IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Qradar Auto Update issue

    Posted Fri August 28, 2020 10:15 AM
    Hello Community

    I try  to  do  an Auto Update in my Qradar server (version 7.3.1) but I got the issue bellow :
    Could not retrieve "manifest_list_512": 500 Can't connect to qmmunity-eu.q1labs.com:443 Could not download manifest list.
    I checked the internet connexion and it was OK I can do  a curl  commande to  the update servers "https://qmmunity.q1labs.com/"
    "https://qmmunity-eu.q1labs.com/"
     
    but I got the same error.I downloaded the AUProxyFP.tgz to verifiy the connexion but I still  got the same error 

    [root@qradar AUProxyFP]# /opt/qradar/bin/UpdateConfs.pl -testConnect 1 0
    [AUTOUPDATE] [TESTCONNECT] Testing Internet Connection
    [AUTOUPDATE] [TESTCONNECT] ------- Debug DownloadFile -------
    [AUTOUPDATE] [WARN] Could not read company
    [AUTOUPDATE] [DEVEL] Recorded license info as "?version=7.3.1.20170927195520&lastau=1573843861&lastpatch=1573843861&vendor=Q1%20Labs"
    [AUTOUPDATE] [DEVEL] Downloading "manifest_list" and placing in "/store/autoupdates/".
    [AUTOUPDATE] [TESTCONNECT] Verify ssl is turned on
    [AUTOUPDATE] [DEVEL] Attempting to retrieve https://qmmunity.q1labs.com/autoupdates/manifest_list?version=7.3.1.20170927195520&lastau=1573843861&lastpatch=1573843861&vendor=Q1%20Labs
    [AUTOUPDATE] [TESTCONNECT] AU Proxy server setting - no proxy settings found
    -----------------Summary-----------------
    [AUTOUPDATE] [TESTCONNECT] PERL_LWP_SSL_VERIFY_HOSTNAME: 1
    [AUTOUPDATE] [TESTCONNECT] PERL_NET_HTTPS_SSL_SOCKET_CLASS: IO::Socket::SSL
    [AUTOUPDATE] [TESTCONNECT] Proxy Server:
    [AUTOUPDATE] [TESTCONNECT] Status Line: 500 Can't connect to qmmunity.q1labs.com:443
    [AUTOUPDATE] [TESTCONNECT] Content Line: Can't connect to qmmunity.q1labs.com:443
    -----------------------------------------
    [AUTOUPDATE] [WARN] Could not retrieve "manifest_list": 500 Can't connect to qmmunity.q1labs.com:443
    [AUTOUPDATE] [TESTCONNECT] Could not download manifest list.
    [AUTOUPDATE] [DEBUG] Set au_test_connect to 0
    [AUTOUPDATE] [DEBUG] Previous Value: 1
    [AUTOUPDATE] [DEBUG] Updating DB
    [AUTOUPDATE] [DEBUG] Successfully Updated DB au_test_connect to 0
    [root@qradar AUProxyFP]#

    if any one can help  me to resolve this issue please.

    ------------------------------
    cherbani samir
    ------------------------------


  • 2.  RE: Qradar Auto Update issue

    Posted Mon August 31, 2020 01:03 AM
    Please take a look at 

    https://www.ibm.com/support/pages/qradar-auto-update-proxy-issues-500-ssl-negotiation-failed-updated

    It should be useful.

    best regards,

    ------------------------------
    Mario Sebastiani
    ------------------------------

    Original Message


  • 3.  RE: Qradar Auto Update issue

    Posted Wed November 17, 2021 02:34 PM
    I got the "Could not retrieve "manifest_list_512": 500 Can't connect to qmmunity.q1labs.com:443" msg today with QRadar CE.

    When I followed the link above (500 ssl negotiation failed), I noticed 2 things:
    1. the instruction of "Type the following command to extract the file: gunzip -c AUProxyFP.tgz | tar zxvf -" did not have the correct filename, it was AUProxyFP-9.11.tgz (maybe everyone checks this) but this same command with the correct filename always issued a "Child died with signal 13" error.

    Any ideas on how to get this working?

    ------------------------------
    John Tyson
    ------------------------------

    Original Message


  • 4.  RE: Qradar Auto Update issue

    Posted Mon August 31, 2020 10:55 AM
    Edited by Hendry Mon August 31, 2020 10:56 AM
    I had the same issue with QRadar version 7.3.3 FP 3. 

    The test connection was successful and FW didn't block any communication to qmmunity.q1labs.com. I installed the auproxy that Mario suggested, but I had still an issue with auto-update. I reached out to IBM support and they did reset the auto-update after that I works so far.


    ------------------------------
    Hendry
    ------------------------------

    Original Message