A higher than usual load is seen on the management port and we need a way to verify if the crossover connection is working.

A high load is seen on the management interface.

A possible crossover connection issue.

To test the HA crossover connection, here are some commands to verify that your crossover is working and sending data.

To test the crossover status:

• JSA 7.3.0 and above /opt/qradar/ha/bin/qradar_nettune.pl crossover
• JSA 2014.8 and prior/opt/qradar/bin/qradar_nettune.pl crossover status
   

To test the crossover heartbeat:

• JSA 7.3.0 and above /opt.qradar/ha/bin/qradar_nettune.pl crossover test link
• JSA 2014.8 and prior /opt/qradar/bin/qradar_nettune.pl crossover test link
   

JSA synchronization uses SSH. To test if you can move data between nodes, SSH between the nodes. If you can SSH from each node and back on the crossover connection, data can be synchronized.

[root@QRadar-727-1-primary ~]# ssh 169.254.1.2
Last login: Mon Nov 21 09:30:18 2016 from 169.254.1.1
This server has QRadar 7.2.7.20161017135129 installed on Tue Nov 8 14:18:53 EST 2016.
[root@QRadar-727-1-secondary ~]#

Test the link using the cstate command:

• JSA 7.3.0 and after: /opt/QRadar/ha/bin/ha cstate
• JSA 2014.8 and before: /opt/qradar/ha2/bin/ha cstate
   

In this example, a 1.0 status equals pass and 0.0 would be fail. LSN refers to the locale node, which is primary at this moment and RSN is the Remote node.

Results: All tests indicate that crossover is working.