QRadar: Troubleshooting bandwidth issues on a Managed Host (Passive bandwidth test)

Diagnosing The Problem

1. SSH in to the QRadar Console as the root user.
2. From the command line on the QRadar Console, SSH to the managed host where you want to perform a passive bandwidth test. 
3. Run the following commands needed for calculating the percentage of the bad RDT values:

   QL=${LOG_DIRECTORY}/var/log/qradar.log;total_replication=$(cat $QL | grep -i 'Replication download timing' | awk '{print $10}'| wc -l);ideal_replication=$(cat $QL | grep -i 'Replication download timing' | awk '$10 < 3000' | wc -l);normal_replication=$(cat $QL | grep -i 'Replication download timing' | awk '$10 > 3000' | awk '$10 < 5000' | wc -l);bad_replication=$(cat $QL | grep -i 'Replication download timing' | awk '$10 > 5000' | wc -l);pct_bad=$((100*$bad_replication/total_replication));pct_normal=$((100*$normal_replication/total_replication));pct_ideal=$((100*$ideal_replication/total_replication))

4. Next, run the following command to print the result.

   clear;printf "\n";printf "%-30s | %-110s |\n" ' Total RDT values found' $total_replication;printf "%-30s | %-110s |\n" ' Ideal RDTs (3000ms <)' $ideal_replication\ out\ of\ $total_replication\ ' | '\ $pct_ideal\ '%';printf "%-30s | %-110s |\n" ' Normal RDTs (3000ms<>5000ms)' $normal_replication\ out\ of\ $total_replication\ ' | '\ $pct_normal\ '%';printf "%-30s | %-110s |\n" ' Bad  RDTs (>5000ms)' $bad_replication\ out\ of\ $total_replication\ ' | '\ $pct_bad\ '%';printf "\n\n\n"

5. The result is presented as follows: