www.ibm.com Open in urlscan Pro
2a02:26f0:3500:583::1e89  Public Scan

Form analysis
3 forms found in the DOM

POST /support/pages/ij26949-wincollect-730-managed-agent-communication-issues-reported-qradar-appliances-encrypted-host-connections

<form action="/support/pages/ij26949-wincollect-730-managed-agent-communication-issues-reported-qradar-appliances-encrypted-host-connections" method="post" id="openid-connect-login-form" accept-charset="UTF-8">
  <div><input data-drupal-selector="edit-openid-connect-client-generic-login" type="submit" id="edit-openid-connect-client-generic-login" name="generic" value="Log in with Generic" class="button js-form-submit form-submit">
  </div><input autocomplete="off" data-drupal-selector="form-g43shjs2lv3bkqnkigam8-k4xa7s7rnhuil5jymtyly" type="hidden" name="form_build_id" value="form-g43shjS2lv3BKqNkIGam8-K4XA7s7RNHUIl5jYmtYLY">
  <input data-drupal-selector="edit-openid-connect-login-form" type="hidden" name="form_id" value="openid_connect_login_form">
</form>

<form class="ibm-row-form ibm-home-search ibm" enctype="multipart/form-data" id="spng-search" ng-submit="omniType()">
  <input id="spng-search-query" class="bx--search-input" name="text" size="40" type="search" autocomplete="off" placeholder="Search support or find a product">
  <a title="Search" aria-label="Search" href="#" tabindex="-1" id="spng-search-button" ng-click="omniButton()" class="ibm-search-link common-search-link"></a>
  <div id="spng-search-typeahead-wrapper" style="display:none" class="search-results-wrapper">
    <div id="spng-search-typeahead" class="common-search-results">
      <div id="spng-spinner" style="display:none">
        <h2 class="ibm-h2 ibm-h4 ibm-bold"><span class="ibm-spinner">&nbsp;</span></h2>
      </div>
      <div id="sp-no-results" style="display:none">
        <div class="results">
          <p>No results were found for your search query.</p>
          <div class="ibm-rule">
            <hr>
          </div>
          <h5 class="ibm-h5"><strong>Tips</strong></h5>
          <p>To return expected results, you can:</p>
          <ul>
            <li><strong>Reduce the number of search terms.</strong> Each term you use focuses the search further.</li>
            <li><strong>Check your spelling.</strong> A single misspelled or incorrectly typed term can change your result.</li>
            <li><strong>Try substituting synonyms for your original terms.</strong> For example, instead of searching for "java classes", try "java training"</li>
            <li><strong>Did you search for an IBM acquired or sold product ?</strong> If so, follow the appropriate link below to find the content you need.</li>
          </ul>
        </div>
      </div>
      <div id="sp-doc-failure" style="display:none">
        <div class="category">Our apologies</div>
        <div class="results">
          <p>Search results are not available at this time. Please try again later or use one of the other support options on this page.</p>
        </div>
      </div>
      <div id="sp-prev-products" class="result_section"></div>
      <div id="sp-wd-results" class="result_section"></div>
      <div id="sp-prod-results" class="result_section"></div>
      <div id="sp-doc-results" class="result_section"></div>
    </div>
  </div>
</form>

POST /support/pages/ij26949-wincollect-730-managed-agent-communication-issues-reported-qradar-appliances-encrypted-host-connections

<form class="node-troubleshooting-6325963-vote-field-was-this-topic-helpful__vote-vote-votingapi-useful-form vote-form" id="vote-form"
  data-drupal-selector="node-troubleshooting-6325963-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form"
  action="/support/pages/ij26949-wincollect-730-managed-agent-communication-issues-reported-qradar-appliances-encrypted-host-connections" method="post" accept-charset="UTF-8">
  <div class="js-form-item form-item js-form-type-select form-type-select js-form-item-value form-item-value form-no-label">
    <select autocomplete="off" data-result-value="-1" data-vote-value="-1" data-style="default" data-show-own-vote="false" data-drupal-selector="edit-value" id="edit-value" name="value" class="form-select select2-widget ibm-widget-processed"
      data-jquery-once-autocomplete="true" data-select2-autocomplete-list-widget="true" search-pagesize="10" style="display: none; width: 124px;" tabindex="0" aria-hidden="false">
      <option value="-1">Not useful</option>
      <option value="1">Useful</option>
    </select>
    <div class="useful-rating" role="complementary" aria-label="Was this topic helpful?">
      <div class="like">
        <a href="#"><button aria-label="Yes" tabindex="0" class="ibm-margin-right-1 bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M26,12H20V6a3.0033,3.0033,0,0,0-3-3H14.8672a2.0094,2.0094,0,0,0-1.98,1.7173l-.8453,5.9165L8.4648,16H2V30H23a7.0078,7.0078,0,0,0,7-7V16A4.0045,4.0045,0,0,0,26,12ZM8,28H4V18H8Zm20-5a5.0057,5.0057,0,0,1-5,5H10V17.3027l3.9578-5.9365L14.8672,5H17a1.0008,1.0008,0,0,1,1,1v8h8a2.0025,2.0025,0,0,1,2,2Z"></path></svg><span class="text-yes">Yes</span><span id="like" style="display:none;">999</span></button></a>
      </div>
      <div class="dislike">
        <a href="#"><button aria-label="No" tabindex="0" class="bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M30,16V9a7.0078,7.0078,0,0,0-7-7H2V16H8.4648l3.5774,5.3662.8453,5.9165A2.0094,2.0094,0,0,0,14.8672,29H17a3.0033,3.0033,0,0,0,3-3V20h6A4.0045,4.0045,0,0,0,30,16ZM8,14H4V4H8Zm20,2a2.0025,2.0025,0,0,1-2,2H18v8a1.0008,1.0008,0,0,1-1,1H14.8672l-.9094-6.3662L10,14.6973V4H23a5.0057,5.0057,0,0,1,5,5Z"></path></svg><span class="text-no">No</span><span id="dislike" style="display:none;">No</span></button></a>
      </div>
    </div>
  </div>
  <input autocomplete="off" data-drupal-selector="form-z-9wblwuktrho9z9flwsiunp7isqefl96qjzjjeai5c" type="hidden" name="form_build_id" value="form-z-9WBlWuktrHO9z9FlWSiUnP7isqEfl96qjzjjEAi5c">
  <input data-drupal-selector="edit-node-troubleshooting-6325963-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" type="hidden" name="form_id"
    value="node_troubleshooting_6325963_vote_field_was_this_topic_helpful__vote_vote_votingapi_useful_form">
  <input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" name="op" value="Save" class="button button--primary js-form-submit form-submit" data-once="drupal-ajax" style="display: none;">
</form>

Text Content

Support My IBM Log in

IBM Support


 

No results were found for your search query.

--------------------------------------------------------------------------------

TIPS

To return expected results, you can:

 * Reduce the number of search terms. Each term you use focuses the search
   further.
 * Check your spelling. A single misspelled or incorrectly typed term can change
   your result.
 * Try substituting synonyms for your original terms. For example, instead of
   searching for "java classes", try "java training"
 * Did you search for an IBM acquired or sold product ? If so, follow the
   appropriate link below to find the content you need.

Our apologies

Search results are not available at this time. Please try again later or use one
of the other support options on this page.







IJ26949: WINCOLLECT 7.3.0 MANAGED AGENT COMMUNICATION ISSUES REPORTED ON QRADAR
APPLIANCES WITH ENCRYPTED HOST CONNECTIONS


TROUBLESHOOTING





PROBLEM

This technical note provides further information and a workaround for
administrators with communication issues between encrypted QRadar® appliances
and WinCollect 7.3.0 agents as described in APAR IJ26949.



SYMPTOM

Recently updated WinCollect 7.3.0 (V7.3.0-24) agents cannot communicate or
register to the QRadar appliance when the host is encrypted in the deployment.
When this issue occurs, WinCollect agents cannot register or receive log source
updates due to the communication issue between the agent and the QRadar®
appliance.



ENVIRONMENT

WinCollect 7.3.0 agents.



DIAGNOSING THE PROBLEM

When a WinCollect 7.3.0 agent cannot communicate to the QRadar appliance after
an upgrade, the workaround depends on the error messages displayed by the
WinCollect agent in WinCollect.log or by the QRadar appliance managing the
WinCollect agents in /var/log/qradar.error. Administrators must select the
workaround associated the error messages displayed in the logs.

1. Agent generates 'unable to find certificate path' or 'no subject alternative
names matching IP address' errors
If the agent believes the certificate is incorrect or cannot find the path, the
configuration server protocol on the QRadar appliance writes an error message to
/var/log/qradar.error of the appliance managing the remote WinCollect V7.3.0
agents. These errors indicate that the administrator needs to update a file on
the QRadar Console to enable legacy support for the WinCollect Configuration
Server protocol. Legacy support mode allows the protocol to use localhost
tunnels to communicate to the encrypted QRadar appliance.

Administrators can review the QRadar appliance logs to determine whether the
WinCollectConfigHandler displays an error message in /var/log/qradar.error. This
error message is generated on the appliance managing the WinCollect agent to
indicate that the localhost address is not in the certificate and a legacy mode
update is required:
 
[ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_1]
com.q1labs.frameworks.crypto.trustmanager.extended.Q1X509FullTrustManager:
[ERROR] [X.X.X.X/- -] [-/- -] Server Not Trusted No subject alternative names
matching IP address
[ecs-ec-ingress.ecs-ec-ingress] [WinCollectConfigHandler_1]
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException:
java.security.cert.CertificateException: No subject alternative names matching
IP address 127.0.0.1 found


2. Agent generates 'Register with configuration server failed' errors
If the WinCollect agent locates the certificate, but cannot register to the
QRadar appliance, the WinCollect service writes debug messages to C:\Program
Files\IBM\WinCollect\logs\WinCollect.log. This error indicates that the IP of
the QRadar appliance cannot be determined to register the agent and a workaround
can be applied in the WinCollectConfigServer.vm file to resolve this issue.

Administrators can log in to the Windows host to review for the following error:
DEBUG SRV.Code.SSLConfigServerAPIClient.v2.XXXX : Received connection
establishment response (result code 2147483649, wire versions 2.0)
DEBUG SRV.Code.ConfigServerConnection.SSL.X.X.X.X : BeginUpdateTransaction:
failed -- An error was reported on server. Check the server's log files for
details.
DEBUG SRV.System.WinCollectSvc.Service : Register with configuration server
failed -- An error was reported on server. Check the server's log files for
details. -- will try again later




RESOLVING THE PROBLEM

The workaround to APAR IJ26949 depends on the error messages displayed to the
user in the logs. Administrators can engage QRadar Support to determine the
error message displayed in the logs. The WinCollect-WA-APAR-IJ26949 utility
allows support representatives or administrators apply a workaround to assist
with APAR IJ26949 and update the WinCollectConfigServer.vm file settings on the
QRadar Console to resolve encrypted host settings or experience certificate
issue error messages. 

What to do
 1. Open a case with QRadar Support.
 2. Include the logs from your QRadar Console appliance.
 3. Include the WinCollect.log from one or more WinCollect agents experiencing
    issues after upgrading to WinCollect 7.3.0.
    Note: Logs are not required for all agents, but a sample from one or more
    agents with a communication issue can help determine the issue.
    
    Results
    A QRadar Support representative will contact you with more information about
    your case or schedule a WebEx to review your issues.






DOCUMENT LOCATION

Worldwide











Notice: Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.


[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business
Unit":{"code":"BU059","label":"IBM Software w\/o
TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM
Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case
Number":"","Platform":[{"code":"PF025","label":"Platform
Independent"}],"Version":"All Version(s)"}]


WAS THIS TOPIC HELPFUL?

Not usefulUseful
Yes999
NoNo



DOCUMENT INFORMATION

More support for:
IBM Security QRadar SIEM

Component:
WinCollect

Software version:
All Version(s)

Document number:
6325963

Modified date:
17 November 2020


UID

ibm16325963

You will be taken to the My Notifications interface where you have been
auto-subscribed to IBM Security QRadar SIEM

You can click the EDIT menu option to configure your subscription experience.

You can also search for and select other IBM products to subscribe to based on
your needs.


CancelOK
Manage My Notification Subscriptions

Click the Subscribe button to stay informed of critical IBM support updates with
My Notifications.

Take a proactive approach to problem prevention.

Receive support content tailored to your needs, delivered directly to you!

Receive immediate notifications of Security Bulletins and Flashes.

Receive daily or weekly notifications of technical support information such as
downloads, tips, technical notes, and publications.

Log in to Subscribe

Page Feedback

Close


SHARE YOUR FEEDBACK


NEED SUPPORT?

 * Submit feedback to IBM Support

 * 1-800-IBM-7378 (USA)

 * Directory of worldwide contacts

Top products & platforms Industries Artificial intelligence Blockchain Business
operations Cloud computing Data & Analytics Hybrid cloud IT infrastructure
Security Supply chain What is Hybrid Cloud? What is Artificial intelligence?
What is Cloud Computing? What is Kubernetes? What are Containers? What is
DevOps? What is Machine Learning? IBM Consulting Communities Developer education
Support - Download fixes, updates & drivers IBM Research Partner with us -
Partner Plus Training - Courses Upcoming events & webinars Annual report Career
opportunities Corporate social responsibility Diversity & inclusion Industry
analyst reports Investor relations News & announcements Thought leadership
Security, privacy & trust About IBM LinkedIn Twitter Instagram Subscription
Center Contact IBM Privacy Terms of use Accessibility United States — English
Share your feedback





IBM web domains

ibm.com, ibm.dev, ibm.org, ibm-zcouncil.com, insights-on-business.com, jazz.net,
merge.com, micromedex.com, mobilebusinessinsights.com, promontory.com,
proveit.com, ptech.org, resource.com, s81c.com, securityintelligence.com,
skillsbuild.org, softlayer.com, storagecommunity.org, strongloop.com,
teacheradvisor.org, think-exchange.com, thoughtsoncloud.com, trusteer.com,
truven.com, truvenhealth.com, alphaevents.webcasts.com, betaevents.webcasts.com,
ibm-cloud.github.io, ibmbigdatahub.com, bluemix.net, mybluemix.net, ibm.net,
ibmcloud.com, redhat.com, galasa.dev, blueworkslive.com, swiss-quantum.ch,
altoromutual.com, blueworkslive.cn, blueworkslive.com, cloudant.com, ibm.ie,
ibm.fr, ibm.com.br, ibm.co, ibm.ca, silverpop.com,
community.watsonanalytics.com, eclinicalos.com, datapower.com,
ibmmarketingcloud.com, thinkblogdach.com, truqua.com, my-invenio.com,
skills.yourlearning.ibm.com, bluewolf.com, asperasoft.com, instana.com,
taos.com, envizi.com
About cookies on this site Our websites require some cookies to function
properly (required). In addition, other cookies may be used with your consent to
analyze site usage, improve the user experience and for advertising. For more
information, please review your cookie preferences  options and IBM’s privacy
statement. To provide a smooth navigation, your cookie preferences will be
shared across the IBM web domains listed here.

Accept all Required only