IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  DLC 1.8.3 auto shutdown services

    Posted Sun October 15, 2023 09:35 AM
    Reply
    After DLC uses UDP to transfer logs for a week, the dlc process suddenly stops automatically.
     
    The message is
    023-10-13 16:22:01,432 [FrameworksShutdownHook/dlc.dlc] com.q1labs.frameworks.queue.SpilloverQueue.ecs-dlc_dlc_TCP_TO_QRADAR: [INFO] [NOT:0000006000][127.0.0.1/- -] [-/ - -]Queue ecs-dlc_dlc_TCP_TO_QRADAR shutdown...
    2023-10-13 16:22:01,433 [FrameworksShutdownHook/dlc.dlc] com.q1labs.frameworks.queue.SpilloverQueue.ecs-dlc_dlc_TCP_TO_QRADAR: [INFO] [NOT:0000006000][127.0.0.1/- -] [-/ - -]Queue ecs-dlc_dlc_TCP_TO_QRADAR is closing...
    Then the dlc process status changes to failed
     
    Has anyone encountered such a situation?


    ------------------------------
    Sun Allen
    ------------------------------


  • 2.  RE: DLC 1.8.3 auto shutdown services

    Posted Mon October 16, 2023 02:48 PM
    Reply

    This is an issue that likely requires a case with support to resolve. I think you should open a case and get the logs from the DLC and submit those so we can take a look. This could potentially be a cfg permissions issue or potentially a corrupted cfg file. The only time I've seen this is when a support rep needed to recreate the .cfg files as the DLC wasn't able to read the .dat files of the /store/persistent_queue/dlc.dlc/ directory. 

    It is hard to tell without the full stack trace, but if your DLC suddenly stopped, we want a case so we can review. 



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------

    Original Message