This is likely a DNS issue or potentially an /etc/hosts issue if it is only happening on one application and not all. I would get support to investigate this to confirm but the app.log likely displays something like this:
{"level":"error","message":"Internal Server Error - Cannot establish connection to QRadar console. - api: GET /api/pinned_windows - username: admin, userRole: Admin, securityProfile: 1","timestamp":"2020-06-25T12:08:39.962"}
{"level":"error","message":"Details: E_CONSOLE_NETWORK_ERROR - ENOTFOUND - getaddrinfo ENOTFOUND qconsole.example.local qconsole.example.local:443 - {\"name\":\"APIError\",\"httpStatus\":500,\"code\":\"E_CONSOLE_NETWORK_ERROR\",\"message\":\"E_CONSOLE_NETWORK_ERROR - ENOTFOUND - getaddrinfo ENOTFOUND qconsole.example.local qconsole.example.local:443\",\"details\":\"ENOTFOUND - getaddrinfo ENOTFOUND qconsole.example.local qconsole.exmaple.local:443\",\"logLevel\":\"error\"}","timestamp":"2020-06-25T12:08:39.963"}
In this example error string, the app is trying to connect to qconsole.example.local, but cannot as it hit a network issue. This is either due to DNS or FQDN issue or that your /etc/hosts file needs to be updated. You didn't mention if this was a Console or an App Host appliance, but you should be able to curl to confirm the error.
sh-4.1# curl -v https://qconsole.example.local
* getaddrinfo(3) failed for qconsole.example.local:443
* Couldn't resolve host 'qconsole.example.local'
* Closing connection #0
curl: (6) Couldn't resolve host 'qconsole.example.local'
This is what support will likely do as part of their review:
- Verify the state of the application and test the connection with curl.
- Confirm workloads.json to see where the app is trying to connect.
- Restart docker to ensure that changes are loaded.
- Verify /etc/hosts matches the request from the Pulse app.
- Confirm certificates are regenerated.
- Verify the specific API being polled can respond.
I would ensure you have a case opened as if you are only having issue with one app, you might only need to restart docker to ensure that everything is loaded, but you probably want support to confirm the issue/error.
#QRadar#Support#SupportMigration