IBM Support

QRadar: Changing the network settings of a QRadar High Availability Cluster

Question & Answer


Question

When changing the IP or any other network settings for an appliance that belongs to an High Availability (HA) environment, what additional steps need to be addressed?

Cause

Changing the IP of one of the HA members cause files to get corrupted between the peer nodes.

Answer

Procedure to Remove High Availability

Procedure to Remove the Appliance from the Deployment

Procedure to run qchange_netsetup

Procedure to Add Host to Deployment & Add HA Host



Before making any necessary networking changes by using supported methods. It is necessary to first remove both the primary and the secondary HA nodes from your deployment. To do this, follow the steps for each of these sections.

Remove High Availability
  1. Log in to QRadar User Interface.
  2. Click the Admin tab > System and License Management > Systems View tab.
  3. Highlight the HA host Virtual IP Address.
  4. From the top Menu right click High Availability > Remove HA Host.
    Note: To do this Primary needs to be Active and Secondary needs to be in Standby.


Results: This action takes some time to complete. Once it is complete the HA configuration will be removed on both the primary and the secondary appliance and your secondary appliance will become an unmanaged host.

Remove the Appliance from the Deployment
  1. Log into QRadar User Interface.
  2. Click the Admin tab > System and License Management > Systems View tab.
  3. Click the host you need to remove from the deployment.
  4. From the Deployment Actions drop down click Remove Host.
  5. Click OK.
  6. On the Admin tab menu, click Advanced > Deploy Full Configuration.



Results: When the full configuration deploy is complete, the appliance is removed from your environment and it becomes an unmanaged host.

Procedure to run qchange_netsetup
  1. Connect directly to the appliance you need to change the Network setting on using a KVM, iDRAC; IMM or local monitor keyboard and mouse.
  2. After logging in run qchange_netsetup from the command prompt.
  3. Follow the prompts on screen to change all required Network settings.
Results: When completed all settings are updated. The Appliance restarts services. As a final step the appliance restarts.

Add Host to the deployment and add HA Host
  1. Click the Admin tab > System and License Management > Systems.
  2. Click on Deployment Actions > Add Host > OK.
  3. Add required information > OK.
  4. On the Admin tab menu, click Advanced > Deploy Full Configuration.
  5. Wait for this action to Complete.
  6. Click Actions > Add HA Host > OK.
  7. Add required information > click Finish.
Result: After the action completes successfully, which will take some time, the host is added back to the deployment with HA.

For more information on removing a host refer to this link.

Deploying managed hosts and components after installation
Removing a managed host
Creating an HA cluster





Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"High Availability","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21989204