IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Known Issue: Data Replication difficult | sorry, too many clients..

    Posted 26 days ago
    Edited by Ralph Belfiore 25 days ago

    Hey community,

    today I had again a great learning related to QRadar. In System Notifications a frequently message shows up: Data Replication difficult..

    The deployment has been updated this week from 7.5.0 UP14 IF02 to 7.5.0 UP14 IF03. At the end of last year I had the same issue after 7.5.0 UP14 IF02 has been applied successfully. At this time I had the great pleasure to meet @John Dawson in person at the QRadar User Group Meeting in Frankfurt. We had a great talk during coffee breaks and by the way I mentioned this issue.. To make it short: we had a short investigation session in the affected deployment and were able to fix it running QRadar 7.5.0 UP14 IF02!

    The root cause was on the EP related to a misconfig parameter in conjunction with Postgresql.. In qradar.log we could identify a similar error message like this:

    ErrorStream replication: DBI connect ..'qradar' .. connection to server on socket.. failed: FATAL: sorry, too many clients already at ..

    A few days later the following IBM Known Issue Dokument DT458064 has been released:

    Known Issue: Replication Difficulty: too many clients already

    The solution was to adjust a parameter in the involved .conf file and restarting services. Done! After adjusting this value the data replication has been started to work as expected.

    The point of this thread is, that this "misconfiguration" related to this max_connections value reappeared after applying IF03! 

    @IBM Support just to keep you informed to be aware about this issue permanently will be fixed with UP15?!

    Regards,

    Ralph



    -------------------------------------------


    ------------------------------
    Ralph Belfiore
    Managing Consultant | CyberSecurity Strategy | SIEM & Data Resilience
    connecT SYSTEMHAUS AG
    Siegen
    ------------------------------



  • 2.  RE: Known Issue: Data Replication difficult | sorry, too many clients..

    Posted 26 days ago

    Hey Ralph

    It was a pleasure meeting you too.  I have checked and can confirm that this is resolved in 7.5.0 UP15 and will also be in 7.5.0 UP14 IF04.

    Thanks

    John



    ------------------------------
    John Dawson
    Qradar Support Architect
    IBM
    ------------------------------

    Original Message


  • 3.  RE: Known Issue: Data Replication difficult | sorry, too many clients..

    Posted 26 days ago

    @Ralph Belfiore Just to throw-in another related experience (maybe it'll help someone): 
    In the last few days I've noticed issues with deploying changes on event processors at 2 sites after upgrading the environment to UP14 IF03. In both cases it was related to this "postgres too many clients" known issue. After increasing the parameter it was resolved (though a local transformation was needed to complete the change). 



    ------------------------------
    Dusan VIDOVIC
    ------------------------------

    Original Message


Related Content