IBM Security QRadar

 View Only

  • 1.  Remove 'unknown' managed host

    Posted Mon October 07, 2019 04:20 AM
    Hi all

    I have to remove a cluster of event processor from a deployment.
    The point is that managed hosts are no longer reachable from a console, so I can't do it from GUI as usual.

    Does anyone know how to remove HA host and then primary host from a deployment with CLI command when the managed host status is 'unknown'?

    ------------------------------
    Witold Smela
    ------------------------------


  • 2.  RE: Remove 'unknown' managed host

    Posted Tue October 08, 2019 08:31 AM
    Hopefully you have resolved your issue by raising a support ticket.

    They may use the following command to remove the managed host via the CLI

    /opt/qradar/bin/addhostCLI.sh -r


    ------------------------------
    James Hill
    ------------------------------

    Original Message


  • 3.  RE: Remove 'unknown' managed host

    Posted Tue October 08, 2019 08:42 AM
    I finally managed to resolve it from GUI.

    1. Set Standby host to Offline
    2. Set Primary host to Offline
    3. Be patient, wait a few minutes
    4. From High Availability menu Remove HA Host
    5. Be patient again, wait a few minutes
    6. From Deployment Actions Remove Host

    That worked fine for me.


    ------------------------------
    Witold Smela
    ------------------------------

    Original Message


  • 4.  RE: Remove 'unknown' managed host

    Posted Tue September 12, 2023 06:46 AM

    The reported issue assumes a host is not reachable for some reason (Hardware failed ... etc). At the same time, we assume that the host is not required no more.... 

    I have tried the procedure but still i'm unable to remove the HA.. This is becuase both HA managed hosts are now in state UNKNOWN. and as i remember, you can't remove them unless they are restored to their original state. Then you can remove them.

    Please let me know if there a way to successfully remove both HA nodes without restore ...



    ------------------------------
    ahmad zuhd
    ------------------------------

    Original Message