IBM Security QRadar

 View Only
  • 1.  QRadar Deployment Timeout

    Posted Tue September 29, 2020 06:53 AM
    Hello everyone,
    we are no longer able to deploy the changes since restoring the QRadar config backup. We have "timeout" as an error message between the console and the AppHost.
    any idea ?
    @Jonathan Pechta


    ------------------------------
    Famara Bodian
    ------------------------------


  • 2.  RE: QRadar Deployment Timeout

    Posted Tue September 29, 2020 08:02 AM
    Hi Famara,

    Can be many things. Have you gone through the 101 guidance for deploys?

    https://www.ibm.com/community/qradar/home/deploys/

    Regards,


    ------------------------------
    Darren H.
    ------------------------------



  • 3.  RE: QRadar Deployment Timeout

    Posted Tue September 29, 2020 08:13 AM
    Hello Darren,
    yes I consulted the page and I still did not find a solution. The ssh connection is OK, no token conflict and QRadar has the same version as the App Host. The "Timeout" error is not explicit enough and I do not know the exact cause

    ------------------------------
    Famara Bodian
    ------------------------------



  • 4.  RE: QRadar Deployment Timeout

    Posted Tue September 29, 2020 08:49 AM
    Right - without sounding like a support team (which you should probably contact anyway), it is useful to know if you are on 7.3.x or 7.4.x. Full or community edition? Is this a production environment or dev/test environment?

    Also, having applied a config backup to the console, did the app host exist before the backup was applied and did it operated normally before the restore? Did keys and tokens since the back up get changed? Have an certs changed? How old is the back up?

    Do you trust the before and after networking has not changed? Is the app host now "in" the deployment since the backup was applied to the console?

    Other thoughts:

    • I'd use the all_servers.sh script to locate "deploy" items in the log files on both. This is described here: https://www.ibm.com/support/pages/node/543993
    • I'd also use tcpdump on each end to verify if the deploy (start) from the console is actually reaching the app host. You never know, the config backup may have differing network elements, or host names so may not even be trying to talk to the app host.
    Just some initial thoughts - do think about a ticket if this is for a production system.

    Regards,

    ------------------------------
    Darren H.
    ------------------------------



  • 5.  RE: QRadar Deployment Timeout

    Posted Tue September 29, 2020 10:41 AM
    hello Darren, thank you for the good resources. I will check them.
    I have also noticed that the tomcat service is not running in the App Host. And the hostcontext service also keep failing after the restart.

    ------------------------------
    Famara Bodian
    ------------------------------