IBM Support

IJ33703: ENCRYPTED TUNNEL BETWEEN MANAGED HOSTS CAN FAIL TO START AFTER PATCHING TO QRADAR 7.4.3 FP1 OR NEWER

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • An encrypted tunnel between two Managed Hosts that have been
installed at an earlier build and then patched independently to
QRadar version 743 FP1 or newer can fail to start.
Messages similar to the following might be visible in
/var/log/qradar.log when this issue occurs:
hostname-primary.fqnd ssh[31216]: debug1: expecting
SSH2_MSG_KEX_ECDH_REPLY
hostname-primary.fqdn ssh[31216]: debug1: Server host key:
ecdsa-sha2-nistp256
SHA256:9bmfZQ2qbj5zYrT3Fo5K04gKOevEic4S36baS1x4i6o
hostname-primary.fqdn ssh[31216]: No ECDSA host key is known for
(ipaddress) and you have requested strict checking.
hostname-primary.fqdn ssh[31216]: Host key verification failed.
hostname-primary.fqdn systemd[1]:
[email protected]: main process exited,
code=exited, status=255/n/a
hostname-primary.fqdn systemd[1]: Unit
[email protected] entered failed state.

hostname-primary.fqdn systemd[1]:
[email protected] failed.

Local fix

  • Run the following command from an SSH session to the QRadar
Console after the host(s) is added to the deployment:
#/opt/qradar/bin/deploy_known_hosts.sh

Problem summary

  • This issue has been resolved in QRadar 7.5.0 Update Package 4.

Problem conclusion

  • This issue has been resolved in QRadar 7.5.0 Update Package 4.

Temporary fix

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    IJ33703
    • 

  • Reported component name
    QRADAR SOFTWARE
    • 

  • Reported component ID
    5725QRDSW
    • 

  • Reported release
    743
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt / Xsystem
    • 

  • Submitted date
    2021-07-09
    • 

  • Closed date
    2022-12-13
    • 

  • Last modified date
    2022-12-13
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    

  • Fixed component name
    QRADAR SOFTWARE
    • 

  • Fixed component ID
    5725QRDSW
    • 



Applicable component levels


    








      
              
                            

              

              [{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"743","Line of Business":{"code":"LOB24","label":"Security Software"}}]
              

                          

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            13 December 2022
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback