Question & Answer
Question
Why do you see licensing messages such as "GLGLI0003E" on QRadar Network Security (XGS) sensors after making a policy change?
Answer
The XGS is designed so that it only requests a license file if one is required for the current policy configuration. Because of this, each time you change a policy such as the SSL Inspection policy, the sensor removes its licenses and requests an updated set of licenses based on the new policy settings. This results in messages like the following in the system logs:
This behavior is normal and is working as designed so you can safely ignore these messages.
Jun 8 13:47:05 mesa_control[3122]: Policy changes committed
Jun 8 13:47:05 mesa_spad[5541]: GLGPL9001I:: GLG_events:: |policy_names= ,policy=ssl_inbound_decryption_policy,interface=SiteProtector,user=|
Jun 8 13:47:05 mesa_spad[5541]: Detected change in license usage, forcing license download
Jun 8 13:47:20 mesa_config[4372]: Removing licenses
Jun 8 13:47:20 mesa_config[4372]: "Successfully removed license"This behavior is normal and is working as designed so you can safely ignore these messages.
[{"Product":{"code":"SSFSVP","label":"IBM QRadar Network Security"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"SSL Inspection","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SSHLHV","label":"IBM Security Network Protection"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"SSL Inspection","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.3.1;5.3.2;5.3.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
23 January 2021
UID
swg21986091