IBM Support

Event details in log-activity tab shows different Event Collector ID than target Event Collector set in the Log Source configuration.

Troubleshooting


Problem

Events pulled using the protocols like Universal Cloud REST API, Amazon AWS REST API, JDBC etc., route to an incorrect Event collector/processor in the deployment. Specifically, they are being directed to EventCollectorX, whereas the designated target should be EventCollectorY.

Cause

If we change the target event collector in the log source configuration, the change does not reflect in the event details and events are still received on the older EC set for the log source. This happens due to marker file not getting updated.
For example: 
While creating log source for first time, the target event collector was set to EventCollectorX and then changed to EventCollectorY, but the events were just showing EventCollectorX in the event details.

Environment

Logsources using pull protocols like Universal Cloud REST API, Amazon AWS REST API, JDBC etc.

Diagnosing The Problem

Confirm the problem by checking if the event details show incorrect Event Collector (e.g: the Event Collector ID in the event details shows EventCollectorX instead of EventCollectorY)

Perform below check to eliminate configuration issues:

  1. Verify if the log source configuration is showing the right Target Event Collector.
  2. Reconfigure the log source and check if the issue still persists.
  3. Run tcpdump on EventCollectorX and EventCollectorY, events were noticed on EventCollectorY.
If the issue still persists, it could be due to be outdated marker files which still pointed to older EventCollector.

Resolving The Problem

  1. Check marker file on both Event Collectors (EventCollectorX and EventCollectorY):
    • To get spconfig for the logsource, please run:
      psql -U qradar -c "select spconfig from sensordevice where id = '<logsource ID>'";
    • Navigate to /store/ec/UniversalCloudRestAPI/<spconfig> directory on both EC hosts
    • cat the marker file present at this location
    • Check and compare the timestamp value in both marker files
      If the timestamp in the marker file on new EC i.e. EventCollectorY is not changing while the timestamp value in the marker file on EventCollectorX keep updating to current timestamp, proceed to the next steps. 
       
  2. Disable Log Source in the Logsource Management App.
  3. Move the marker file on older EC host:
    • Move the marker file on the incorrect eventcollector (EventCollectorX).
    • Navigate to /store/ec/universalcloudrestapi/<SPConfig>/
    • Find the file and move it to /store/IBM_support
       
  4. Regenerate marker/state File on correct EventCollector (EventCollectorY in our example):
    • Regenerate the file by running the command: mv file1 file1_bk
       

  5. Restart ecs-ec-ingress service:
    systemctl restart ecs-ec-ingress

  6. Enable the log source in the Logsource Management App and Perform Test on the logsource.

    In the log activity tab, check the latest logs for this logsource and verify if the eventcollector ID is same as target event collector set in the log source configuration.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
21 July 2024

UID

ibm17157086

Page Feedback