IBM Support

QRadar: Job for snmpd.service failed because the control process exited

Question & Answer


Question

Is the Simple Network Management Protocol (SNMP) daemon state supposed to be failed?
The following command displays the SNMP daemon status as failed:
systemctl status snmpd

snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
   Loaded: loaded (/usr/lib/systemd/system/snmpd.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/snmpd.service.d
           └─qradar.conf
   Active: failed (Result: exit-code) since Thu 2020-12-17 15:13:52 EST; 34min ago
<Date and Time> <IP>  systemd[1]: Starting Simple Network Management Protocol (SNMP) Daemon....
<Date and Time> <IP>  snmpd_precheck.sh[2836]: Failed to start, LINUX_AGENT_SNMP_ENABLED is disabled in nva.conf.
<Date and Time> <IP>  snmpd_precheck.sh[2836]: To enable it, set LINUX_AGENT_SNMP_ENABLED=yes
<Date and Time> <IP>  systemd[1]: snmpd.service: control process exited, code=exited status=1
<Date and Time> <IP>  systemd[1]: Failed to start Simple Network Management Protocol (SNMP) Daemon..
<Date and Time> <IP>  systemd[1]: Unit snmpd.service entered failed state.
<Date and Time> <IP>  systemd[1]: snmpd.service failed.
In /var/log/qradar.log, you see errors such as:
ErrorStream snmpd: Job for snmpd.service failed because the control process exited with error code

Cause

The SNMP daemon is disabled by default on IBM® QRadar® installations.  Unless the daemon needs to be active, the failed state and errors messages are expected and can be safely ignored.

Answer

If you plan to monitor your IBM® QRadar® appliance via the Simple Network Management Protocol, the SNMP Agent needs to be enabled:
  1. Within the QRadar® User Interface, click the Admin tab.
  2. Go to System Settings.
  3. Go to "Embedded SNMP Daemon Settings".
  4. Set "Enabled" to "yes".

    Note: Deploy Changes might result in services being restarted. While services are restarting, event processing stops until services restart. Scheduled reports that are in-progress will need to be manually restarted by users. Administrators with strict outage policies are advised to complete the next step during a scheduled maintenance window for their organization.
  5. Deploy the change.
     

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtEAAQ","label":"Log Activity"}],"ARM Case Number":"TS004030789","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
27 December 2020

UID

ibm16386596