IBM Support

IJ32591: RULES CAN BE INCORRECTLY GENERATED IN DEPLOYMENTS WHERE DUAL STACK IS CONFIGURED AND A QRADAR PATCH HAS BEEN APPLIED

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • OPEN

Error description

  • Iptables and ip6tables rules can be incorrectly generated in
    QRadar deployments where dual stack is configured.
    Appliances configured for dual stack are configured so iptables
    and ip6tables are disabled and iptables_update.pl script is
    symlinked to /bin/true.
    When patching to a QRadar version where the hostcontext rpm is
    updated, this configuration is reverted and iptables is
    unexpectedly re-enabled.
    

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IJ32591

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    732

  • Status

    OPEN

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2021-05-10

  • Closed date

  • Last modified date

    2021-07-06

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
07 July 2021