IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Adding Managed Host - Event Collector Fails

  • 1.  Adding Managed Host - Event Collector Fails

    Posted Fri October 27, 2023 04:29 PM

    Hello,

    we have QRadar console in version 7.5.0 UP4 and event collectors in same version.

    when I try to add the Event Collector as Managed Host to Console, the process fails after STAGE 10, with following error.

    can you please advise: FAILED TO READ OUTPUT FROM SSH CONNECTION ON HOST (IP ADDRESS).

    please note, I'm able to SSH to event collector from the Console.

    Thanks in advance.

    Siddarth



    ------------------------------
    --
    Thanks and Best Regards,
    Siddarth
    ------------------------------


  • 2.  RE: Adding Managed Host - Event Collector Fails

    Posted Wed November 01, 2023 12:31 PM
    HI Siddarth,
     
    this side Durgesh, same issue I face in my time.
     
    you can resolve this issue with network team because this will appear when network issue is out there in between your ec/ep and qradar console server.
     
     
    note: make sure you are able to make 30 ssh hub connection with your ec/ep server to qadar server
     
    you can check 30 ssh hub connection using below command from your console server.
     
    for i in `seq 1 30`;do ssh X.X.X.X uname -a;done;echo Total ssh count = $i      (you have to just give ec/ep server ip)
     
    once you are done with connection after that try to add your ec/ep with qradar
    regards,
    Durgesh Gupta


    ------------------------------
    Durgesh Gupta
    ------------------------------