IBM Support

QRadar Deployment Intelligence (QDI) Component Status Feed reporting Unavailable

How To


Summary

The QRadar Deployment Intelligence (QDI) Component Status Feed overview reports components as Unavailable.

Objective

To understand why you might see, some components in the QDI Component Status Feed showing as Unavailable.

Environment

7.3.2

Steps

  • Under the QDI tab, in the Component Status Feed window, check what processes, and components are showing Unavailable. Some child processes are managed by hostcontext. If the hostcontext is manually restarted or a Full Deploy is run, which restarts child processes. The result is some components showing temporarily Unavailable.

    Note: You can check that all services are running with a wait_for_start script. See the article, QRadar: Monitor Hostcontext processes with wait_for_start.sh.
     
  • QDI Component Status Feed relies on the QRadar health metrics for its statuses, so when a component goes down for any reason, the component Status Feed reports it Unavailable. As shown in the screen capture, the Component Status Feed reports that the processes on a host went Unavailable. The Unavailable status does occur when hostcontext is manually restarted, perform a Full Deploy, or if an issue is encountered.
     
  • Make sure that all filters are removed from the Component Status Feed to verify the most current statuses. The Component Status Feed does not update previously logged messages; instead, it logs recent status changes and appends it to the scrolling list of statuses. In the screen capture, the filter results on unavailable, so it was not displaying when components became available. 


    image-20200212105526-1

Additional Information

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Apps","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
07 January 2021

UID

ibm11273966