Troubleshooting
Problem
An automated task that verifies the internal QVM contract date on fresh installs or newly licensed QRadar Vulnerability Manager systems might prevent a scan from starting as expected.
Symptom
This issue can affect any QRadar Vulnerability Manager that is a new install or a newly licensed at version 7.2.x.
When this issue occurs, scans in QRadar Vulnerability Manager might not start a scan as expected. This is because the automated script that updates the contract date has not had the opportunity to run.
Cause
Every night at 6:00 a.m. (Console time), an automated task runs to check if the activation date for the license needs to be updated. If an administrator has just installed or recently added a QRadar Vulnerability Manager license to activate this feature, then the script might not have had a chance to launch and can prevent scans from starting. When this issue occurs, no error message is generated for the user.
There are two main use cases where the activation end date could cause an issue for administrators:
- Customers want to run QVM scans the same day* they installed QRadar from an ISO (fresh installation).
- Customers want to run QVM scans the same day* they licensed QVM on an preexisting QRadar system.
* Until 6am the following day.
Diagnosing The Problem
If a scan fails to start after a new appliance is commissioned by an administrator, then the activation date might need to be updated.
Resolving The Problem
The administrator can take one of the following actions to resolve this issue.
- Wait until after 6:00am to start the first scan for a fresh install or newly licensed QRadar Vulnerability Manager product.
- Manually update the activation date for QRadar Vulnerability Manager.
Note: This procedure should only be attempted by administrators experienced with database changes and requires root access to the appliance hosting QRadar Vulnerability Manager.
To manually update the activation date for QRadar Vulnerability Manager
Procedure
- Using SSH, log in to the appliance hosting the QRadar Vulnerability Manager Processor as a root user.
- To force the contract to update, the adminsitrator can run the following command: psql -U fusionvm -p 15433 -c "select cw_schedule_checkforcontractend()"
- Log in to the QRadar user interface.
- Click the Vulnerabilities tab.
- Select a scan profile.
- Click Actions > Run Now.
The scan status should change to Running shortly after starting the scan.
Where do I find more information?
If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support:
- Online QRadar Customer Forums
- Submit and manage your support tickets online 24x7 using IBM Service Request
- QRadar Downloads - IBM Fix Central
Was this topic helpful?
Document Information
Modified date:
10 May 2019
UID
swg21694490