IBM Support

QRadar: Data to be provided to the QRadar support team to troubleshoot email related issues

Question & Answer


Question

What information does the IBM QRadar Support team require to effectively diagnose an email issue in QRadar?

Answer

  1. Confirm whether the configuration of the email server was done on the Managed Host(MH) or the Console.
  2. Run the following on the host where the mail server is configured (Console or MH) and attach the archive generated to the case
    /opt/qradar/support/get_logs.sh -s -q 5
  3. Collect the screenshots based on these instructions:
    1. Screenshots of mail server configuration (On the Admin tab, click Email Server Management)
    2. Verify and test the connection from the Console or Managed Host to the email server. Kindly follow the steps and share screenshots as mentioned:
      • Log in to QRadar UI.
      • Go to the Admin tab
      • In the "System & Configuration" section, click "System and License Management".
      • From the Display list, select System.
      • Double-click the target host (Console or MH) and go to the email server (share screenshot of this page)
      • Verify whether the mentioned email server is correct.
      • Ensure that the test connection works - click on "Test Connection" and share a screenshot of the same. image-20231011195459-1
  4. Run the following commands on the target host for mail server (Console or MH) and save the output in a text file and send to IBM Support for review:

    telnet IP or smtp.my_mail_server.com 25
    systemctl status postfix
    mailq

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwthAAA","label":"Offenses"},{"code":"a8m0z000000cwtmAAA","label":"Reports"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
14 November 2023

UID

ibm17033024