How To
Summary
The QRadar Deployment Intelligence (QDI) Component Status Feed overview reports components as Unavailable.
Objective
To understand why you might see, some components in the QDI Component Status Feed showing as Unavailable.
Environment
7.3.2
Steps
- Under the QDI tab, in the Component Status Feed window, check what processes, and components are showing Unavailable. Some child processes are managed by hostcontext. If the hostcontext is manually restarted or a Full Deploy is run, which restarts child processes. The result is some components showing temporarily Unavailable.
Note: You can check that all services are running with a wait_for_start script. See the article, QRadar: Monitor Hostcontext processes with wait_for_start.sh.
- QDI Component Status Feed relies on the QRadar health metrics for its statuses, so when a component goes down for any reason, the component Status Feed reports it Unavailable. As shown in the screen capture, the Component Status Feed reports that the processes on a host went Unavailable. The Unavailable status does occur when hostcontext is manually restarted, perform a Full Deploy, or if an issue is encountered.
- Make sure that all filters are removed from the Component Status Feed to verify the most current statuses. The Component Status Feed does not update previously logged messages; instead, it logs recent status changes and appends it to the scrolling list of statuses. In the screen capture, the filter results on unavailable, so it was not displaying when components became available.
Additional Information
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Apps","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
07 January 2021
UID
ibm11273966