Troubleshooting
Problem
When a managed host is not able to retrieve the current values of the database, a mismatch occurs between the two databases.
Symptom
As the database on the managed host grows, deploys might fail and replication errors are seen on the managed host:
replication [NOT:0280014100]psql failed to restore /store/replication/tx[N].sql, error: 768
Cause
The cause of this problem is a mismatch between the Console's database and the managed host's database local copy.
Diagnosing The Problem
Administrators can compare database sizes between the managed host and the Console by running the following command on each host and comparing the values:
psql -U qradar -c "select * from q_table_size;"
Resolving The Problem
To resolve this problem, administrators can force the conflicting managed host to obtain a new copy of the database.
- Log in to the Console as the root user.
- SSH to the conflicting managed host.
- Stop the hostcontext service manually.
systemctl stop hostcontext - Obtain a new copy of the database by running the following script.
Note: The script starts the hostcontext service automatically./opt/qradar/bin/replication.pl -rebuild - Wait 5 minutes after the script finishes.
- Verify that the hostcontext service remains up.
systemctl status hostcontext
Result
The managed host database local copy is now synchronized with the Console. If hostcontext does not remain up, administrators can run a configuration deploy manually. If the issue persists, contact QRadar Support for assistance.
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.3"}]
Was this topic helpful?
Document Information
Modified date:
16 May 2024
UID
ibm17091379