IJ33650: 'ERRORSTREAM FLUSH-KEY-FOR-IPADDRESS' ERROR MESSAGES BEING WRITTEN TO QRADAR LOGGING

APAR status

• Closed as program error.

Error description

• Repeating "ErrorStream" messages can sometimes be observed in
  /var/log/qradar.log as well as Managed Hosts attempting to
  connect to other Managed Hosts over port 22.
  
  Messages similar to the following might be visible in
  /var/log/qradar.log when this issue occurs:
  [hostcontext.hostcontext] [Thread-1913] ComponentOutput: [ERROR]
  [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  flush-key-for-ipaddress: # ipaddress:22 SSH-2.0-OpenSSH_7.4 May
  13 10:14:28 ::ffff:127.0.0.1 [hostcontext.hostcontext]
  [Thread-1917] ComponentOutput: [ERROR]
  [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  flush-key-for-ipaddress: # ipaddress:22 SSH-2.0-OpenSSH_7.4 May
  13 10:14:28 ::ffff:127.0.0.1 [hostcontext.hostcontext]
  [Thread-1919] ComponentOutput: [ERROR]
  [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  flush-key-for-ipaddress: # ipaddress:22 SSH-2.0-OpenSSH_7.4 May
  13 10:14:28 ::ffff:127.0.0.1 [hostcontext.hostcontext]
  [Thread-1921] ComponentOutput: [ERROR]
  [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  flush-key-for-ipaddress: # ipaddress:22 SSH-2.0-OpenSSH_7.4 May
  13 10:14:29 ::ffff:127.0.0.1 [hostcontext.hostcontext]
  [Thread-1923] ComponentOutput: [ERROR]
  [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  flush-key-for-ipaddress: # ipaddress:22 SSH-2.0-OpenSSH_7.4 May
  13 10:14:30 ::ffff:127.0.0.1 [hostcontext.hostcontext]
  [Thread-1925] ComponentOutput: [ERROR]
  [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  flush-key-for-ipaddress: # ipaddress:22 SSH-2.0-OpenSSH_7.4
  

Local fix

• No workaround available.
  APARs identified with no workaround may require a software
  delivery to resolve. This reported issue will be considered for
  a future release and administrators can subscribe to the APAR to
  get updates by clicking on the Subscribe button on the right
  side of this page or ask a question about this APAR in our
  Support Forums.
  https://ibm.biz/qradarforums
  

Problem summary

• This issue was fixed in QRadar QRM QVM release of 7.5.0.
  

Problem conclusion

• This issue was fixed in QRadar QRM QVM release of 7.5.0.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  QRADAR SOFTWARE

• Fixed component ID

  5725QRDSW

Applicable component levels