IBM Support

QRadar: There appears to be a configuration issue with the provider connection

Troubleshooting


Problem

After a Log Source is configured, or after a Log Source in error status is selected, receive error message: "There appears to be a configuration issue with the provider connection."

Symptom

In /var/log/qradar.log error "configuration issue with the provider connection" can be seen:
[ecs] [SFTP Provider Protocol Provider Thread: class com.q1labs.semsources.sources.remote.transferprotocol.sftp.SFTPProvider103] com.q1labs.semsources.sources.remote.RemoteStreamSource: [ERROR] [NOT:0070003100][{CONSOLE}/- -] [-/- -]There appears to be a configuration issue with the provider connection 'class com.q1labs.semsources.sources.remote.transferprotocol.sftp.SFTPProvider103'.
[ecs] [SFTP Provider Protocol Provider Thread: class com.q1labs.semsources.sources.remote.transferprotocol.sftp.SFTPProvider103] com.q1labs.semsources.sources.remote.RemoteStreamSource: [INFO] [NOT:0000006000][{CONSOLE}/- -] [-/- -]Provider 'class com.q1labs.semsources.sources.remote.transferprotocol.sftp.SFTPProvider103' stopped.

Cause

Can occur after:
  • A password was changed on the remote host
  • One of the configuration variables was changed on QRadar or the remote host
  • The remote source software was updated

Resolving The Problem

  1. Log in to QRadar.
  2. Click the Admin tab.
  3. Click the QRadar Log Source Management icon.
  4. Select the Log Source in error status.
    Note: the error filter and other filters can help your search efforts.
  5. If the log source contains a password variable, reenter the password.
    Note: bulk added windows log sources can be updated in bulk.
  6. Verify that each configuration variable, and do not assume that anything is correct. 
    Note: You can search for information on your specific log source variables on the DSM support pages.
  7. Test the log source connectivity.
    Note: only some log sources have the test feature available.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Document Information

Modified date:
10 July 2023

UID

ibm17010899

Page Feedback