IBM QRadar: Principais Comandos e Arquivos - Revision history

Ebasso: /* Principais arquivos */

2025-03-25T18:13:04Z

Principais arquivos

← Older revision		Revision as of 18:13, 25 March 2025
Line 26:		Line 26:
	/store -> is used as directory for DB, Config. deployment files, and all stored events and flows data.		/store -> is used as directory for DB, Config. deployment files, and all stored events and flows data.

			* [https://www.ibm.com/community/101/qradar/tools/ Support Tools 101]
	* [https://www.ibm.com/support/pages/qradar-core-services-and-impact-restarting-services QRadar: Core services and the impact of restarting services]		* [https://www.ibm.com/support/pages/qradar-core-services-and-impact-restarting-services QRadar: Core services and the impact of restarting services]

2025-03-24T13:14:14Z

← Older revision		Revision as of 13:14, 24 March 2025
Line 12:		Line 12:
	\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar		\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar
	\|- support		\|- support
			\| \|- deployment_info.sh -FO -> identify your firmware version
	\| \|- get_logs.sh -S -> Get application logs. Add -S to get setup logs		\| \|- get_logs.sh -S -> Get application logs. Add -S to get setup logs
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps

2025-03-24T13:12:35Z

← Older revision		Revision as of 13:12, 24 March 2025
Line 12:		Line 12:
	\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar		\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar
	\|- support		\|- support
			\| \|- get_logs.sh -S -> Get application logs. Add -S to get setup logs
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps
	\| \|- recon -> Conecta ao container rodando a aplicação "recon connect <id>"		\| \|- recon -> Conecta ao container rodando a aplicação "recon connect <id>"
	\| \|- threadTop.sh -> thread like Top command, para aplicativos do QRadar		\| \|- threadTop.sh -> thread like Top command, para aplicativos do QRadar
			\| \|- validate_deployment.sh -> Pretests/review before you start a QRadar software update
	\|- upgrade		\|- upgrade
	\| \|- util		\| \|- util

2025-03-24T13:08:18Z

Commands

← Older revision		Revision as of 13:08, 24 March 2025
Line 36:		Line 36:

	ariel_query --no-verify -u admin --output table --query "select QIDNAME(QID) from EVENTS limit 10"		ariel_query --no-verify -u admin --output table --query "select QIDNAME(QID) from EVENTS limit 10"

			== System Notifications ==

			* '''38750033 / 38750035''' - Unable to execute a backup request notifications
			* '''38750055 / 38750004''' - Memory notifications
			* '''38750056''' - TX Sentry long transaction notifications
			* '''38750058 / 38750043''' - Process stopped notifications
			* '''38750060 / 38750061''' - Performance or event pipeline degradation notifications
			* '''38750080 / 38750081''' - HA active or HA standby failure system notifications
			* '''38750085''' - Data replication experiencing difficulty notifications
			* '''38750092''' - Disk Sentry notices for unavailable storage partitions
			* '''38750098''' - Backup notifications
			* '''38750110 / 38750111''' - Disk failure system notifications
			* '''38750129''' - Time synchronization system notifications
			* '''38750140''' - RAID controller misconfiguration notifications

	= Ver também =		= Ver também =

2025-03-24T12:35:52Z

Ver também

2025-03-24T12:34:48Z

Commands

← Older revision		Revision as of 12:34, 24 March 2025
Line 26:		Line 26:

	== Commands ==		== Commands ==

			=== Run a command in all QRadar servers ===

			'''/opt/qradar/support/all_servers.sh -k''' df -h /root /var/log \| tee diskcheck.txt

	=== ariel_query ===		=== ariel_query ===

			Run a aql directly from command line

	ariel_query --no-verify -u admin --output table --query "select QIDNAME(QID) from EVENTS limit 10"		ariel_query --no-verify -u admin --output table --query "select QIDNAME(QID) from EVENTS limit 10"

2025-02-03T11:09:31Z

Principais arquivos

← Older revision		Revision as of 11:09, 3 February 2025
Line 13:		Line 13:
	\|- support		\|- support
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps
	\| \|- recon. -> Conecta ao container rodando a aplicação "recon connect <id>"		\| \|- recon -> Conecta ao container rodando a aplicação "recon connect <id>"
			\| \|- threadTop.sh -> thread like Top command, para aplicativos do QRadar
	\|- upgrade		\|- upgrade
	\| \|- util		\| \|- util

2025-02-03T11:03:46Z

Principais arquivos

← Older revision		Revision as of 11:03, 3 February 2025
Line 13:		Line 13:
	\|- support		\|- support
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps
			\| \|- recon. -> Conecta ao container rodando a aplicação "recon connect <id>"
	\|- upgrade		\|- upgrade
	\| \|- util		\| \|- util

2025-01-31T19:00:09Z

Commands

← Older revision		Revision as of 19:00, 31 January 2025
Line 20:		Line 20:
	\|- conf		\|- conf
	/store -> is used as directory for DB, Config. deployment files, and all stored events and flows data.		/store -> is used as directory for DB, Config. deployment files, and all stored events and flows data.

			* [https://www.ibm.com/support/pages/qradar-core-services-and-impact-restarting-services QRadar: Core services and the impact of restarting services]

	== Commands ==		== Commands ==

2025-01-31T18:34:23Z

← Older revision		Revision as of 18:34, 31 January 2025
Line 10:		Line 10:
	\| \|- qchange_netsetup -> Realiza a troca de IP, DNS, ...		\| \|- qchange_netsetup -> Realiza a troca de IP, DNS, ...
	\|- conf/		\|- conf/
	\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar		\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar
	\|- support		\|- support
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps
Line 19:		Line 19:
	\| \| \| \| \|- do_deploy.pl -> deploy events for		\| \| \| \| \|- do_deploy.pl -> deploy events for
	\|- conf		\|- conf
			/store -> is used as directory for DB, Config. deployment files, and all stored events and flows data.

	== Commands ==		== Commands ==

← Older revision		Revision as of 13:14, 24 March 2025
Line 12:		Line 12:
	\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar		\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar
	\|- support		\|- support
			\| \|- deployment_info.sh -FO -> identify your firmware version
	\| \|- get_logs.sh -S -> Get application logs. Add -S to get setup logs		\| \|- get_logs.sh -S -> Get application logs. Add -S to get setup logs
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps

← Older revision		Revision as of 13:12, 24 March 2025
Line 12:		Line 12:
	\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar		\| \|- nva.conf -> Um dos principais arquivos e configuração do QRadar
	\|- support		\|- support
			\| \|- get_logs.sh -S -> Get application logs. Add -S to get setup logs
	\| \|- qappmanager -> verify status of all apps		\| \|- qappmanager -> verify status of all apps
	\| \|- recon -> Conecta ao container rodando a aplicação "recon connect <id>"		\| \|- recon -> Conecta ao container rodando a aplicação "recon connect <id>"
	\| \|- threadTop.sh -> thread like Top command, para aplicativos do QRadar		\| \|- threadTop.sh -> thread like Top command, para aplicativos do QRadar
			\| \|- validate_deployment.sh -> Pretests/review before you start a QRadar software update
	\|- upgrade		\|- upgrade
	\| \|- util		\| \|- util