HA failover succeeds but Ariel searches and offenses are stale
A QRadar 7.5 HA pair protects the Console and Event Processor. At 02:10 the primary node failed; the secondary took over. Analysts can log in, but Ariel searches for the last 8 hours return no events and offenses created after 01:00 are missing. The HA status page shows Synchronizing and a replication backlog. Before the failure, an admin had deployed a new rule and added a log source but did not verify HA status. Backups run nightly to /store/backup and are copied off-box; the last successful backup was 24 hours ago. The business requires RPO 15 minutes for events and configuration, and RTO 1 hour. You must restore service and explain the gap.
1. What do you check first, and what is the likely reason searches and offenses are missing?
Read the worked answer
First check HA status, replication backlog, and the HA logs; Synchronizing means the secondary is not current. Missing events and offenses since 01:00 point to replication lag that predates the 02:10 failure, not just a search UI problem. Check /store free space, network between nodes, and DRBD/replication status. Do not fail back or restore over the secondary until replication is healthy and Ariel services are running. Verify with a short Ariel search and a test offense. The 8-hour gap already exceeds the 15-minute RPO, so record it as a data-loss incident.
2. How do you restore configuration and data within RTO, and in what order?
Read the worked answer
Order: stabilize the secondary, stop HA control if needed, restore configuration from the last backup only if the deployed rule or log source is missing, then restart Ariel services and verify searches. Do not restore the full 24-hour-old backup over production unless config is corrupt; it would lose more data than the replication backlog. If the backlog can complete, let replication catch up first. If events are permanently lost, document the gap and use the data node or off-box backups for historical search. Re-enable HA, wait for full sync, then fail back in a window. RTO 1 hour is achievable only if config restore is quick and replication fills data.
3. What preventive controls would you add for RPO and RTO?
Read the worked answer
Add monitoring for HA replication lag above 15 minutes, HA state not Active, backup failure, and /store thresholds; alert before disk pressure breaks replication. Deploy changes only when HA is healthy and verify HA status after each deploy. Run quarterly failover and restore tests against the RPO and RTO, including a config-only restore. Keep off-box backups and a runbook with the exact failback order. Review the incident: the admin deployed a rule and log source without checking HA, so make HA status a deployment gate.