IBM Support

QRadar: Deploys intermittently timeout on virtual machines or adding managed hosts

Troubleshooting


Problem

Deploys intermittently timeout or managed hosts fail to add when you are using virtual machines (VMs).

Cause

Deploys are originally written for hardware appliances. However, with the introduction of VMs, the deployment timeout might need to be changed depending on VM host performance, as well as some other indicators. This VM performance issue can also cause a timeout when you are adding a managed host to the deployment.

Resolving The Problem

Before you Begin:
  • Running a Deploy Full Configuration or restarting hostcontext might result in Event collection being briefly interrupted while services restart.
  • Restarting Tomcat results in users not being able access the Console UI.
  • Schedule a maintenance window before running Deploy Full Configuration, restarting hostcontext, or restarting Tomcat.
  1. Log in to the QRadar Console by using an SSH session as the root user.
  2. Back up /opt/qradar/conf/nva.configservices.conf by using this command:
    mkdir -p /store/IBM_Support && cp /opt/qradar/conf/nva.configservices.conf /store/IBM_Support
  3. Use vi editor to modify nva.configservices.conf: vi /opt/qradar/conf/nva.configservices.conf
  4. Search for and update the following lines:
    INITIATE_DEPLOYMENT_TIMEOUT=240000 [default is 120000]
    INPROGRESS_DEPLOYMENT_TIMEOUT=900000 [default is 600000]
    ADD_HOST_TIMEOUT=800000 [default is 300000]
  5. Save the changes to the file by entering:  Esc :wq
  6. Restart hostcontext by using the command:
    For QRadar 7.3.X: /opt/qradar/init/hostcontext restart -q
    For QRadar 7.2.X: service hostcontext -q restart
  7. Restart the Tomcat service by using the command:
    For QRadar 7.3.x: systemctl restart tomcat
    For QRadar 7.2.8: service tomcat restart
  8. Log in to the Console User interface.
  9. From the Admin page, click Advanced > Deploy Full Configuration.
Results:
Your changes are able to deploy or your host can to be added to the deployment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":""}]

Document Information

Modified date:
31 March 2020

UID

ibm10871370