IBM Support

IJ11384: NAPATECH3 SERVICE CAN DIE WHEN MULTIPLE NETWORK INSIGHTS APPLIANCES ARE IN A STACKED CONFIGURATION

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that the napatech3 service can die and
    fail to start in a multiple QRadar Network Insights appliance
    stacked configuration.
    When this occurs there is an interuption in flow collection and
    no notification of the service failure.
    Messages similar to the following might be visible in
    /var/log/messages when this issue is occuring:
    ntservice: Executing NTPL file:
    /opt/napatech3/config/qni_ntconfig.ntpl
    ntservice: NTPL CMD: # NTPL file generated by QRadar for host
    <ip_address>
    ntservice: NTPL CMD:  HashMode=Hash5TupleSorted
    ntservice: NTPL CMD:  Setup[NUMANode=0] = StreamID==(1..8)
    ntservice: NTPL CMD:  Setup[NUMANode=1] = StreamID==(9..16)
    ntservice: NTPL CMD:  Assign[StreamID=(1..8)] = Port==0,1
    ntservice: Error during _HandleAssignData: No available
    hostbuffers
    ntservice: >>> Parsing expression " Assign[StreamID=(1..8)] =
    Port==0,1" failed.
    ntservice: >>> Error: 0x20002061
    ntservice: >>> No available host buffer found matching the
    command
    ntservice: >>>
    ntservice: >>>
    napatech3[122902]: Starting NTService (this may take a while)
                   [Failed]
    ntservice:
    ****************************************************************
    ****
    ntservice: *                Something failed during init.
                  *
    ntservice: *          Please check the complete log for more
    info.            *
    ntservice:
    ****************************************************************
    ****
    

Local fix

  • Contact Support for a possible workaround that might address
    this issue in some instances.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.3.1 patch 8
    and 7.3.2 GA.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.3.1 patch 8
    and 7.3.2 GA.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ11384

  • Reported component name

    QR INCIDENT FOR

  • Reported component ID

    5725QIFSW

  • Reported release

    731

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-11-16

  • Closed date

    2019-03-06

  • Last modified date

    2019-03-06

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QR INCIDENT FOR

  • Fixed component ID

    5725QIFSW

Applicable component levels

  • R731 PSY

       UP

  • R732 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SS6E69","label":"IBM QRadar Network Insights"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Edition":""},{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSUK44","label":"IBM Security QRadar Incident Forensics"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Edition":""}]

Document Information

Modified date:
06 March 2019