Intrusion Prevention
Highlighted
Intrusion Prevention

STRM problem after upgrade to v2012.1.r1

‎11-21-2012 01:08 AM

After upgrade (reinstall ) i am not getting any flows and are getting allot of error messages like:

 

"


System Notification (1 of 11)

Process monitor: Application has failed to start up multiple times.

Nov 21 09:23:28 127.0.0.1 [hostcontext.hostcontext] [ProcessMonitor] com.q1labs.hostcontext.processmonitor.ProcessManager: [ERROR] [NOT:0150114103][172.17.0.1/- -] [-/- -]Process qflow.qflow0 has failed to start for 1882 intervals. Continuing to try to start...

"

 

Anyone knows how to get the qflow process back up and running again ?

 

BR

Daniel

3 REPLIES 3
Highlighted
Intrusion Prevention

Re: STRM problem after upgrade to v2012.1.r1

‎11-21-2012 03:55 AM

Update:

 

Seems to be some directory missing..

 

"

[root@sestostrm01 log]# /opt/qradar/bin/qflow.qflow0 --nodaemon -p -r60 -c /opt/qradar/conf/nva.conf
Failed to create fifo "/store/proc/qflow.qflow0.cmd": No such file or directory
Failed to create fifo "/store/proc/qflow.qflow0.status": No such file or directory
ProcFile: procfile.cc:114: Failed to open fifo /store/proc/qflow.qflow0.cmd: No such file or directory
ProcFile: FileMonitor started
ProcFile: procfile.cc:114: Failed to open fifo /store/proc/qflow.qflow0.cmd: No such file or directory
Segmentation fault
[root@sestostrm01 log]# /opt/qradar/bin/qflow.qflow0 --nodaemon -c /opt/qradar/conf/nva.conf
Failed to create fifo "/store/proc/qflow.qflow0.cmd": No such file or directory
Failed to create fifo "/store/proc/qflow.qflow0.status": No such file or directory
ProcFile: procfile.cc:114: Failed to open fifo /store/proc/qflow.qflow0.cmd: No such file or directory
ProcFile: FileMonitor started
ProcFile: procfile.cc:114: Failed to open fifo /store/proc/qflow.qflow0.cmd: No such file or directory
Segmentation fault
[root@sestostrm01 log]# ls -l "/store/proc/qflow.qflow0.cmd"
ls: /store/proc/qflow.qflow0.cmd: No such file or directory
[root@sestostrm01 log]# ls -l /store/proc/qflow.*
ls: /store/proc/qflow.*: No such file or directory
[root@sestostrm01 log]# ls -l /store/proc/
ls: /store/proc/: No such file or directory
[root@sestostrm01 log]# ls -l /store/

"

So i created the /store/proc folder, and now it can create the qflow.qflow0.cmd and some other files under there but i still get Failed..

 

 

"

[root@sestostrm01 log]# /opt/qradar/init/qflow status qflow.qflow0
qflow.qflow0 is stopped
[root@sestostrm01 log]# /opt/qradar/init/qflow  start  qflow.qflow0
[Q] Starting qflow.qflow0.qflow service: /opt/qradar/bin/qflow.qflow0 -p -r60 -c /opt/qradar/conf/nva.conf
                                                           [FAILED]

"

...Any suggestions on how to get it running ?

 

BR

Daniel

Highlighted
Intrusion Prevention

Re: STRM problem after upgrade to v2012.1.r1

‎11-21-2012 05:37 AM

Update:

from the messages log:

 

"

Nov 21 14:28:51 sestostrm01 kernel: qflow0[30219]: segfault at 0000000000000008 rip 00002b68fe1e391e rsp 00007fff157ddd40 error 4
Nov 21 14:29:58 sestostrm01 kernel: qflow0[2949]: segfault at 0000000000000008 rip 00002ba63224f91e rsp 00007fff839e7d30 error 4
Nov 21 14:31:06 sestostrm01 kernel: qflow0[8011]: segfault at 0000000000000008 rip 00002b8fc162691e rsp 00007fff0935a0e0 error 4
Nov 21 14:32:13 sestostrm01 kernel: qflow0[12888]: segfault at 0000000000000008 rip 00002b9115a7b91e rsp 00007fff477f95a0 error 4
Nov 21 14:33:21 sestostrm01 kernel: qflow0[17767]: segfault at 0000000000000008 rip 00002b04c8a3891e rsp 00007fff310ea7a0 error 4
Nov 21 14:34:28 sestostrm01 kernel: qflow0[22758]: segfault at 0000000000000008 rip 00002ae50486391e rsp 00007fff33bb4940 error 4
Nov 21 14:35:35 sestostrm01 kernel: qflow0[27817]: segfault at 0000000000000008 rip 00002b70c54bc91e rsp 00007fff029a4e30 error 4

"

Highlighted
Intrusion Prevention

Re: STRM problem after upgrade to v2012.1.r1

‎11-22-2012 04:25 AM

update:

 

Tried reinstalling qflow-7.0.0-301503_ctrh.i386.rpm but still the same problem..

 

 

[root@sestostrm01 cdrom]# /opt/qradar/bin/qflow.qflow0 --nodaemon
ProcFile: FileMonitor started
Segmentation fault

...
Any hot tips ?

 

 

/D

Feedback