IBM Support

QRadar: License pool allocation displays N/A for one or more hosts

Troubleshooting


Problem

License pool allocation displays N/A for one or more managed hosts.

Symptom

  1. On the navigation menu, click Admin.
  2. In the System Configuration section, click System and License Management.
  3. From the Display list, select Licenses.
  4. Click License Pool Management.
  5. Displayed is one or more hosts with N/A for average EPS value:
    image-20230620162157-1
 
Alternatively, you might see an error in /var/log/qradar.error:
grep -i accumulator /var/log/qradar.error
[accumulator_rollup.accumulator_rollup] [accumulator_rollup.accumulator_rollup] com.q1labs.frameworks.core.ThreadExceptionHandler: [ERROR] [NOT:0000003000][{CONSOLE}/- -] [-/- -]Exception was uncaught in thread: accumulator_rollup.accumulator_rollup 
[accumulator_rollup.accumulator_rollup] [accumulator_rollup.accumulator_rollup] java.lang.NullPointerException 
(..) 
[accumulator.accumulator] [AccumulationService] com.q1labs.cve.accumulation.AggregationService.events: [ERROR] [NOT:0000003000][{CONSOLE}/- -] [-/- -]Unable to create aggregator for view:10058 [accumulator.accumulator] [AccumulationService] java.lang.NullPointerException

Cause

  • Accumulator is running out of memory or time
  • Not enough CPUs assigned to the host
  • Hosts file is not correct
  • Saved search Event Rate (EPS) or Flow Rate (FPS) is missing or linking is broken
  • Duplicate search was created that is interfering with the out of the box search
  • Duplicate search changes the out of the box search

Resolving The Problem

  1. Verify that accumulator performance is not an issue.
  2. Validate /etc/hosts file and /etc/hosts.default on Console:
    • Is the host IP that is displaying N/A in the hosts file only once?
    • Is the host short name on the same line with the IP address?
    • Is the host fully qualified domain name (FQDN) on the same line with the IP address?

    Note: Check whether the issue is resolved by closing and reopening Admin > System and License Management > Display: Licenses > License Pool Management.
     
  3. Sometimes the system doesn't have enough cpu resources to complete the algorithm. You might notice a notification SAR Sentinel: threshold crossed, and an error in /var/log/qradar.error similar to: 
    grep -i sarsentinel /var/log/qradar.error | less +G
[hostcontext.hostcontext] [Thread-205] com.q1labs.hostcontext.sar.SarSentinel: [WARN] [NOT:0150124100][{HostIP}/- -] [-/- -]System load over 1 minute has an average of 11.5 over the past 5 intervals, and has exceeded the configured threshold of 10.8.

    Increase CPU cores from minimum to recommended cores. For example, increasing an EP VM 8 cpu cores to 24 cores.

    Note: Check whether the issue is resolved by closing and reopening Admin > System and License Management > Display: Licenses > License Pool Management.

 
 

Work around: If you are requiring current EPS rates, pull from the CLI on the console the rates:

/opt/qradar/support/all_servers.sh -C 'grep -i "Incoming raw event rate" /var/log/qradar.log | tail -n 2'

The grep command on the logs returns the 5 second, 10s, 15s, 30s, 60s (1 minute), 300s (5 minutes), and 900s (15 minutes) accurate averages for all servers in your environment.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"},{"code":"a8m0z000000cwtiAAA","label":"Performance"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.0"}]

Document Information

Modified date:
30 June 2023

UID

ibm17005653

Page Feedback