Skip to main content

Integrations

Data Not Added to Reference Table

Problem: Data is not being added into the reference table even though the PCE and port connections were saved successfully.

The problem may be that the configured QRadar Authorization Token has read-only access.

  1. Perform the docker ps command on your QRadar instance using SSH.

  2. Find the Container ID of of the Illumio App. The Container ID for the Illumio App will be an image column that contains a previously copied number, such as qapp-1062.

  3. Perform the docker exec -it <container-id> /bin/bash command to go inside the Docker container.

  4. Inside the Docker container of the Illumio App v1.4.0, do the following:

    1. Change the working directory: cd/opt/app-root/store/log.

    2. View data collection logs: tail -f label_data_collect.log.

    3. Verify log messages with the following screenshot.

      DataNotAddedtoReferenceTable.png

This happens when the configured QRadar Authorization Token doesn't have create/edit access to the Reference Table.

Make sure that the created QRadar authorization token has sufficient access. See Assign User Roles and Capabilities.

CreateQRadarAuthTokenwithAdminRights.jpg
Data Not Collected

Problem: Data is not being collected by the app.

Follow the steps in General Troubleshooting.

UI Issues

A dashboard panel, configuration page, or chart shows errors or displays unintended behavior.

  1. Clear the browser and reload the page.

  2. Try reducing the time range of the filter and retry. QRadar queries can expire if too much data is matched in the query.

Reinstall the Application

If you encounter any errors, reinstall the application.

  1. Remove all saved searches and custom properties associated with the Illumio ASP V2 log source type.

  2. Navigate to Admin Panel > Log Sources and delete the log source associated with the Illumio ASP V2 log source type.

  3. Uninstall the app.

    See Uninstall the App.

  4. Refresh the page and make sure that you cannot see the Illumio Overview Dashboard tab after you have uninstalled the app.

  5. Reinstall the app from Extension Management.

    See Install QRadar.

General Troubleshooting

If you encounter a problem that is not described in this document, follow these steps to troubleshoot your issue.

  1. Click System and License Management in the Admin Panel.

  2. Select the host on which the Illumio application is installed.

  3. On the top panel, click Actions, and select Collect Log Files.

  4. On the Log File Collection window, click Advanced Options and check the following check boxes:

    • Include Debug Logs

    • Application Extension Logs

    • Setup Logs (Current Version)

  5. For data input, select 2 Days.

  6. Click Collect Log Files.

  7. Click the Click here to download files link.

    This downloads all the logs in a single zip file on your local machine.

  8. Create a support case with Illumio Support and attach the zipped log files.