IBM Support

QRadar: Applications display offline mode or can fail to connect to external URLs due to an iptables rule

Troubleshooting


Problem

Administrators may experience connection issues with apps that need to communicate with external resources. This can lead to problems where these apps fail to function as intended or they may show stale information.  These apps include, but not limited to, QRadar Assistant, Threat Intelligence and Watson Advisor

Symptom

Administrators may see any of the following symptoms:
  1. Apps like QRadar Assistant, Watson, or Threat Intelligence may display a banner indicating the app is having problems connecting to X-force® Exchange.
    image 9767
  2. The app container logs indicate a problem with name resolution to an external resource. 
    021-03-31 06:21:46,151 [abstract_qpylib.log] [MainThread] [INFO] - 127.0.0.1 [APP_ID/2651]
[NOT:0000006000] Proxy.py: make_request: ERROR: HTTPSConnectionPool(host='api.xforce.ibmcloud.com', 
port=443): Max retries exceeded with url: /lang (Caused by NewConnectionError('<urllib3.connection.
VerifiedHTTPSConnection object at 0x7fee7da45510>: 
Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',))
  3. Apps that pull data based on a regular interval, show no recent data being populated. For example. Threat Intel shows no new IOCs being updated, due to the fact that the app can not reach the intended URL.
  4. Output of  /opt/qradar/support/recon ps will show "-" against columns I,J & K.
    image 9749

Document Location

Worldwide

[{"Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
18 May 2021

UID

ibm16430697

Page Feedback