IBM Support

QRadar Risk Manager: Cisco IOS devices are unable to perform backup



For IBM Security QRadar Risk Manager, Cisco IOS devices do not backup as expected, and they display the message: "ERROR - Device backup failed"


A terminal emulation issue is preventing the Cisco IOS devices from performing a backup. This issue causes control characters in the stream (^H) when the "--More--" prompt is displayed.

Diagnosing The Problem

In the ziptieServer.log (/usr/share/ziptieServer.log), administrators will see attempted backups for devices "" device, which keep failing:

[BackupJob] [ZipTieScheduler_Worker-1 ] <@> INFO - Starting Backup Job '_interactive.Backup Devices (Run now ID1102)'
[attempt ] [Running-3 (] <@> INFO - Attempting adapter operation (backup) against device with protocol set 'SSH' and credential set 'default set' using adapter ZipTie::Adapters::Cisco::IOS
[BackupJob] [ZipTieScheduler_Worker-1 ] <@> INFO - Completed Backup Job '_interactive.Backup Devices (Run now ID1102)'
[BackupJob] [Idle-3 ] <@> WARN - Backup in Job '_interactive.Backup Devices (Run now ID1102)' completed with exception
[failure ] [Idle-3 ] <@>ERROR - Device backup failed: id=477, adminIp=
13-08-09 12:00:04,250 [complete ] [ZipTieScheduler_Worker-1 ] <@> INFO - Job finished: Backup Devices (Run now ID1102)._interactive (class org.ziptie.server.job.backup.BackupJob)

Resolving The Problem

By adding "terminal length 0" to your device authorized command set you will then be able to backup. This eliminates the "--More--" prompt. The adapter is written to handle "--More--" but does not expect the control characters.

Where do you find more information?

[{"Product":{"code":"SSBQQU","label":"IBM Security QRadar Risk Manager"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Not Applicable","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018