APAR status
Closed as program error.
Error description
The QRadar qflow process can stop receiving and processing flows from some flow sources causing the received packet count to drop and the qflow swap memory to start growing continually until the qflow service is restarted. Memory fixes were implemeted to address this behavior within QRadar QRM QVM release 7.4.1 FixPack1, but the behavior can still occur.
Local fix
A technical note with a support utility is available for this issue to assist administrators. For more information about the SwapMonitor utility for APAR IJ29315, see: https://www.ibm.com/support/pages/node/6370705
Problem summary
This issue was fixed in QRadar QRM QVM release of 7.4.2 FixPack 2 and 7.3.3 FixPack 8.
Problem conclusion
This issue was fixed in QRadar QRM QVM release of 7.4.2 FixPack 2 and 7.3.3 FixPack 8.
Temporary fix
Comments
APAR Information
APAR number
IJ29315
Reported component name
QRADAR SOFTWARE
Reported component ID
5725QRDSW
Reported release
741
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2020-11-16
Closed date
2021-01-28
Last modified date
2021-05-03
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
QRADAR SOFTWARE
Fixed component ID
5725QRDSW
Applicable component levels
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"741"}]
Document Information
Modified date:
04 May 2021