IBM Support

QRadar missed payloads/logs Error - ErrorStream tunnel.host

How To


Summary

In the event of a loss of connection between, the QRadar console and one or more managed hosts, the issue is automatically repaired by QRadar. However, system dashboards cannot represent actual incoming traffic during this time.

Objective

To create a rule that notifies a user when networking issues occur so that chart gaps can be identified as false positive alarms and safely ignored.

Steps

The Log Activity tab displays not incoming events but can also display the contents of qradar.log in the form of events from the System-Notification-2 log source. This can be used to identify back-end events for which there is no notification in the UI. 

For example, – a Java™ messaging service (JMS) tunnel between the Event Collector (EC) and the Console has shut down with an error. As a result, the dashboard displays what looks like a gap in the traffic. But the EC is still sending events to the Console – the Accumulator is unaware of the number of events the Console receives. So, the graph does not reflect incoming traffic in this case. 

The Accumulator, responsible for charts, is a centralized process that gathers statistical data from local console logs. While an issue of this nature is ongoing, the Accumulator can be dealing with inaccurate log information.

This can be indicated by an event with a description:
[hostcontext.hostcontext] ComponentOutput: [ERROR] ErrorStream tunnel.<tunnel_ID>: Job for tunnel@<tunnelID> because the control process exited with error code.

  1. Open (one of) one or more events to investigate the details and click the Extract Properties button.
  2. In the "Test Field" section of the Extract Properties window, highlight the string "tunnel@<tunnelID> service failed". Write a regular expression to match and test this string – when successful QRadar highlights the matching text in yellow. Give the property a name and save it.
  3. Next, create a new event rule with the test "when this property equals this property".
    Rule Wizard
  4. For the first property, select "Payload"; for the second property, select the CEP created above. So, it looks like: "And when Payload equals <CEP_Name>".

  5. Select a rule response by your use case.

Result

The Rule is created which notifies a user when networking issues occur.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtEAAQ","label":"Log Activity"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
19 June 2023

UID

ibm16983494