IBM Support

QRadar: Verifying HA crossover connections with qradar_nettune.pl

Question & Answer


Question

Is there a way to test the high-availability (HA) crossover connection?

Cause

You are seeing a higher that usual load on the management port and want to verify whether the crossover connection is working.

Answer

To test the HA crossover connection, here are some commands to verify that your crossover is working and sending data.

To test the crossover status:
QRadar 7.3.0 and greater /opt/qradar/ha/bin/qradar_nettune.pl crossover
QRadar 7.2.8 and prior/opt/qradar/bin/qradar_nettune.pl crossover status



To test the crossover heartbeat:
Qradar 7.3.0 and greater /opt/qradar/ha/bin/qradar_nettune.pl crossover test link
Qradar 7.2.8 and prior/opt/qradar/bin/qradar_nettune.pl crossover test link


QRadar synchronization uses SSH. To test if you can move data between nodes, SSH between the nodes. If you can SSH from each node and back on the crossover connection, data can be synchronized.

[root@QRadar-727-1-primary ~]# ssh 169.254.1.2
Last login: Mon Nov 21 09:30:18 2016 from 169.254.1.1
This server has QRadar 7.2.7.20161017135129 installed on Tue Nov 8 14:18:53 EST 2016.
[root@QRadar-727-1-secondary ~]#


You can test the link using the cstate command:
QRadar 7.3.0 and greater /opt/QRadar/ha/bin/ha cstate
QRadar 7.2.8 and prior /opt/qradar/ha2/bin/ha cstate


In this example, a 1.0 status equals pass and 0.0 would be fail. LSN refers to the locale node, which is primary at this moment and RSN is the Remote node.

Results: All tests indicate that crossover is working.


Where do you find more information?


[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"High Availability","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3","Edition":""}]

Document Information

Modified date:
06 January 2020

UID

swg21994485