IBM Support

QRadar: Verifying HA crossover connections with

Question & Answer


Is there a way to test the high-availability (HA) crossover connection?


You are seeing a higher that usual load on the management port and want to verify whether the crossover connection is working.


To test the HA crossover connection, here are some commands to verify that your crossover is working and sending data.

To test the crossover status:
QRadar 7.3.0 and greater /opt/qradar/ha/bin/ crossover
QRadar 7.2.8 and prior/opt/qradar/bin/ crossover status

To test the crossover heartbeat:
Qradar 7.3.0 and greater /opt/qradar/ha/bin/ crossover test link
Qradar 7.2.8 and prior/opt/qradar/bin/ crossover test link

QRadar synchronization uses SSH. To test if you can move data between nodes, SSH between the nodes. If you can SSH from each node and back on the crossover connection, data can be synchronized.

[root@QRadar-727-1-primary ~]# ssh
Last login: Mon Nov 21 09:30:18 2016 from
This server has QRadar installed on Tue Nov 8 14:18:53 EST 2016.
[root@QRadar-727-1-secondary ~]#

You can test the link using the cstate command:
QRadar 7.3.0 and greater /opt/QRadar/ha/bin/ha cstate
QRadar 7.2.8 and prior /opt/qradar/ha2/bin/ha cstate

In this example, a 1.0 status equals pass and 0.0 would be fail. LSN refers to the locale node, which is primary at this moment and RSN is the Remote node.

Results: All tests indicate that crossover is working.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"High Availability","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
06 January 2020