Troubleshooting, Health Checks, and Log File Analysis
Troubleshooting items ask you to localize a failure: ingestion, parsing, deployment, or storage.
Core rules
- Start with System Health and health metrics; confirm the host, service, and disk are healthy.
- Key logs: /var/log/qradar.log, /var/log/qradar.error, /var/log/qradar-sql.log, /var/log/messages, and /var/log/audit/audit.log.
- Deployment problems: check drq for queued or failed jobs, then qradar.error.
- Ingestion problems: tcpdump on the collector port, then log source identifier, DSM, and collector assignment.
- Service control uses systemctl or the qradar service wrapper; capture logs before restarting.
- Use a support bundle for vendor escalation rather than copying random files.
Worked example
A firewall sends nothing. tcpdump on the collector shows packets arriving on 514, so the network is fine. The log source identifier does not match the firewall IP, so events are discarded as Unknown. Correct the identifier, deploy, and verify in Log Activity. The reasoning: prove each hop before changing configuration.
Traps
- Reading only qradar.log and missing qradar.error.
- Restarting services before capturing evidence.
- Assuming a parsing failure is a network failure.
- Ignoring a failed DRQ job that blocks all deploys.
- Changing multiple variables at once.