IBM Support

QRadar Deploy Will Fail During Data Node Rebalancing

Troubleshooting


Problem

Deploys do not initiate and no error from Web UI. Deploys cannot be processed while a host is still being added to the deployment and the initial balancing on a newly added Data Node is still part of that adding process in QRadar 7.3.2.

Symptom

The Web UI > Admin will display, after about 2 minutes, that rebalancing is in progress. 

Diagnosing The Problem

To confirm you are hitting this:

grep "Wait until rebalancing has completed and try again" /var/log/qradar.error

Resolving The Problem

  1. Add all Data Nodes prior to first Deploy, prior to initial balanace starts.
  2. Otherwise, wait until rebalancing is complete.
    Note: when rebalancing terabytes (TB) of data this step can take a few days, so AutoUpdate deploys fail during this time as well.
  3. On the navigation menu ( Navigation menu icon ), click Admin.
  4. In the System Configuration section, click System and License Management.
  5. In the Display list, select Systems.
  6. In the host table, select the managed host select the top-level host for the Data Node.
  7. On the Actions menu, click View and manage system.
  8. Click the Security Data Distribution tab to view the progress of data rebalancing and the capacity of the Data Node appliance.
  9. Process Deploy Changes in the Web user interface (UI).

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000blOYAAY","label":"QRadar-\u003EDeployment-\u003EDeploys"}],"ARM Case Number":"TS002478676","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.2","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
21 December 2020

UID

ibm10959501

Page Feedback