Users reported an issue where after an upgrade to 7.5.0  Update Package 7, log sources configured with the Log File protocol that uses SFTP fail to connect. When this issue occurs, the log source can display OK in the user interface after an upgrade, but the ingress service logs and error when trying to connect with STFP.

Events stop collecting

An investigation into this issue determined that a required Java file is not included in the correct directory, which prevents log sources with SFTP from connecting due to one of the following errors:  

ecs-ec-ingress.ecs-ec-ingress] [ProtocolTestingThread-41dd1c18-15ce-43c4-9f09-be1458036506] java.lang.NoClassDefFoundError: com.jcraft.jsch.UserInfo 

OR 

ecs-ec-ingress.ecs-ec-ingress] [SFTP Provider Protocol Provider Thread: class com.q1labs.semsources.sources.remote.transferprotocol.sftp.SFTPProvider4205]java.lang.NoClassDefFoundErr

The fix for this is in 7.5.0 Update Package 7 Interim Fix 3. This release updates the Log File protocol to ensure that SFTP connections can retry, instead of generating an error which required administrator intervention.

The workaround process is as follows:

Administrators who experience this issue after an upgrade to QRadar 7.5.0 Update Package 7 can confirm which appliance is making the connection over SFTP and moving the jsch jar file to the correct directory on the managed host. 

1. Use SSH to log in to the Console as the root user. 
2. Open an SSH session to the managed host making the SFTP  connection. 
                                                                   
   Note: The hostname or IP of the appliance listed in the Target Event Collector field of your log source is the appliance making the connection to collect SFTP event logs.    
                                                                   
3. Type the following command:                                  
     cp /opt/qradar/jars/jsch-0.2.3.jar                            
/opt/ibm/si/services/ecs-ec-ingress/current/bin                 
                                                                   
4. To restart the ecs-ec-ingress service, type:                 
     systemctl restart ecs-ec-ingress                              
                                                                   
5. Log in to the QRadar user interface as an administrator.     
                                                                   
6. Click the Admin tab.                                         
                                                                   
7. Click the Log Sources icon.                                  
                                                                   
8. Select Log File protocol log source that uses the SFTP option.                                                         
                                                                   
9. Select one of the following options:
   1. Use the Test button in the Log Source Management app to  verify sample events are retrieved.   
   2. Disable and enable the log source to force the protocol to poll for events and confirm events in the Log Activity tab.     
                                                                      

Results:                                                    
If events are received, the issue is resolved and you can repeat this procedure for any other Event Collectors or Event Processors that use SFTP to collect events. If you continue to experience issues, Contact Juniper Support.               

version 1