There is a common problem with how to add new DNS servers to QRadar if you need to change them. Normally, you should run qchange_netsetup script, which is looking after this change. Nevertheless, the problem appears when there is more than one appliance in the deployment. In order to run the qchange_netsetup script, you would need to remove each of Managed Host from the deployment, then change DNS servers and finally re-add it. It can be a serious problem in the distributed deployments, where you have more than one or two hosts. It was confirmed that there is quick method to change these details without running the mentioned script. Using SSH, log in to your Console as root user. If you need use sudo then run sudo -i (but never just sudo su)

From the Console, you can quickly ssh to the Managed Host, which needs a DNS change. Go to /etc/sysconfig/network-scripts/ location and using any text editor amend the management interface configuration file for DNS servers details. The management interface configuration file name starts with ifcfg-<Management_interface>. Please note, that if there would be DNS3= line in that file, you can safely remove or leave it empty, because QRadar is using only DNS1= and DNS2= lines.

Leave a Reply

Your email address will not be published. Required fields are marked *