IBM Support

QRadar: Verifying HA crossover connections with qradar_nettune.pl

Question & Answer


Question

Is there a way to test the high-availability (HA) crossover connection?

Answer

If you see a higher that usual load on the management port, you can verify whether the crossover connection is working and sending data by following this procedure.
  1. SSH into your QRadar console.
  2. To check the crossover status, enter the following command:
    /opt/qradar/ha/bin/qradar_nettune.pl crossover status
    Example output:
  3.  To test the crossover heartbeat, enter the following command:
    /opt/qradar/ha/bin/qradar_nettune.pl crossover test link
    Example output:
    output
  4. To test if you can move data between nodes, SSH between the nodes. If you can SSH from each node and back on the crossover connection, data can be synchronized.
    ssh <NODE IP>
    
  5. To test the link, enter the following command:
    /opt/QRadar/ha/bin/ha cstate
    Note: In this example, a 1.0 status equals pass and 0.0 would be fail. LSN refers to the locale node, which is primary at this moment and RSN is the Remote node.

    Result
    If all the tests pass, the crossover is working.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtXAAQ","label":"High Availability"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
04 April 2023

UID

swg21994485