We were trying to add Host as an Event Collector. During the adding process it is passing all 10 parameter. After pass the the Step 10 i.e. "Updating database on host and starting service. This may take while
Getting below error  i.e
"Error Code (18): No SEC header present in request. Please provide it via "SEC: token". You may also use BASIC authentication parameters if this host supports it. e.g. "Authorization: Basic base64Encoding"


What is wrong with the deployment option?

Thanks  
SA

------------------------------
Siem Admin
------------------------------

I'm not sure what version you are on, but there was a known issue where a user who removes an Event Collect 'Encrypted' as a host, then when you readd or add a host with the same IP, the system tries to add it as 'Encrypted' by default, but encounters an error. Solution was to restart the hostcontext process. After that, add host process completed successfully.

1. You can attempt to restart hostcontent on the Console. There is an article about this process here: https://www.ibm.com/support/pages/qradar-hostcontext-service-and-impact-service-restart.
2. Try to add your EC again.
3. If you continue to experience issues, open a case with QRadar Support so we can review the logs.

The error message you listed is not specific to the add host error, but it might be related to this APAR potentially. Without the full logs, I think we are going to want to review the errors to confirm. A lot of issues can occur during an add host, such as bandwidth, SSH tunnels for encryption, and more. My first thought when reading your post is that your issue might be APAR IJ32056. However, I think you can try to restart Hostcontext and try to add your host again. If you still cannot add the EC, then you should open a case for us to recreate the issue and get logs from the Console.

------------------------------
Jonathan Pechta
QRadar Support Content Lead
Support forums: ibm.biz/qradarforums
jonathan.pechta1@ibm.com
------------------------------

Original Message:
Sent: Sat October 15, 2022 01:24 AM
From: Siem Admin
Subject: add Host as an Event Collector. Error Code (18): No SEC header present in request

We were trying to add Host as an Event Collector. During the adding process it is passing all 10 parameter. After pass the the Step 10 i.e. "Updating database on host and starting service. This may take while
Getting below error  i.e
"Error Code (18): No SEC header present in request. Please provide it via "SEC: token". You may also use BASIC authentication parameters if this host supports it. e.g. "Authorization: Basic base64Encoding"


What is wrong with the deployment option?

Thanks  
SA

------------------------------
Siem Admin
------------------------------