IBM Support

QRadar: Bad data in resolv.conf causes a Microservices Infrastructure failure of the initial configuration of qchange_netsetup

Troubleshooting


Problem

A faulty configuration in /etc/resolv.conf causes Microservice Infrastructure to error resulting in a failure of the configuration of the qchange_netsetup script.

Symptom

Error during initial configuration you may see errors similar to this:
[microservices-infrastructure-install] Attempt X to install Microservice Infrastructure
[microservices-infrastructure-install] Microservice Infrastructure failed with return code 1
...
[microservices-infrastructure-install] After 10 failed attempts to execute the NodeInstaller, the NodeInstaller has failed to install the Microservice Infrastructure
[microservices-infrastructure-install] Error executing com.ibm.si.configservices.node.impl.NodeInstaller for the Microservice Infrastructure install
ERROR: Failed to install micro-services infrastructure components. (1)
ERROR: Failed. Exit code: 255. Case 1.
ERROR:
System setup failed.  Please logout/login on the console terminal to reconfigure system.

From the qradar_netsetup.log
Feb 11 14:53:26 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [INFO] ...
Feb 11 14:53:26 qradar_netsetup.py[21224]: ibm_command_utils run_and_log [INFO] systemctl restart network
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR] Exceptions:
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR] Traceback (most recent call last):
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]   File "/opt/qradar/bin/qradar_netsetup.py", line 3874, in main
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]     qradarNetsetup.doJob()
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]   File "/opt/qradar/bin/qradar_netsetup.py", line 885, in doJob
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]     self.installQradar()
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]   File "/opt/qradar/bin/qradar_netsetup.py", line 1793, in installQradar
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]     % (result))
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]   File "/opt/qradar/lib/python/ibm_logging.py", line 80, in error
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]     sysExit(255)
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]   File "/opt/qradar/lib/python/ibm_logging.py", line 46, in sysExit
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR]     raise Exception(message)
Feb 11 14:53:40 qradar_netsetup.py[21224]: qradar_netsetup finalBlock [ERROR] Exception
Feb 11 14:53:40 qradar_netsetup.py[21224]: ibm_logging error [ERROR] Failed. Exit code: 255. Case 1.
Feb 11 14:53:40 qradar_netsetup.py[21224]: ibm_logging error [ERROR]

Cause

When you configure your DNS networking configuration, the file /etc/resolv.conf is created by /etc/resolv.conf.masq. Sometimes the resolv.conf file is not correctly configured by resolv.conf.masq, which causes Microservices Infrastructure to fail to install properly.

Resolving The Problem

The DNS information in the /etc/resolv.conf must to be configured as in figure 1 in order for the Microservices Infrastructure to install and configure successfully:

 nameserver 127.0.0.1
 search localdomain

   figure 1. Proper /etc/resolv.conf  file.
In some problematic cases, the information found in /etc/resolv.conf was found to be:
nameserver 127.0.0.1search localdomain
   figure 2.  Improper /etc/config file.
In problematic cases, entries other than 127.0.0.1 are found in the /etc/resolv.conf file as illustrated in figure 2.

To resolve the issue
  1. Open /etc/resolv.conf in a text editor, such as vi.
  2. Remove all entries other than 127.0.0.1 and ensure there is a carriage return between the two lines within this file.
  3. Restart the dnsmasq service by typing the command:
    systemctl restart dnsmasq
  4. Reboot the machine to restart the initial install configuration.

Where do you find more information?



Internal Use Only

Bad data in /etc/resolv.conf causes Microservice Infrastructure to error resulting in a failure of the initial configuration of the qrchange_netsetup script

Document Location

Worldwide

[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Component":"Networking","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.0;7.3.1","Edition":""}]

Document Information

Modified date:
19 February 2019

UID

ibm10871654