Optimizing QNI flow processing

To prevent processing errors due to truncated data in processing QNI flows, you must increase QRadar parameter SV_IPFIX_METADATA_ENCODING_LENGTH to 2048 (default 1024).

Procedure

  1. Use SSH to log in to your QRadar Console appliance as a root user.
  2. Edit the following file: /store/configservices/staging/globalconfig/nva.conf
  3. Add a new parameter SV_IPFIX_METADATA_ENCODING_LENGTH and set the value to 2048.
  4. Save the file and exit the SSH session.
  5. Log in to the QRadar Console.
  6. Click the Admin tab, and then click Deploy Changes.