IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Does Analyst workflow application works for Console in HA

    Posted Tue July 14, 2020 07:11 PM

    Installed successfully on primary console but it is not loading in gui. Not sure whether it works for Console which are in HA. Any workaround or troubleshooting will also be helpful.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Does Analyst workflow application works for Console in HA

    Posted Thu July 23, 2020 02:40 PM

    The Analyst Workflow app should work on Console's in HA pairs. If you failed over and the app is not loading, then you should get a case opened with Support. There is not much information here to help with troubleshooting. We have seen issues where the app is trying to connect to the HA pair using an incorrect Fully Qualified Domain Name (FQDN) that includes -primary in the name. It could also be that the cert possibly includes this FQDN...it is hard to tell without some error messages.


    You could potentially connect to the docker container for the Workflow Analyst App recon connect {appid} and then type env, which would output to the screen what the app believes the Console's FQDN is as CONSOLE_FQDN. If you see CONSOLE_FQDN=example.hostname-primary in the output then the application is trying to talk to an incorrect host.


    This is something that should be reviewed by support to confirm and the support rep can update nva.conf to confirm the change and that the app is working as expected. I am not going to list a procedure here as there are other items that the support team would also look for to confirm, so you should not attempt to update nva.conf yourself. As the team would want to also confirm environment variables in docker or potentially that all required files reflect the proper FQDN or not.


    It is really hard to say if this is a certificate issue or potentially an issue with the FDQN, but what I listed could be checked. We have seen some issues that are difficult to reproduce and we can get the app running, but best to get a case opened so we can confirm where the problem occurs, if it is cert, container, FQDN update, etc.

    You can open a case at the following URL: https://www.ibm.com/mysupport/CommunitiesLogin?startURL=/s/createrecord/NewCase


    Hope this helps or gives some insights....



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Does Analyst workflow application works for Console in HA

    Posted Thu July 23, 2020 06:38 PM

    Update: There is a fix for this FQDN issue in the QRadar Analyst Workflow App v1.0.1.


    https://exchange.xforce.ibmcloud.com/hub/extension/123f9ec5a53214cc6e35b1e4700b0806



    #QRadar
    #Support
    #SupportMigration


  • 4.  RE: Does Analyst workflow application works for Console in HA

    Posted Fri July 24, 2020 04:52 AM

    Thanks for the help. It was an error for certificates, the app was taking virtual IPs FQDN and trying to get the certificate. The support rep able to resolve by replacing in the hostname parameter to FQDN in the conman-api.cli.sh Then it worked. However we have not yet came across with failover scenario.



    #QRadar
    #Support
    #SupportMigration