IBM Support

IJ06593: QRADAR CAN SOMETIMES NOT INGEST/PROCESS PCAP FILES UNTIL A DEPLOY FULL CONFIGURATION IS PERFORMED

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as unreproducible in next release.

Error description

  • It has been identified that when PCAPs are configured to be
    received/processed by QRadar, a Deploy Full Configuration can
    sometimes be required for proper ingestion and processing of
    those PCAP files.
    

Local fix

Problem summary

  • PCAP files was replayed and the flows were seen. We couldn't
    reproduce the issue.
    

Problem conclusion

  • PCAP files was replayed and the flows were seen. We couldn't
    reproduce the issue.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ06593

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED UR1

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-05-22

  • Closed date

    2018-07-30

  • Last modified date

    2018-07-30

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Edition":""}]

Document Information

Modified date:
30 July 2018