IBM Support

QRadar: Appliance generating CRC and input errors

Troubleshooting


Problem

The appliance is generating millions of CRC and input errors.

Cause

Interface is configured as half duplex

Diagnosing The Problem

Run the command: ethtool ethN
Where N is the ethernet interface associated with the appliance IP.

Check if the ethernet interface is running half duplex.

Resolving The Problem

Before you begin:

  1. It is recommended to run these commands through the IMM or DRAC console as you may loose connectivity to the machine for a few minutes while speeds are reset.
  2. The issue may be a switch speed setting is not on Auto Negotiating. You may also want to hard set the switch to 1000 Mb/s Full Duplex. If this is the case contact your network administrator.

Force the speed of the interface using the "ETHTOOL_OPTS" setting in the file /etc/sysconfig/network-scripts/ifcfg-ethN

Example:

vi /etc/sysconfig/network-scripts/ifcfg-eth0
Append the line as follows to disable Auto-Negotiation, enable Full Duplex and set up Speed to 1000 Mb/s :

ETHTOOL_OPTS="autoneg off duplex full speed 1000"


Where do you find more information?

Related Information

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Integrations - IBM","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1;7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21678799