IBM Security QRadar

 View Only
  • 1.  Qradar Auto Update issue

    Posted Fri August 28, 2020 10:15 AM
    Hello Community

    I try  to  do  an Auto Update in my Qradar server (version 7.3.1) but I got the issue bellow :
    Could not retrieve "manifest_list_512": 500 Can't connect to qmmunity-eu.q1labs.com:443 Could not download manifest list.
    I checked the internet connexion and it was OK I can do  a curl  commande to  the update servers "https://qmmunity.q1labs.com/"
    "https://qmmunity-eu.q1labs.com/"
     
    but I got the same error.I downloaded the AUProxyFP.tgz to verifiy the connexion but I still  got the same error 

    [root@qradar AUProxyFP]# /opt/qradar/bin/UpdateConfs.pl -testConnect 1 0
    [AUTOUPDATE] [TESTCONNECT] Testing Internet Connection
    [AUTOUPDATE] [TESTCONNECT] ------- Debug DownloadFile -------
    [AUTOUPDATE] [WARN] Could not read company
    [AUTOUPDATE] [DEVEL] Recorded license info as "?version=7.3.1.20170927195520&lastau=1573843861&lastpatch=1573843861&vendor=Q1%20Labs"
    [AUTOUPDATE] [DEVEL] Downloading "manifest_list" and placing in "/store/autoupdates/".
    [AUTOUPDATE] [TESTCONNECT] Verify ssl is turned on
    [AUTOUPDATE] [DEVEL] Attempting to retrieve https://qmmunity.q1labs.com/autoupdates/manifest_list?version=7.3.1.20170927195520&lastau=1573843861&lastpatch=1573843861&vendor=Q1%20Labs
    [AUTOUPDATE] [TESTCONNECT] AU Proxy server setting - no proxy settings found
    -----------------Summary-----------------
    [AUTOUPDATE] [TESTCONNECT] PERL_LWP_SSL_VERIFY_HOSTNAME: 1
    [AUTOUPDATE] [TESTCONNECT] PERL_NET_HTTPS_SSL_SOCKET_CLASS: IO::Socket::SSL
    [AUTOUPDATE] [TESTCONNECT] Proxy Server:
    [AUTOUPDATE] [TESTCONNECT] Status Line: 500 Can't connect to qmmunity.q1labs.com:443
    [AUTOUPDATE] [TESTCONNECT] Content Line: Can't connect to qmmunity.q1labs.com:443
    -----------------------------------------
    [AUTOUPDATE] [WARN] Could not retrieve "manifest_list": 500 Can't connect to qmmunity.q1labs.com:443
    [AUTOUPDATE] [TESTCONNECT] Could not download manifest list.
    [AUTOUPDATE] [DEBUG] Set au_test_connect to 0
    [AUTOUPDATE] [DEBUG] Previous Value: 1
    [AUTOUPDATE] [DEBUG] Updating DB
    [AUTOUPDATE] [DEBUG] Successfully Updated DB au_test_connect to 0
    [root@qradar AUProxyFP]#

    if any one can help  me to resolve this issue please.

    ------------------------------
    cherbani samir
    ------------------------------


  • 2.  RE: Qradar Auto Update issue

    Posted Mon August 31, 2020 01:03 AM
    Please take a look at 

    https://www.ibm.com/support/pages/qradar-auto-update-proxy-issues-500-ssl-negotiation-failed-updated

    It should be useful.

    best regards,

    ------------------------------
    Mario Sebastiani
    ------------------------------



  • 3.  RE: Qradar Auto Update issue

    Posted Wed November 17, 2021 02:34 PM
    I got the "Could not retrieve "manifest_list_512": 500 Can't connect to qmmunity.q1labs.com:443" msg today with QRadar CE.

    When I followed the link above (500 ssl negotiation failed), I noticed 2 things:
    1. the instruction of "Type the following command to extract the file: gunzip -c AUProxyFP.tgz | tar zxvf -" did not have the correct filename, it was AUProxyFP-9.11.tgz (maybe everyone checks this) but this same command with the correct filename always issued a "Child died with signal 13" error.

    Any ideas on how to get this working?


    ------------------------------
    John Tyson
    ------------------------------



  • 4.  RE: Qradar Auto Update issue

    Posted Mon August 31, 2020 10:55 AM
    Edited by Hendry Mon August 31, 2020 10:56 AM
    I had the same issue with QRadar version 7.3.3 FP 3. 

    The test connection was successful and FW didn't block any communication to qmmunity.q1labs.com. I installed the auproxy that Mario suggested, but I had still an issue with auto-update. I reached out to IBM support and they did reset the auto-update after that I works so far.


    ------------------------------
    Hendry
    ------------------------------