Hey
@Jonathan Pechta,
thank you for your reply!
The main problem is that we cannot allocate the new license to our system. On one system, there is this "null" host as the only possible host available for allocating the license. On the other system (Testing purposes) there is none. We can upload the license, but we cannot allocate it. The list below is empty: "No results were returned"
I thought there was a problem with the license key file itself, but I managed to allocate it to two other systems I installed yesterday using ISO files and that have trial licenses.
A) QRadar LogManager 7.2.8 (after the license allocation it became QRadar SIEM with XXX more EPS)
B) QRadar 7.3.1 ( after the license allocation it gained more EPS)
I suspected that the aforementioned systems cannot receive the new license because they have been upgraded year after year since a very old version of QRadar.
PS: we've been talking to q1pd a lot, they helped us and here is their final response:
"Q1PD is not the resource for assistance in this area."
Thank you for your help!
Regards,
Bruno
------------------------------
Bruno Oliveira
------------------------------
Original Message:
Sent: 02-28-2019 10:03 AM
From: Jonathan Pechta
Subject: License Issue
Bruno,
There are two options here:
A. You can try to get a new license from q1pd. There is a q1pd FAQ here.
You can contact q1pd@us.ibm.com and get them to cut you a new license. This is probably your first step, but know that if this is a database issue, then you might need to follow-up with QRadar Support. Send an email to q1pd and ask for them to provide you an updated license and it will at least prove your issue. If you do not believe the license is the root problem, then see item B.
B. Get QRadar Support Involved
There was likely some kind of connection issue flagged in the database that needs to be cleaned up. I've only seen this reported when trying to add hosts and there is an network interruption or the system isn't actually online when it is added to the deployment. This doesn't sound like your exact issue, but it is the only situation that I can think of where NULL is displayed in the license view.
The steps that can cause this issue that we've seen before. These are not steps for you to take, but context so you can understand what types of actions can cause NULL to display in the UI.
- Admin > System and License management > Systems display.
- Select Deployment Actions > Add Host.
- Enter an IP of a host that is not connected or NIC disabled.
- Upload a license and from the Licenses display and select Allocate License to System.
- The user interface shows a NULL in the text in the user interface for the name or the status. See the attached example image.
What to do
- From your Log Manager Console, navigate to the Admin tab.
- Click System & License Mgmt > Actions > Collect Log Files.
- Wait for the logs to be collected and download the file to your workstation.
- Open a case for QRadar Support to review this issue.
- There is likely a managed host table problem in the database that needs to be reviewed to ensure that this license can be allocated to the host to resolve the bad entry and clean up the null value.
- Open a case for QRadar Support.
- Make sure your case includes a number where we can contact you (phone/email).
------------------------------
Jonathan Pechta
------------------------------
Original Message:
Sent: 02-28-2019 06:09 AM
From: Bruno Oliveira
Subject: License Issue
Actually, there are two systems running 7.3.1 as LogManager and it is not possible to allocate this new license to activate SIEM to neither of them.
Using an old ISO file for LogManager 7.2.8 I managed to install QRadar and could import and allocate the license . So the license is not corrupt.
It can be imported, but it is not possible to allocate it to any system in our two 7.3.1 systems.
A) Have you ever seen something like this before?
B) Is it possible to allocate a license through CLI?
Thank you!
Regards,
Bruno
------------------------------
Bruno Oliveira