IBM Support

IBM QRadar Network Security (IQNS) debug logging

Question & Answer


Question

How do you set IBM QRadar Network Security (IQNS) debug logging?

Answer

Alpsd debugging
  1. Log in to appliance via SSH.
  2. Type: analysis debug <type in the needed debug level>
    Debug level options:
    0 - turns off debugging
    1 - alpsd level 1 (event detection level)
    2 - alpsd level 2 (verbose packet tracking level)
  3. Reproduce issue after turn off debug logging.
    Type: analysis debug 0
  4. Generate a support file.

Notes:
  • Potential performance impact of debug logging on a busy sensor, which increases with logging levels implemented (2 would have a greater impact than 1, for example).
  • It is importance that you set logging, reproduce the issue, and quickly turning off logging when finished. This is also important for debug level 2, as it can roll over logs quickly.
  • Be sure that you turn off any debug logging before trying to generate the support file.


Event response (eventsd) debugging
  1. Open Advanced Tuning Parameters policy.
  2. Add the following parameter:
    Name: events.debug.level
    Value: 2
  3. Reproduce issue and generate a support file.
  4. Remove parameter or set to 0 to turn off debug logging.

LUM and update debugging
  1. Open Advanced Tuning Parameters policy
  2. Add the following parameter:
    Name: update.log.level
    Value: 2
  3. Log into the XGS via SSH and restart the License and Update service via the CLI.
    Type: services restart  and enter the index number of the entry "License and Update" then enter YES.
  4. Reproduce issue and generate a support file.
  5. Remove parameter or set to 0 to turn off debug logging.

Note: As an option you can enable the LUM MSL logging parameter:
  • Name: msl.trace.lum
    Value: true


SPA and heartbeat debugging
  1. Open Advanced Tuning Parameters policy.
  2. Add the following parameter:
    Name: spad.debug.level
    Value: 2
  3. log in to the XGS via SSH and restart the SiteProtector Communication service via cli.
    Type: services restart and enter the index number of the entry "SiteProtector Communication" then enter YES
  4. Reproduce issue and generate a support file.
  5. Remove parameter or set to 0 to turn off debug logging.

Note: As an option you can enable the SPA MSL logging parameter:
  • Name: msl.trace.spa
    Value: true


web Server and LMI debugging
  1. Open Advanced Tuning Parameters policy.
  2. Add the following parameter:
    Name: lmi.debug.enabled
    Value: 1
  3. Save and deploy the policy. This restarts the LMI service automatically.
  4. Reproduce issue and generate a support file.
  5. Remove parameter or set to 0 to turn off debug logging.

[{"Product":{"code":"SSFSVP","label":"IBM QRadar Network Security"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Tuning Parameters","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SSHLHV","label":"IBM Security Network Protection"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"Tuning Parameters","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.3.1;5.3.2;5.3.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
21 January 2021

UID

swg21987352

Page Feedback