Troubleshooting
Problem
In IBM QRadar, SNMP traps are sent to the host that is set/configured on QRadar Admin Tab/System Settings/SNMP Settings. In some cases, the SNMP traps do not appear to be sending from the QRadar server.
Symptom
To see why the SNMP traps are not sending, review the /var/log/qradar.log and /var/log/qradar.error files.
Search the logs for: SNMP
In one case, we found this error in the /var/log/qradar.error file where x.x.x.x,x.x.x.x was 2 IP Addresses:
Apr 23 17:24:26 ::ffff:127.0.0.1 [ecs-ep.ecs-ep] [ECS Runtime Thread] com.ibm.si.ep.SNMPV2: [ERROR] [NOT:0000003000][10.191.88.51/- -] [-/- -]Invalid host specified: x.x.x.x,x.x.x.x SNMP sender will be disabled
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt8AAA","label":"Ariel"},{"code":"a8m0z000000cwtIAAQ","label":"Dashboard"}],"ARM Case Number":"TS019201068","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.3.3;7.4.0;7.4.1;7.4.2;7.4.3;7.5.0"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
21 May 2025
UID
ibm17233825