Timeout exception
Symptoms
Error: “Ensure that there are no network related issues preventing the connection. Additionally ensure that the Event Hub and Storage Account Connection Strings are valid.”
Error: “The server did not respond to the requested operation within the specified time, which is controlled by OperationTimeout. The server might have completed the requested operation. This exception can be caused by network or other infrastructure delays. An attempt will be made to query for content at the next retry interval.”
Causes
The most common cause is that the connection string information is invalid. The network might be blocking communication, resulting in a timeout. While rare, it is possible that the default timeout period (60 seconds) is not long enough due to network congestion.
Resolving the problem
Follow these steps to resolve your timeout exception error.
- When you copy the event hub connection string from the Azure portal to IBM QRadar, ensure that no additional white space or invisible characters are added. Alternatively, before you copy the string, ensure that you don't copy any additional characters or white space.
- Verify that the storage account connection string is valid and appears in a similar format to
the following example:
DefaultEndpointsProtocol=https;AccountName=<Storage Account Name>;AccountKey=<Storage Account Key>;EndpointSuffix=core.windows.net
- Ensure that QRadar can communicate with the storage account host on port 443, and with the event hub on ports 5671 and 5672.
- Ensure that a certificate is downloaded manually or by using the Automatically Acquire Server Certificate(s) option. The certificates are downloaded from <Storage Account Name>.blob.core.windows.net.
- Advanced- There is a hidden parameter that can increase the default timeout from 60 seconds. Contact support for assistance in getting the timeout increased.