IBM Support

QRadar: Unable to add Managed Host to Deployment

Troubleshooting


Problem

Adding new manged host to the deployment fails with a Tomcat error in the logs.

Symptom

On the managed host, in /var/log/setup-7######/presence.log look for this error:

Mon Aug 22 04:43:27 MDT 2016: service postgresql start
Starting postgresql service: ^MESC[0KStarting postgresql service: DB took 2 seconds[ OK ]
Mon Aug 22 04:43:29 2016 [presence.pl-10270]: Syncing local time to console host

Mon Aug 22 04:43:35 2016 [presence.pl-10270]: Testing tomcat connection ...

Mon Aug 22 04:44:47 2016 [presence.pl-10270]: Tomcat is not connected. ERROR:100024

Cause

This is caused if port 443 is blocked between the Console and the Managed Host. If encryption is not used, Port 443 will need to be opened on the firewall between the Console and the Managed Host.

Resolving The Problem

To test connectivity, try to telnet to Console from the Managed Host on port 443. Using an SSH session connect to the Managed Host and execute the following command:

telnet Console_IP 443

Note: Replace Console_IP with the actual IP of the Console.


If telnet fails to connect on port 443 and opening the firewall is not allowed per security policy, the host can be added selecting the "Encrypt Host Connections" option instead. This will allow all communication to occur over the SSH port 22.

To do this:

  1. Log in to the QRadar Web User Interface.
  2. Click Admin tab > System and License Management icon.
  3. Click Deployment Actions > Add Host.

  4. Add the required Information and click the box Encrypt Host Connections.

  5. Click Add.
 

This allows communication between the Console and Managed Host to be on port 22 instead of port 443.

Results: you can now add the Managed Host to the Deployment.

[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Installation","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
10 August 2021

UID

swg21997790

Page Feedback