Description

INFO-level log messages are being incorrectly written to the qradar.error log file due to the PROTOCOL-SmbTailProtocol RPM package.

Symptoms

JSA Administrators may observe repeated INFO log entries in the qradar.error log file when using the affected RPM version: PROTOCOL-SmbTailProtocol-7.5-20251007121747.noarch.rpm.

 

The following INFO log messages are generated in the the qradar.error file, which should not occur.

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128172024659969

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128172024659969

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128172024659969 from host 192.168.1.1

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:39:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128175849865297

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128175849865297

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128175849865297 from host 192.168.1.1

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:39:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128170011394109

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128170011394109

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128170011394109 from host 192.168.1.1

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:39:46 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128173970817077

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128173970817077

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128173970817077 from host 192.168.1.1

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:39:56 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128173232619617

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128173232619617

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128173232619617 from host 192.168.1.1

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:40:06 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128175312994321

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128175312994321

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128175312994321 from host 192.168.1.1

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:40:16 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:40:20 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [Windows Event Log RPC Protocol Provider Thread: Windows Event Log RPC Provider 10] com.q1labs.semsources.sources.windowseventrpc.transport.test_ip_tcp.RpcTransport: [ERROR] [NOT:0000003000][192.168.1.x/- -] [-/- -]Failed to create socket using host:Port : 192.168.1.x:135. This will result in an NPE exception.

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128175111667737

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128175111667737

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128175111667737 from host 192.168.1.1

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:40:26 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

May 16 00:40:31 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [Windows Event Log RPC Protocol Provider Thread: Windows Event Log RPC Provider 97] com.q1labs.semsources.sources.windowseventrpc.eventsource.RPCSession: [WARN] [NOT:0000004000][192.168.1.x/- -] [-/- -][192.168.1.x]   Could not connect to remote registry: Connection timed out. Verify that the "Server" service is running and ports TCP/139 and TCP/445 are open.

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Initialized PacketEncryptor with Cipher << null >>

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully connected to: 192.168.1.1

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Successfully authenticated qradarsvc on 192.168.1.1, session is 128167729692693

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Connecting to \\192.168.1.1\C$ on session 128167729692693

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Logging off session 128167729692693 from host 192.168.1.1

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Closed connection to 192.168.1.1

May 16 00:40:36 qradar.test.local ecs-ec-ingress[98602]: INFO | Thread[Packet Reader for 192.168.1.1,5,main] stopped.

 

Solution

This issue has been resolved in the updated package: PROTOCOL-SmbTailProtocol-7.5-20251203065112.noarch.rpm

 

 

JSA Administrators should upgrade to this version or later to prevent INFO messages from being logged in the qradar.error file.

 

Users can use the following commands to check the current version of the SmbTail RPM package installed on the JSA system.

 

rpm -qa | grep -i smbtail

 

To install the latest SmbTail protocol, follow the steps below: 

 

  1. Download the latest SmbTail protocol (PROTOCOL-SmbTailProtocol-7.5-20251203065112.noarch.rpm) from the Juniper download site.
  2. Copy the RPM to the /tmp directory on the Console using WinSCP.
  3. Log in to the Console CLI and run the following command to verify the RPM file:

cd /tmp/
ls -l PROTOCOL-SmbTailProtocol-7.5-20251203065112.noarch.rpm

        4. Install the PROTOCOL-SmbTailProtocol-7.5-20251203065112.noarch.rpm using the following command:

 

yum install -y PROTOCOL-SmbTailProtocol-7.5-20251203065112.noarch.rpm

 

        5. Perform a Full Deploy afterwards to make sure it all works.

 

If the INFO lines continue to fill the logs, restart Ingress on the necessary hosts to fully load any new jar files that may not have properly loaded during the deploy.

Modification History

2026-05-28 : Article Created