Troubleshooting iSCSI issues

To prevent iSCSI disk and communication issues, you must connect QRadar®, the iSCSI server, and your network switches to an uninterruptible power supply (UPS). Power failure in a network switch might result in your iSCSI volume reporting disk errors or remaining in a read-only state.

About this task

In a high-availability (HA) environment, if your primary host fails, you must restore your iSCSI configuration to the primary host. In this situation, the /store or /store/ariel data is already migrated to the iSCSI shared external storage device. Therefore, to restore the primary host iSCSI configuration, ensure that you configure a secondary HA host. For more information, see Configuring iSCSI in a HA deployment

Procedure

Determine whether a disk error exists.
1. Using SSH, log in to QRadar Console as the root user.
2. Create an empty file filename.txt on your iSCSI volume by typing one of the following command:
  - touch /store/ariel/filename.txt
  - touch /store/filename.txt
If your iSCSI volume is mounted correctly and you have write permissions to the volume, the touch command creates an empty file that is named filename.txt on your iSCSI volume.

If you see an error message, unmount and remount the iSCSI volume.
Stop the QRadar services.
- If you migrated the /store file system, type the following commands in the specified order:
```
systemctl stop hostcontext
systemctl stop ecs-ec-ingress
systemctl stop tomcat
systemctl stop hostservices
systemctl stop systemStabMon
systemctl stop crond
```
- If you migrated the /store/ariel file system, type the following command:
```
systemctl stop hostcontext
```
Unmount the iSCSI volume.
- If you migrated the /store file system, type the following commands:
```
umount /store
```
- If you migrated the /store/ariel file system, type the following command:
```
umount /store/ariel
```
Mount the iSCSI volume.
- If you migrated the /store file system, type the following commands:
```
mount /store
```
- If you migrated the /store/ariel file system, type the following command:
```
mount /store/ariel
```
Test the mount points.
- If you migrated the /store file system, type the following command:
```
touch /store/filename.txt
```
- If you migrated the /store/ariel file system, type the following command:
```
mount /store/ariel/filename.txt
```
If you continue to receive a read-only error message after you remount the disk, then reconfigure your iSCSI volume.

Alternatively, you can unmount the file system again and run a manual file system check with the following command: fsck /dev/partition.
Start the QRadar services.