IBM Support

IV84190: EVENT/FLOW FORWARDING USING ENCRYPTED OFFSITE SOURCE AND TARGET CAN NOT BE ACCOMPLISHED SUCCESSFULLY

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • Forwarding normalized Events and Flows using encrypted offsite
    source and targets cannot be configured successfully to an
    event collector on a managed host.
    The initial configuration process succeeds in the User
    Interface, but the authorized_keys file in /root/.ssh are
    overwritten without including the offsite sources keys during
    the required Deploy changes function after configuration.
    

Local fix

  • Where possible: Do not use the encryption option for offsite
    source and target event/flow forwarding until this issue is
    corrected.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.3.3 GA.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.3.3 GA.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV84190

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    725

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-04-27

  • Closed date

    2019-12-08

  • Last modified date

    2019-12-08

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"725","Edition":""}]

Document Information

Modified date:
08 December 2019