IBM Support

QRadar: Napatech3 service fails on new QRadar M7 QNI or NPCAP

Troubleshooting


Problem

The Napatech adapter's napatech3 service may start, but then immediately fail.

Symptom

The napatech3 service may show "failed" or "activating", as the service will typically continue to attempt to restart after failing.

Message from /var/log/messages:

Jan 23 04:29:30 [hostname] ntservice[2264593]: ********************************************************************
Jan 23 04:29:30 [hostname] ntservice[2264593]: *                NTService is now operational.                     *
Jan 23 04:29:30 [hostname] ntservice[2264593]: ********************************************************************
Jan 23 04:29:30 [hostname] ntservice[2264593]: Starting NTService (this may take a while)                  [Done]
Jan 23 04:29:30 [hostname] ntservice[2264593]: systemd[1]: Started Napatech3 3GD Service.
-- Subject: Unit napatech3.service has finished start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- 
-- Unit napatech3.service has finished starting up.

Jan 23 04:29:31 [hostname] ntservice[2264593]: Adapter 0: Uses OS clock as time reference
Jan 23 04:29:31 [hostname] ntservice[2264593]: Adapter 1: Uses OS clock as time reference
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 4: NIM not present
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 4: Link Down
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 5: NIM not present
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 5: Link Down
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 6: NIM not present
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 6: Link Down
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 7: NIM not present
Jan 23 04:29:31 [hostname] ntservice[2264593]: Port 7: Link Down
Jan 23 04:29:33 [hostname] systemd[1]: napatech3.service: Main process exited, code=killed, status=11/SEGV
Jan 23 04:29:33 [hostname] systemd[1]: napatech3.service: Failed with result 'signal'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- 
-- The unit napatech3.service has entered the 'failed' state with result 'signal'.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtcAAA","label":"Hardware"},{"code":"a8m0z000000cwtJAAQ","label":"QRadar Network Insights"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
04 February 2025

UID

ibm17182390