IBM Support

QRadar: QRadar Deployment Intelligence (QDI) App is Missing CPU Health Metrics

Troubleshooting


Problem

QRadar Deployment Intelligence (QDI) allows administrators to monitor their deployment health and visualize specific metrics. In QRadar 7.2.8 and 7.3, CPU charts show no data. This technical note informs administrators how to enable CPU metrics.

Cause

This is not a defect with the QDI App, but an issue related to a missing CPU metric definitions in QRadar 7.2.8 and 7.3.0 installations. This issue is resolved in QRadar with the future release of QRadar 7.3.1. Administrators with QRadar 7.2.8 or QRadar 7.3.0 will need to run the associated sql file on all QRadar managed hosts in the deployment to collect CPU metrics from all appliances.


When this issue occurs, CPU utilization metrics will display N/A as there are no metric definitions from QRadar 7.2.8 and 7.3.0 for QDI to collect. The sql file attached in this technical note allows QDI to display this data to administrators.

Figure 1: Example image of the CPU Utilization after the fix is applied. It might take several minutes for these values to display.


Resolving The Problem

Before you begin
This procedure works with both the 7.2.6 and 7.2.8+ versions of QDI available from the IBM App Exchange and must be run on all primary appliances in a distributed deployment. For administrators using HA pairs, it is not required to run the utility on the secondary appliance in stand-by as the files are replicated to the secondary host from the primary.

Note: This procedure is not required, if you are using QRadar 7.3.1.

Procedure

  1. Download the QDI_CPU_metrics_delta.sql script attached in this procedure.
    QDI_CPU_metrics_delta.sql
    md5sum 831f99c9977adba63a4887bacc67228d
  2. Using WinSCP or equivalent tool, transfer this file to the /tmp directory on the Console.
  3. Log in to the QRadar Console as the root user.
  4. To verify the file integrity, type the following command to compare the sql file to the MD5 sum provided with the download.
    md5sum QDI_CPU_metrics_delta.sql
  5. Copy the script to all the appliances in the deployment by using this command
    /opt/qradar/support/all_servers.sh -p /tmp/QDI_CPU_metrics_delta.sql | tee QDI_transfer.log
  6. To import the missing CPU metrics definitions, run this command on the Console to install the CPU Health Metrics definitions.
    /opt/qradar/support/all_servers.sh -C "psql -U qradar -a -f /tmp/QDI_CPU_metrics_delta.sql" | tee QDI_update.log
    Note: Administrators should retain both QDI log files from this procedure for reference in case troubleshooting is required. Running the script a second time will not cause appliance issues and overwrite the log file output. For troubleshooting purposes, it is recommended that you rename the logs if you attempt to complete this procedure a second time.
  7. From the QRadar User Interface refresh the QDI tab.

Results

The data for CPU health metrics is available to the QDI app for appliances in the QRadar deployment. It might take several minutes for the data to display in the QDI application. If you do not see CPU metrics, it is recommended that you clear your browser cache and log back in to QRadar. If you have questions about this procedure or any issues, ask us in the QRadar forums. QRadar Deployment Intelligence app questions can be filtered using the QDI tag in the forum.


Where do you find more information?



[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"App","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg22008102

Page Feedback