IBM Support

Resetting IMM to factory defaults on QRadar appliances

Question & Answer


Question

How do you reset the Integrated Management Module (IMM) to factory default settings on QRadar appliances?

Cause

You may need to use the information in this article If you are experiencing one of the following conditions:

  • You have forgotten the current IMM username and password.
  • You are unable to reset the IMM password using the following command:
    /opt/ibm/toolscenter/asu64 set IMM.Password.1 NewPassword --kcs
  • You are unable to gain physical access to the appliance to reset IMM via crash cart, such as physical KVM access.
  • You are unable to connect to the configured IP Address for the IMM.

Answer

The following instructions describe how to reset IMM to the factory default configuration and then reconfigure IMM.

  1. Log in to the appliance with the root account via SSH connection.
  2. Enter the following command to reset IMM to default settings:

    /opt/ibm/toolscenter/asu/asu64 loaddefault

    Note: After you see Command completed successfully, the screen might time out. This is normal as the reset can take up to 10 minutes to complete.
  3. After 10 minutes, enter the following command:

    /opt/ibm/toolscenter/asu/asu64 show all --kcs

    If the IMM reset is complete, the command should output the unconfigured IMM settings.
  4. Enter the following sequence of commands to reconfigure IMM:

    Note: Each command can take up to 5 minutes to complete.

    /opt/ibm/toolscenter/asu/asu64 set IMM.HostName1 <Desired_Hostname> --kcs
    /opt/ibm/toolscenter/asu/asu64 set IMM.DHCP1 Disabled --kcs
    /opt/ibm/toolscenter/asu/asu64 set IMM.IPv6DHCP1 Disabled --kcs
    /opt/ibm/toolscenter/asu/asu64 set IMM.HostIPAddress1 <Desired_IPv4_Address> --kcs
    /opt/ibm/toolscenter/asu/asu64 set IMM.HostIPSubnet1 <Desired_Subnet> --kcs
    /opt/ibm/toolscenter/asu/asu64 set IMM.GatewayIPAddress1 <Desired_Default_Gateway_IP_Address> --kcs

    Optional

    If you are sharing IMM through only one ethernet port and not dedicating a separate cable to the management port, you will also need to enter the following command:

    /opt/ibm/toolscenter/asu/asu64 set IMM.SharedNicMode Shared --kcs
  5. Enter the following command to restart IMM:

    /opt/ibm/toolscenter/asu/asu64 rebootimm --kcs

    Note: This process can take up to 10 minutes to complete.
  6. Enter the following command to verify that your settings took effect:

    /opt/ibm/toolscenter/asu/asu64 show all --kcs
  7. Attempt to connect to IMM using the default login credentials:

    Username: USERID
    Password: PASSW0RD

    Note: The '0' in the password is the number zero (0).

    The command needed to manage the IMM at command line is asu64, which is found under /opt/ibm/toolscenter/asu/

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Operating System","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21964070

Page Feedback