After updating to UP14 IF02, customers with any Log File protocol log sources may notice that they stop collecting events.
In the qradar.error and qradar.log files, they will see this error stack:
Jan 15 10:04:41 [ecs-ec-ingress.ecs-ec-ingress] [ProtocolTestingThread-c8fda830-7469-43c5-aada-04217c62e8de] com.q1labs.semsources.sources.base.testing.ProtocolTestJob: [ERROR] [NOT:0000003000]An error occurred while running com.q1labs.semsources.sources.remote.testing.LogFileTester
Jan 15 10:04:41 [ecs-ec-ingress.ecs-ec-ingress] [ProtocolTestingThread-c8fda830-7469-43c5-aada-04217c62e8de] java.lang.NoClassDefFoundError: com.jcraft.jsch.JSch
at com.q1labs.semsources.sources.utils.HostKeyCheckingUtil.extractHostKeys(HostKeyCheckingUtil.java:46)
at com.q1labs.semsources.sources.remote.RemoteStreamProvider.initializeConfig(RemoteStreamProvider.java:269)
at com.q1labs.semsources.sources.remote.transferprotocol.scp.SCPProvider.initializeConfig(SCPProvider.java:30)
at com.q1labs.semsources.sources.remote.testing.scp.SCPTester.populateTests(SCPTester.java:32)
at com.q1labs.semsources.sources.remote.testing.LogFileTester.populateTests(LogFileTester.java:40)
at com.q1labs.semsources.sources.testing.base.ProtocolTesterExtended.init(ProtocolTesterExtended.java:63)
at com.q1labs.semsources.sources.base.testing.ProtocolTestJob$TestThread.runTests(ProtocolTestJob.java:219)
at com.q1labs.semsources.sources.base.testing.ProtocolTestJob$TestThread.run(ProtocolTestJob.java:196)
Caused by:
java.lang.ClassNotFoundException
at java.base/java.lang.ClassLoader.findClass(ClassLoader.java:617)
at com.q1labs.core.util.classloader.ChildFirstClassLoader$ParentClassLoader.findClass(ChildFirstClassLoader.java:48)
at java.base/java.lang.ClassLoader.loadClassHelper(ClassLoader.java:1176)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:1091)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:1074)
at com.q1labs.core.util.classloader.ChildFirstClassLoader$ChildURLClassLoader.findClass(ChildFirstClassLoader.java:77)
It is a "NoClassDefFound" error caused by the jsch jar file being removed from the /opt/ibm/si/services/ecs-ec-ingress/current/bin/ directory in IF02.
Log collection stops
This issue is resolved in 7.5.0 Update Pack 14 Interim Fix 5 (Build 20260211194805INT)
Workaround:
Copy the jar from /opt/qradar/jars to the current ingress folder using command:
cp /opt/qradar/jars/jsch-0.2.26.jar /opt/ibm/si/services/ecs-ec-ingress/current/bin/
Restart ingress:
systemctl restart ecs-ec-ingress
version 1