IBM Support

QRadar: Configuring jumbo frame MTU to match switch settings

How To


Summary

The purpose of this article is show when and how QRadar can be configured to use higher than MTU 1500 value for network interfaces.

Environment

SSH to QRadar host you wish to alter MTU and run this command:
# lspci -vvv|grep Ether
07:00.0 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
07:00.1 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
07:00.2 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
0f:00.0 Ethernet controller: Intel Corporation 82599ES 10-Gigabit SFI/SFP+ Network Connection (rev 01)
0f:00.1 Ethernet controller: Intel Corporation 82599ES 10-Gigabit SFI/SFP+ Network Connection (rev 01)
Results
Intel Ethernet adapters should be listed in the command line. If you do not see Intel Ethernet adapters in the command line query below, work with your network team to change MTU to the default 1500.

Steps

Before you begin
  • The procedure applies to QRadar software installs only on a clients own hardware.
  • These steps do not apply to IBM® QRadar® appliance installs that have Broadcom ethernet adapters.
  • The procedure also applies to virtual machines.
  1. SSH to QRadar Console.
  2. Optional: From the Console SSH to the appliance with Intel ethernet adapters.
  3. Navigate to /etc/sysconfig/network-scripts/ directory.
  4. Edit the ifcfg-<interface> file.
    For example, if the interface is eno1 use ifcfg-eno1 for ifcfg-<interface>.
  5. Add a new line to the end of the file: MTU=9000.
  6. Save the file.
    Important: Restarting network services might temporarily stop event collection and other QRadar functionality while the service restarts. Administrators with strict outage policies are advised to complete the next step during a scheduled maintenance window for their organization.
  7. Restart network services: systemctl restart network.
Results
Administrators can use the ethtool command to verify if the interface displays errors. If the MTU of QRadar interface and the switch are mismatched, CRC or frame errors can be displayed. If the two errors are greater than zero, follow the steps on this guide to resolve the MTU mismatch issue on QRadar side.
For example,
ethtool -S eno1|grep -i 'frame\|crc'
     rx_crc_errors: 0
     rx_frame_errors: 0

Additional Information

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
10 September 2020

UID

ibm16255686