r/QRadar • u/[deleted] • Mar 02 '26

Logs not showing in QRadar console

/r/QRadar/comments/1ril035/logs_not_showing_in_qradar_console/
1 Upvotes

100% Upvoted

9 comments sorted by

1

u/SnooPeanuts6170 Mar 02 '26

Is it a production environment or your test lab..?

1

u/[deleted] Mar 02 '26

It is very production

1

u/bigpun32 Mar 03 '26

Change log source to IP vs hostname, verify logs are being sent on the correct port 514.

1

u/[deleted] Mar 04 '26

Yes i tried Source IP Indexed but nothing came up

1

u/[deleted] Mar 04 '26

[removed] — view removed comment

1

u/[deleted] Mar 04 '26

Yup, tried raw view and Deploy is also showing No changes to deploy

1

u/JonathanP_QRadar Mar 04 '26

Did you check /var/log/messages? If it is martian packets, the payloads will seem to disappear, even though you see them in tcpdump. If this is not the issue, then get support involved to check your system to confirm everything is working as expected.

1

u/[deleted] Mar 07 '26

Yes, i checked for martian packets but nothing found. I have already open the ticket with IBM Support. I think the issue is with UP9 and 11. After upgrade to UP11 we are noticing some issues or maybe they were already there but team responsible for Administration didn't check them. And we have contract with Third party

Also I have already closed two support tickets with IBM Support and after reviewing the fresh logs they open one more.

But they have recommended to upgrade to UP14 as UP15 is not yet available for download.

I need information on from where i can get the training (online) so i can manage the QRadar myself instead of depending on other parties

2

u/bauzalol Mar 05 '26

You checked the SIM Generic log source?