IBM Support

Unable to log in to the QRadar Console in V7.2.6



In IBM Security QRadar V7.2.6, you can't log in to the Qradar Console from a computer that is within the IP address range.


If you log in to the QRadar Console by using SSH or the web, access to the QRadar Console is denied from computers that are within the IP address range.


The IP address range is the default range that is used by Docker as a part of the QRadar App Framework.

Resolving The Problem

To resolve the issue, try one of these workarounds:

  • If possible, don't log in to a QRadar Console V7.2.6 from computers that are within the IP address range.
  • If you do not use apps, you can temporarily disable the Docker process that QRadar uses. To disable the Docker process, follow these steps:
    1. Open a terminal and use SSH to log in to your QRadar console from an IP address that is outside the address range.
    2. Enter the following commands:
      /opt/qradar/init/qdocker -m stop

      ip link set docker0 down

      brctl delbr docker0

      The Docker process is restarted when the QRadar disk maintenance processes are next run.

  • If you are using apps in QRadar or must connect from machines within the IP address range, contact QRadar support for help to change the default IP range that Docker uses.

    Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018