IBM Security QRadar

 View Only
Expand all | Collapse all

Unable to configure HA for QRadar

  • 1.  Unable to configure HA for QRadar

    Posted Wed October 26, 2022 05:24 PM
      |   view attached
    Hello,
    We are unable to configure the HA pair for QRadar (All-in-One) deployed as VM.
    I have attached the Logs. Can you please advise on the error.
    Both the Primary and Secondary instances are in the same subnet.
    Please advise on how to resolve the issue.

    Oct 26 17:06:12 ::ffff:10.162.84.199 [tomcat.tomcat] [admin@10.162.84.228 (189) /console/do/hawizard] com.q1labs.qradar.ui.action.HAWizard: [INFO] [NOT:0000006000][10.162.84.199/- -] [-/- -]User admin is attempting to add high availability on managed host 10.162.84.199 (id=53) with new primary IP 10.162.84.202 and with secondary IP 10.162.84.200 at Oct 26, 2022, 5:06:12 PM


    Thanks in advance

    ------------------------------
    --
    Thanks and Best Regards,
    Siddarth
    ------------------------------

    Attachment(s)

    txt
    Logs_HA.txt   3 KB 1 version


  • 2.  RE: Unable to configure HA for QRadar

    IBM Champion
    Posted Sat November 12, 2022 07:30 AM
    Hello @Siddarth Talupula,

    What version of QRadar are you using ?

    ​Check the ha_setup.log file to see what happened.

    Most problems with HA are regarding the prerequisite : IBM QRadar: High Availability Guide and often with the VG for /store and /transient  and the LV extent number and the metadata space for DRBD (depending if you are doing a appliance install, software or BYOL install).

    Also there is a problem with QRadar 7.5 GA https://www.ibm.com/support/pages/apar/IJ39521 with the prepare_ha.sh script

    "LARGE /STORE FILESYSTEMS CAN CAUSE HIGH AVAILABILITY INSTALLS TO IMPROPERLY SET UP THE PARTITION LAYOUT".
    Maybe you are experiencing it (corrected with QRadar 7.5 SP3 new GA).

    Create a ticket on the support page if needed.

    Hope this helps.

    Regards,
    Zoldax



    ------------------------------
    @zoldax

    https://www.youracclaim.com/users/pascal-weber.029e134d/badges
    ------------------------------

    Original Message