IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Managed WinCollect can't connect to configuration server

    Posted Tue December 19, 2023 05:21 AM

    Hi Community, 

    We are using QRadar SIEM 7.5.0 update pack 3. Yesterday we powered off the console VM using command "poweroff" and then increased its RAM to 64GB (previous was 32GB) then again we powered on the machine. Now console is up and running but the new wincollect agent installations are not responding to console.

    There is no communication issue between the endpoint and QRadar console for both ports 8413 and 514. 

    We have also restarted the WinCollect service multiple times but no PEM file is generated in wincollect config folder. 

    Also tried full deployment from console and restarted event collection service but still the error is same. 

    The error message is: 

    log=SRV.System.WinCollectSvc.Service  msg=Register with configuration server failed -- The certificate presented by the configuration server was either missing or its chain was not validated/trusted -- will try again later

    log=SRV.Code.CertificateManager.qradarconsole.com  msg=Cannot connect to configuration server (336032784)


    ------------------------------
    Abdul Rahman
    ------------------------------


  • 2.  RE: Managed WinCollect can't connect to configuration server

    Posted Wed December 20, 2023 04:24 AM

    @Jonathan Pechta, if you can help in this or anyone from community can guide us please.



    ------------------------------
    Abdul Rahman
    ------------------------------

    Original Message


  • 3.  RE: Managed WinCollect can't connect to configuration server

    Posted Wed January 03, 2024 12:17 PM

    Hello,

    please review the following technote:

    https://www.ibm.com/support/pages/wincollect-register-configuration-server-failed-certificate-presented-configuration-server-was-either-missing-or-its-chain-was-not-validatedtrusted-will-try-again-later

    if this doesnt resolve your issue, please raise a support case. 



    ------------------------------
    Comghall Morgan
    QRadar Support Architect
    IBM
    ------------------------------

    Original Message


  • 4.  RE: Managed WinCollect can't connect to configuration server

    Posted Thu December 21, 2023 09:45 AM

    I'm also having the same issue as this, just commenting to follow. Hope someone can help!



    ------------------------------
    Dean Duffy
    ------------------------------

    Original Message