Topic
  • 5 replies
  • Latest Post - ‏2013-12-10T17:22:27Z by networkingkool
vindal0012
vindal0012
5 Posts

Pinned topic Troubleshooting the QRadar UI (Browser losing connection)

‏2013-08-22T05:33:18Z |

Hi all,

I am a bit new in the IBM QRadar SIEM product and my question may be silly. Unlike other IBM security solutions, QRadar does not seem to have any command line interface to perform some troubleshooting steps. From time to time, the browser seems to lose connection to the appliance. Afterwards, I cannot seem to reconnect it, I have to restart the appliance which is inconvenient. Is there a way to manually reset the connection of the browser? How do I determine the port being used by the UI.

  • dwight s (IBM)
    dwight s (IBM)
    22 Posts

    Re: Troubleshooting the QRadar UI (Browser losing connection)

    ‏2013-08-22T14:35:42Z  

    Hi Vindal .. 

    You can ssh to the qradar system and login as root (you'll need the password) to do some basic troubleshooting.  The system runs on Redhat Linux, so if  you're familiar with linux, you should be fine.

    The web ui is in constant communication with the qradar console via the web service httpd and tomcat, running over port 443.  This constant communication is to update things in the UI, such as the messages, dashboard items, search results (if looking at last interval or real time streaming).  If this connection isnt' available, you will see a popup in the ui saying "connection to console has been lost".   We've seen VPN users and remote WAN users have this issue occur if latency to the QRadar system is higher.  Are you hitting the console from a fair distance away?  Are other users also seeing this behavior?  A quick browser reload SHOULD reload the page, though it does go back to the default dashboard.  If you are not able to hit the web portal when you get this, then there may be something going on , on the system itself, to stop the web service, and we would want to investigate that.

    A quick check on the system, is to ssh to the console and run the command "service tomcat status" and "service httpd status", and ensure the web services are running properly:

    [root@csd12 ~]# service tomcat status
    tomcat (pid 29929) is running...
    [root@csd12 ~]# service httpd status
    httpd (pid  4877) is running...
    [root@csd12 ~]# 
     

    If you find that the services are not running, then you should open a ticket with QRadar support and upload the log files from the system.  To grab  a snapshot of the logs, you can run the command "/opt/qradar/support/get_logs.sh".  This will create a package of log files, which you can download from the qradar system with winscp, and then attach to the ticket.  Support can take a look through that, to see what's going on with the web services.

    dwight s. 

  • networkingkool
    networkingkool
    4 Posts

    Re: Troubleshooting the QRadar UI (Browser losing connection)

    ‏2013-12-05T15:47:00Z  

    Hi Vindal .. 

    You can ssh to the qradar system and login as root (you'll need the password) to do some basic troubleshooting.  The system runs on Redhat Linux, so if  you're familiar with linux, you should be fine.

    The web ui is in constant communication with the qradar console via the web service httpd and tomcat, running over port 443.  This constant communication is to update things in the UI, such as the messages, dashboard items, search results (if looking at last interval or real time streaming).  If this connection isnt' available, you will see a popup in the ui saying "connection to console has been lost".   We've seen VPN users and remote WAN users have this issue occur if latency to the QRadar system is higher.  Are you hitting the console from a fair distance away?  Are other users also seeing this behavior?  A quick browser reload SHOULD reload the page, though it does go back to the default dashboard.  If you are not able to hit the web portal when you get this, then there may be something going on , on the system itself, to stop the web service, and we would want to investigate that.

    A quick check on the system, is to ssh to the console and run the command "service tomcat status" and "service httpd status", and ensure the web services are running properly:

    [root@csd12 ~]# service tomcat status
    tomcat (pid 29929) is running...
    [root@csd12 ~]# service httpd status
    httpd (pid  4877) is running...
    [root@csd12 ~]# 
     

    If you find that the services are not running, then you should open a ticket with QRadar support and upload the log files from the system.  To grab  a snapshot of the logs, you can run the command "/opt/qradar/support/get_logs.sh".  This will create a package of log files, which you can download from the qradar system with winscp, and then attach to the ticket.  Support can take a look through that, to see what's going on with the web services.

    dwight s. 

    Hi,

    I got the same problem with him after add secondary Qradar 3105 to HA. I saw two services are stopped.

  • dwight s (IBM)
    dwight s (IBM)
    22 Posts

    Re: Troubleshooting the QRadar UI (Browser losing connection)

    ‏2013-12-10T04:50:27Z  

    Hi,

    I got the same problem with him after add secondary Qradar 3105 to HA. I saw two services are stopped.

    hi NK... 

    while HA is being setup, there are file system changes that can take place, and while in progress, these UI services are shut down for a period of time.  These file system changes can take some time, as they are resizing the file system to allow for some free space for disk replication maintenance between the hosts.   If you are on a xx24 console system, you could be looking at  few hours for the resize to complete. 

    dwight s. 

  • networkingkool
    networkingkool
    4 Posts

    Re: Troubleshooting the QRadar UI (Browser losing connection)

    ‏2013-12-10T17:14:01Z  

    hi NK... 

    while HA is being setup, there are file system changes that can take place, and while in progress, these UI services are shut down for a period of time.  These file system changes can take some time, as they are resizing the file system to allow for some free space for disk replication maintenance between the hosts.   If you are on a xx24 console system, you could be looking at  few hours for the resize to complete. 

    dwight s. 

    Hi dwight

    Forget this case please! After adding HA wizard, the primary one got shutdown unexpectedly whenever it completely booted. I have to factory reset two appliances then do a clean installation with the latest ISO image. 

    Now I implemented the HA successfully. I realized that It take nearly 24 hours to make the full disk synchronization.

    I have a new question about HA in this link, if you know anything, please reply to it

    https://www.ibm.com/developerworks/community/forums/html/topic?id=f0f149e7-5ba0-41b9-b23f-0387cbc9dea7#c8d349a8-e275-426c-aea5-d633169bf1b3

     

    Thanks

  • networkingkool
    networkingkool
    4 Posts

    Re: Troubleshooting the QRadar UI (Browser losing connection)

    ‏2013-12-10T17:22:27Z  

    hi NK... 

    while HA is being setup, there are file system changes that can take place, and while in progress, these UI services are shut down for a period of time.  These file system changes can take some time, as they are resizing the file system to allow for some free space for disk replication maintenance between the hosts.   If you are on a xx24 console system, you could be looking at  few hours for the resize to complete. 

    dwight s. 

    Hi,

    I also realized that when I change some settings in "manage system" such as system time, It also restart tomcat and httpd service then loss connection to web console. It is not a big impact, but it make me some dislikes.

    Thanks