IBM Support

QRadar: How to update network interface names

How To


Summary

How to update network interfaces so that they display a different name?

Objective

Interfaces must match for HA. When the systems are on different hardware the interfaces would be named differently. A firmware update can change the interface names. 
Before attempting the solution ensure both the Primary and Secondary must have the same Hardware type.
Schedule a maintenance window as a restart is required.

Steps

Method A: For Management Interface

When NIC is part of the Management Interface:
In this example the interface to eno1 is changed.
  1. If the host is part of the deployment, remove it first.
  2. Backup all the critical files: 
    tar cvzf /root/nic_back.tgz /etc/management_interface /etc/sysconfig/network* /opt/qradar/conf/capabilities/hostcapabilities.xml
  3. Manually stop hostcontext and related processes: 
    /opt/qradar/systemd/bin/manual.sh hostcontext enable
systemctl stop hostcontext
  4. If on the console, manually stop tomcat: 
    /opt/qradar/systemd/bin/manual.sh tomcat enable
systemctl stop tomcat
  5. Edit /etc/management_interface and change "enp7s0f0" to "eno1": 
    vi /etc/management_interface
  6. Edit /opt/qradar/conf/capabilities/hostcapabilities.xml and change: 
    managementInterface="enp7s0f0"
    with 
    managementInterface="eno1"
    To edit the file: 
    vi /opt/qradar/conf/capabilities/hostcapabilities.xml
  7. Rename ifcfg-enp7s0f0 to ifcfg-eno1: 
    cd /etc/sysconfig/network-scripts/
mv -fv ifcfg-enp7s0f0 ifcfg-eno1
  8. Edit ifcfg-eno1. Relevant lines are: NAME, DEVICE, and HWADDR: 
    vi /etc/sysconfig/network-scripts/ifcfg-eno1
    Verify that the HWADDR line matches the MAC address of the nic 
    ip addr show enp7s0f0
    Or 
    ifconfig enp7s0f0
    Change "NAME=enp7s0f0" to "NAME=eno1"
    Change "DEVICE=enp7s0f0" to "DEVICE=eno1"
    Save the changes
  9. Remove the manual flags for hostcontext and tomcat: 
    /opt/qradar/systemd/bin/manual.sh hostcontext disable
/opt/qradar/systemd/bin/manual.sh tomcat disable
  10. Restart the system: 
    reboot

Method B: For Non-Management Interface

When NIC is not a part of the management interface.

Important: DO NOT apply the following steps for the management interface as it breaks the entire system. To determine which interface is the management interface, run:

cat /etc/management_interface
Steps:
In this example, we are changing ens1f0 to ens4f0:
ens1f0 = Old Network Interface Name
ens4f0= New Network Interface Name
  1. Check the name of the interface and its configuration. 
    ip link show
    For Example: 
    [root@aaaaaaconsole ~]# ip link show
1: ens1f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc prio state UP mode DEFAULT group default qlen 1000
    link/ether 22:xx:xx:xx:95:xx brd ff:ff:ff:ff:ff:ff
  2. Bring the interface down that needs to be changed.
    ip link set ens1f0 down
  3. Change the NIC name to a new one.
    ip link set ens1f0 name ens4f0
  4. Create a backup and copy the configuration of the NIC whose name is going to be changed. 
    mkdir /store/ibm_support/
cp -p /etc/sysconfig/network-scripts/ifcfg-ens1f0 /store/ibm_support/
  5. Rename the NIC with the new name in network-scripts. 
    mv /etc/sysconfig/network-scripts/ifcfg-ens1f0 /etc/sysconfig/network-scripts/ifcfg-ens4f0
  6. Edit the new file and modify the following parameters only. (DO NOT modify others) 
    vi /etc/sysconfig/network-scripts/ifcfg-ens4f0

DEVICE=ens4f0 
NAME=ens4f0 
HWADDR= <mac addr of the old NIC (ens1f0)>
  7. Check whether file "70-persistent-net.rules" is present under /etc/udev/rules.d/. If not, create as follows: 
    cd /etc/udev/rules.d/
touch 70-persistent-net.rules
  8. Edit and add the file as follows and save it:  
    SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="<mac addr of old NIC which is replaced(ens1f0)>",ATTR{type}=="1",NAME="<new interface name>"
    For Example: 
    SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="22:xx:xx:xx:95:xx",ATTR{type}=="1",NAME=“ens4f0”
    Steps 7 and 8 are important to ensure that the NIC name persists after a restart; skipping them can cause the name to revert.
  9. Restart.
    reboot
  10. Confirm if the name has changed permanently by the following commands. The following commands should fetch the same NIC name. 
    ip link show
    ifconfig -a
    ls -l /etc/sysconfig/network-scripts/ifconfig-ens4f0
  11. The preceding steps change the interface name permanently.

 

Related Information

Configuring network interfaces

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"TS016122991","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
12 November 2024

UID

ibm17150564

Page Feedback