QRadar: High Availability appliance is in Unknown state, 'Sent update status of host to unknown'

Resolving The Problem

1. Use SSH to log in to the Console as root user.
2. Open an SSH session to the active HA appliance.
3. To verify the state of the HA appliance, type:

   /opt/qradar/ha/bin/ha state

4. Navigate to /var/log/qradar.log.
5. Review the output to determine the HA appliance with an Unknown state:
   /var/log/qradar.log: [hostcontext.hostcontext] [Server Host Status Processor] com.q1labs.configservices.controller.ServerHostStatusUpdater: [INFO] [NOT:0000006000][X.X.0.97/- -] [-/- -]Sent update status of host X.X.0.98 to UNKNOWN
   
   Note: In this example the active appliance is 192.168.0.97. The standby appliance is 192.168.0.98 and displays 'Unknown' as the status. Administrators can run the ha state command again to write a ha appliance status message in /var/log/qradar.log.
6. To copy the SSH keys to the active HA appliance, type:

   ​ssh-copy-id {STANDBY_NODE_IP}

   Where {STANDBY_NODE_IP} is the address of the Standby appliance.

   ssh-copy-id X.X.0.98
   /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
   /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
   /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
   root@Standby_Node_IP's password: #############
   
   Number of key(s) added: 1
   
   Now try logging into the machine, with: "ssh X.X.0.98"
   and check to make sure that only the key(s) you wanted were added.

   Results
   After the copy is complete, the administrator can attempt to SSH to the standby appliance. Administrators can verify the status with the /opt/qradar/ha/bin/ha state utility. If you continue to experience issues with Unknown appliances, contact QRadar Support.