Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Troubleshooting JSA HA Deployments

 

Use the status of the HA hosts in the System and License Management window to help you troubleshoot.

Status Combinations and Possible Resolutions

The following table describes the possible status settings for primary and secondary HA hosts. Each status combination requires a different troubleshooting approach.

Table 1: System and License Management Window Host Statuses

Primary HA host status

Secondary HA host status

Possible action

Active

Failed or Unknown

Ensure that the secondary host is on, and that you can log on to it as a root user by using SSH. If you can connect, see Restoring a Failed Secondary HA Host.

Failed or Unknown

Active

Ensure that the primary host is on, and that you can log on to it as a root user by using SSH. If you can connect, see Restoring a Failed Primary HA Host.

Unknown

Unknown

If you cannot connect to the primary or secondary HA host by using SSH, ensure that your network and hardware configuration is operational.

Offline

Active

To set the primary host online, see Restoring a Failed Primary HA Host.

Identifying Active Hosts

You can identify the most recent active host in your HA cluster by using SSH.

  1. To display the HA cluster configuration, type the following command:

    /opt/qradar/ha/bin/ha cstate

  2. Review the following line: in the output:

    Local: R:PRIMARY S:ACTIVE/ONLINE CS:NONE P:1:0 HBT:UP RTT:2 1:0 SI:4105589 Remote: R:SECONDARY S:STANDBY/ONLINE CS:NONE P:1.0 HBC:UP RTT:2 I:11753 SI:1382557

    • If the line does not display the following text, cs:Connected, determine the most recent active HA host in the HA cluster.

    • If the output displays the following text, Secondary/Primary, the secondary HA Host is the active system.

    • If the output displays the following text, ro:Primary/Secondary, the primary HA Host is the active system.

  3. If the line displays ro:Secondary/Secondary, review the following line in the output:

    0: cs:Connected ro:Secondary/Secondary

    • If the output displays the following text, ds:< >/UpToDate, the secondary HA Host is the active system.

    • If the output displays the following text, ds:UpToDate/< >, the primary HA Host is the active system.

    • If the output displays the following text, ds:< >/< >, determine the most recent active HA host in your HA cluster.

    • If the output displays the following text, ds:UpToDate/UpToDate, determine the most recent active HA host in your HA cluster.