IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Asset update with flows

    Posted 06/08/21 03:26 PM

    In some installations service ports do not get updated. I have a flow with a destination IP that is in the network hierarchy with a destination port of 52 and i can not find the asset in the database nor the port. In those installations i can not find any assets with services. I find assets in general but not with services and i use flowinformation in all of those installations. Any suggestions what else to check for?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Asset update with flows

    Posted 06/24/21 04:56 PM

    Martin,

    Not sure if you already opened a case on this issue, but this likely requires logs and possibly a pcap file to investigate properly. We had a flows issue where assets were not being updated properly in 7.4.2 as https://www.ibm.com/support/pages/apar/IJ31040. However, it is really hard to identify this type of issue in a forum post without a stack trace from the logs or version information.

    It could potentially be a bit-shifting issue, which a pcap file would help us understand what is going on. Optionally, it might be that APAR IJ31040 that I mentioned that you are hitting where some asset updates are not applied as expected. We are going to want to confirm that you aren't hitting update listener errors. For example:

    [assetprofiler.assetprofiler] [com.q1labs.assetprofile.changelistener.impl.audit.AuditChangeListenerThread] com.q1labs.assetprofile.changepublisher.AssetChangePublisher: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]Unhandled error occurred in listener com.q1labs.assetprofile.changelistener.impl.audit.AuditChangeListener

    I'm not sure if this response helps or not, but let me know if you have follow up questions.



    #QRadar
    #Support
    #SupportMigration