IBM Support

QRadar: "Alert Email from Address" value is set in System Settings but reverts back to the default mail "QRADAR@localhost.localdomain"

Question & Answer


Question

An email address in System Settings -> "Alert Email from Address" is set, but it is overridden to the default value QRADAR@localhost.localdomain by upgrades or full deploys. How to change this address without it reverting to default?

Answer

Resolution:

The workaround for this issue is as follows:

  1. Create backups of the nva.conf files: 
    mkdir -v /storetmp/ibm_support/nvaconfbackup/
mkdir: created directory ‘/storetmp/ibm_support/nvaconfbackup’

mkdir -v /storetmp/ibm_support/nvaconfbackup/deployed
mkdir: created directory ‘/storetmp/ibm_support/nvaconfbackup/deployed’

mkdir -v /storetmp/ibm_support/nvaconfbackup/staging
mkdir: created directory ‘/storetmp/ibm_support/nvaconfbackup/staging’



cp -pv /store/configservices/deployed/globalconfig/nva.conf /storetmp/ibm_support/nvaconfbackup/deployed/
‘/store/configservices/deployed/globalconfig/nva.conf’ -> ‘/storetmp/ibm_support/nvaconfbackup/deployed/nva.conf’

cp -pv /store/configservices/staging/globalconfig/nva.conf /storetmp/ibm_support/nvaconfbackup/staging/
‘/store/configservices/staging/globalconfig/nva.conf’ -> ‘/storetmp/ibm_support/nvaconfbackup/staging/nva.conf’
  2. Edit the nva.conf files: 
    vi /store/configservices/deployed/globalconfig/nva.conf
vi /store/configservices/staging/globalconfig/nva.con
  3. Modify the line ADMIN_ALERT_EMAIL_FROM_ADDRESS= and change the Email address to one that corresponds more correctly to your company.
    From: 
    ADMIN_ALERT_EMAIL_FROM_ADDRESS=QRADAR@localhost.localdomain
    To: 
    ADMIN_ALERT_EMAIL_FROM_ADDRESS=<new_mail_address>
    Change <new_mail_address> to the new value that you want to apply.
  4. Log in to your QRadar Console UI with a Administrative Account
  5. Click on the Admin Tab.
    There are undeployed changes
    DeplyChanges
  6. Click on Deploy Changes.
Results: When the Deployment has completed, open the System Settings application and confirm the Alert Email From Address remains as the Email address you entered and it has not reverted back to QRADAR@localhost.localdomain.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"TS014830750","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
16 May 2024

UID

ibm17103507

Page Feedback