Troubleshooting
Problem
New host pairings do not work when the host ID between the main site and the destination site is different. When a user attempts to pair the hosts, the pairing fails and Error getting host messages are written to the logs.
Symptom
If you attempt to pair the managed hosts, the main page displays paired hostname as N/A.
Environment
Users on QRadar V7.5.0 Update Package 2 with Data Synchronization app V3.1.0 reported that the Console paired successfully, but the Event Processor or other managed hosts did not pair as expected. If you experience the issue described in this technical note, update to QRadar Data Synchronization app V3.1.1.
Diagnosing The Problem
Users who reported the issue stated that the Console paired successfully, but the managed hosts, such as an Event Processor did not successfully pair.
You can verify the issue in the following three scenarios:
You can verify the issue in the following three scenarios:
Pair from managed hosts for 3.1.0
Use the following steps to reproduce the issue:
- Set up two sites each with console and EP and 3.1.0 clean installation. Make sure the host IDs are different for the managed hosts. For example, add two EPs on one site and then remove one.
- Attempt to pair the hosts.
- The following error, 'Error getting host: Host with id: nn does not exist' is displayed:
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] APIException { [ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] status: 400, [ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] unique_code: 1002, [ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] message: 'Error getting host: Host with id: 55 does not exist.', [ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] toString: [Function: toString] [ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] }
Pair from the main site in the main app logs
If you attempt to pair from main site in the main app logs, call API (nginx_access log)
"GET /api/secondary_server/55 HTTP/1.1" 400 82 "-" "node-fetch/1.0 (+https://github.com/bitinn/node-fetch)"
The error is displayed that the host does not exist.
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] APIException {
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] status: 400,
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] unique_code: 1002,
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] message: 'Error getting host: Host with id: 55 does not exist.',
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] toString: [Function: toString]
[ERROR] [Thu Oct 27 2022 06:26:48 GMT-0400 (Eastern Daylight Time)] }
Attempting to pair from the destination
If you attempt to pair from destination site, the following error is displayed:
APIException {
[ERROR] [Thu Oct 27 2022 06:41:00 GMT-0400 (Eastern Daylight Time)] status: 400,
[ERROR] [Thu Oct 27 2022 06:41:00 GMT-0400 (Eastern Daylight Time)] unique_code: 1002,
[ERROR] [Thu Oct 27 2022 06:41:00 GMT-0400 (Eastern Daylight Time)] message: 'Error getting host: undefined',
[ERROR] [Thu Oct 27 2022 06:41:00 GMT-0400 (Eastern Daylight Time)] toString: [Function: toString]
[ERROR] [Thu Oct 27 2022 06:41:00 GMT-0400 (Eastern Daylight Time)] }
Resolving The Problem
Administrators who experience errors related to, 'Error getting host: Host with id: nn does not exist' need to upgrade the Data Synchronization application to version 3.1.1 or later.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
27 February 2023
UID
ibm16955487