Storage exception

Symptoms

Error: “Unable to connect to the Storage Account [Storage Account Name]. Ensure that the Storage Account Connection String is valid and that QRadar can connect to [Storage Account Host Name]."

"An error occurred that represents an exception for the Microsoft Azure Storage Service. An attempt will be made to query for content at the next retry interval."

Causes

Storage exception errors represent issues that occur when you authenticate with a storage account or when you communicate with a storage account. An attempt is made to query for content at the next retry interval. There are two common issues that might occur due to a storage exception.
  1. The storage account connection string is invalid.
  2. Network issues are preventing QRadar from communicating with the storage account.

Resolving the problem

Follow these steps to resolve your storage exception error.

  1. Ensure that the storage account connection string is valid and displays in a similar format to the following example.

    DefaultEndpointsProtocol=https;AccountName=<Storage Account Name>;AccountKey=<Storage Account Key>;EndpointSuffix=core.windows.net

  2. Ensure that QRadar can communicate with the storage account host on port 443.
  3. Ensure that QRadar can communicate with the event hub on port 5671.
  4. Verify that the system time in QRadar matches the current time. Security settings on the storage account prevent mismatched times between the server (storage account) and the client (QRadar).
  5. Ensure that a certificate is downloaded manually or by using the Automatically Acquire Server Certificate(s) option. The certificates are downloaded from <Storage Account Name>.blob.core.windows.net.