IBM Support

QFlow service can stop processing flows and swap memory continually grows until qflow service is restarted (APAR IJ29315)

Troubleshooting


Problem

The QRadar® QFlow process can stop receiving and processing flows from some flow sources. When the issue occurs, it causes the received packet count to drop and the swap memory usage to grow continually until the QFlow service is restarted as described in APAR IJ29315. This technical note provides a utility for administrators that can monitor and restart the QFlow service when swap memory grows to prevent administrators from needing to intervene while this issue is reviewed.

Symptom

The processed packet count declines and amount of swap required to process flows increases over time. 

Environment

Memory fixes were implemented to address this type of memory behavior in QRadar® V7.4.1 fix pack 1, but the behavior can still occur.

Diagnosing The Problem

When this issue occurs, administrators might see messages with numeric differences between the packets received and processed. 
qflow: [INFO] [1603076220] Sent 98531 flows on transport connection to xxx.xxx.xxx.xxx:32010
qflow: [INFO] [1603076280] IPFIX Flow Source Stats for default_Netflow: received and processed 13553 packets.

Resolving The Problem

Before you begin
  • You must have root access to the QRadar Console to complete this procedure.
  • This procedure restarts the cron service, administrators might need a maintenance window to complete this procedure.
  1. Download SwapMonitor_script.sh.
  2. Copy the file to /root on the QRadar Console.
  3. To set permissions on the file, type:
    chmod +x SwapMonitor_script.sh
  4. To edit crontab, type: 
    crontab -e
  5. Add the following lines to the end of your crontab file:
    #Run the swap monitor on flow appliances every hour
    0 * * * * /root/SwapMonitor_script.sh >> /var/log/messages 2>&1
  6. To restart the crond service, type:
    systemctl restart crond

    Results
    After services start, the utility SwapMonitor_script.sh runs hourly to evaluate the current swap size, if required the utility restarts the qflow process. After the service is restarted the templates are flushed and swap memory usage returns to normal. Administrators can subscribe to APAR IJ29315 to be notified when this issue is resolved. If you continue to experience issues with received and processed qflow packets, contact QRadar Support for assistance.
     

 

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsuAAA","label":"Flow Source"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.1"}]

Document Information

Modified date:
20 November 2020

UID

ibm16370705