Troubleshooting
Problem
Wincollect agent is unable to communicate with the configuration server on port 8413 due to which configuration updates are not pushed from the configuration server to the Wincollect agent. This issue does not affect event collection by that agent.
Symptom
Errors in wincollect.log:
12-11 13:49:20.398 INFO SRV.Code.CertificateManager.X.X.X.X : Attempting to retrieve the certificate from the configuration server
12-11 13:49:20.539 ERROR SRV.Code.CertificateManager.X.X.X.X : Cannot connect to configuration server (336032784)
12-11 13:49:20.539 WARN SRV.System.WinCollectSvc.Service : Register with configuration server failed -- The certificate presented by the configuration server was either missing or its chain was not validated/trusted -- will try again later
Errors in qradar.log of the Configuration server:
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] com.q1labs.sem.semsources.wincollectconfigserver.WinCollectConfigHandler: [ERROR] [NOT:0000003000][X.X.X.X/- -] [-/- -] hit an SSL Negotiation issue, most likely tried to connect with an invalid PEM
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] javax.net.ssl.SSLHandshakeException: no cipher suites in common
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.g.a(g.java:38)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.g.a(g.java:16)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bb.a(bb.java:222)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bb.a(bb.java:22)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bb.a(bb.java:88)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.a2$d.a(a2$d.java:43)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.a2$d.produce(a2$d.java:75)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.p.produce(p.java:63)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.G$e.a(G$e.java:73)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.G$b.a(G$b.java:2)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.G$b.consume(G$b.java:15)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.p.consume(p.java:56)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.aa.a(aa.java:142)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.aa.a(aa.java:146)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bb.a(bb.java:112)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.a0.a(a0.java:8)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bj.b(bj.java:451)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bj.f(bj.java:182)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bj.a(bj.java:508)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.ibm.jsse2.bj.startHandshake(bj.java:60)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at com.q1labs.sem.semsources.wincollectconfigserver.WinCollectConfigHandler.run(WinCollectConfigHandler.java:83)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
Dec 11 13:49:42 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_7] at java.lang.Thread.run(Thread.java:830)
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"TS014735093","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Product":{"code":"SSTZMA","label":"QRadar Appliance Hardware"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
19 December 2023
UID
ibm17096703