IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Prompting out Deploy Changes Failure/Warning message even the app have been deployed and running with Active status

    Posted Tue January 21, 2020 03:48 AM
    Issues: Deploy Changes Failure/Warning with the following error messages " There are undeployed changes. Click 'Deploy Changes' to deploy them",  Out of these error/warning messages, I am not sure how to resolve Number of hosts that need deploying, even apphost and qradar console have been already deployed and running in active mode. 

    Number of hosts that need deploying: 2

    host: AppHost with IP: 192.168.153.120
    host: Qradr732 with IP: 192.168.153.29

    Evident: As shown in Figure 1 , AppHost (192.168.153.120) and QRadar 7.3.2 Console ( 192.168.153.29) are currently running in "active", but the QRadar is still prompting such error warnings or messages " There are undeployed changes. Click 'Deploy Changes" to hold the deploy changes procedure.

                                                                                                Figure 1
    NNumber of hosts that need deploying: 2

    host: AppHost with IP: 192.168.153.120
    host: Qradr732 with IP: 192.168.153.29

    Number of global config files that need deploying: 2
    /store/configservices/staging/globalconfig/ssh_public_keys/host_154_key
    /store/configservices/staging/globalconfig/users.conf

    Number of log sources that need deploying: 1
    ID: 513 :: WinCollect DSM - WIN-Collect_11

    Number of components that need deploying: 1
    Component: hostcontext111 on host ID: 106

    Number of hosts that need deploying: 2

    host: AppHost with IP: 192.168.153.120
    host: Qradr732 with IP: 192.168.153.29

    Number of staged components that need deploying: 2
    Authorized Services
    Security Descriptors

    Actually, host: AppHost (192.168.153.120) and Qradr732 (192.168.153.29) have been successfully deployed with Host Status "Active". However, it still prompt out an error while deploying a change.

    IP Address of QRadar 7.3.2 Console : 192.168.153.29
    IP Address of App Host : 192.168.153.120  

    Best Regards
    Ivan To


    ------------------------------
    Ivan To
    ------------------------------


  • 2.  RE: Prompting out Deploy Changes Failure/Warning message even the app have been deployed and running with Active status

    Posted Tue January 21, 2020 03:57 AM
    ​Hi Ivan,

    Have you done a "full deploy"? This can (but not always) resolve inconsistencies.

    Also, if it deploy worked before but there have been network changes stopping the SSH tunnels between the console and managed hosts, then the deploy will not succeed (not sure what your deploy error is - timeout or ???).

    Full deploy first. If that fails, then consider raising a ticket.

    Regards,

    ------------------------------
    Darren H.
    ------------------------------

    Original Message


  • 3.  RE: Prompting out Deploy Changes Failure/Warning message even the app have been deployed and running with Active status

    Posted Tue January 21, 2020 04:32 AM
    Thanks for your quick response. Could you give me some more idea in further approach if there is any ideas to resolve such issues. After performing a testing and executing the Full Deployment over the QRadar.

    It is verified that SSH Tunnelling is working properly (network connection positive)

    And, Full Deployment fails to comply. Where could I grasp the log? 



    ------------------------------
    Ivan To
    ------------------------------

    Original Message


  • 4.  RE: Prompting out Deploy Changes Failure/Warning message even the app have been deployed and running with Active status

    Posted Tue January 21, 2020 05:07 AM
    HiIvan,

    There can be many reasons so I suggest stop and have a read of the "Deploy 101" pages:

    https://www.ibm.com/community/qradar/home/deploys/​

    Regards,


    ------------------------------
    Darren H.
    ------------------------------

    Original Message