IBM Support

QRadar: qchange_netsetup leaves both new and old ip in interface

Troubleshooting


Problem

After the admin runs the command qchange_netsetup, network interface shows both the new and old IP addresses.

Symptom

Tried restarting networking but it didn’t clear the cache: 
systemctl restart network
Note: Restarting interfaces could cause network outages. If required schedule a network maintenance window per your organizations requirements.

Cause

The VMware1 node wasn't powered off before the admin changed the VM network configuration.
  1. In the web UI Console for VMware1 VSphere1 client, select the QRadar VM.
  2. Create a network adapter:
    Select Actions > Edit Settings > Add New Device > Network Adapter
  3. Configure network settings as needed.
  4. Select OK
  5. Remove the unneeded network adapter:
    Actions > Edit Settings
  6. Hover over old network adapter and Select 'X' on right side.
If you made changes in VM network settings, you need to restart the VM node before the admin runs the command qchange_netsetup.

Resolving The Problem

  1. Verify two IP addresses are on the interface: 
    ip addr show dev <INTERFACE>
    image-20221026140940-1
  2. Manually removed the old IP with: 
    ip addr del dev <interface> <ip>/<Mask>
  3. Verify IP was successfully removed: 
    ip addr show dev <INTERFACE>
    image-20221026141200-2
    Note: The inet variable from the ip command is showing the new IP address now, and the second IP is no longer visible.
  1. VMware, the VMware logo, VMware Cloud Foundation, VMware Cloud Foundation Service, VMware vCenter Server, and VMware vSphere are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in the United States and/or other jurisdictions.

Document Location

Worldwide

VMware, the VMware logo, VMware Cloud Foundation, VMware Cloud Foundation Service, VMware vCenter Server, and VMware vSphere are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in the United States and/or other jurisdictions.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS005106809","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.3;7.5.0"}]

Document Information

Modified date:
28 October 2022

UID

ibm16615323

Page Feedback