The JSA deployment was successfully upgraded from 7.5.0 UP6 to 7.5.0 UP7 and post the upgrade, the deploy changes are successful for few of the hosts and are failing for the rest of the managed hosts. The status of the managed hosts was seen as Error in the Deploy Changes window.

If you face all of the below symptoms, then the solution in the KB article needs to be followed.

• Deploy Changes status is shown as Error for the managed hosts after upgrade to 7.5.0 UP7 version.
• Below error messages are seen in the /var/log/qradar.log of the managed hosts.

[hostcontext.hostcontext] [hostcontext_config]com.q1labs.hostcontext.configuration.ConfigSetUpdater: [INFO][NOT:0000006000][IPADDR/- -] [-/- -]Downloading failed using the download url (https://ConsoleIP/console/fetchConfig) in nva.conf. Trying to download again using the url with the real console IP.                           

[hostcontext.hostcontext] [hostcontext_config] com.q1labs.configservices.hostcontext.exception.HostContextException:Failed to search Certificate for <ConsoleIP> doesn't match any of the subject alternative names: [example.siem.com]

• A custom SSL certificate is used on hte console and the certificate does not include the Console IP address in the Subject Alternative Name (SAN) section.

Temporary Workaround:

Edit the managed host in the System and License Management user interface under Deployment Actions --> Edit Host. Choose the option of Encrypt Connections to enable encrypted connections via SSH tunnels from the console to the managed host.

If the deploy changes stills shows error for the managed host after encrypting the connections for the managed host, then the below steps need to be followed for each managed host where the issue is seen.

Solution:

The steps provided below require the following preconditions to function:

1. The Console is running the Tomcat service.
2. The managed host is running Hostcontext.
3. No current deploy, add or remove managed host actions are in progress.

On the Console :

• Create a file named ip.txt and add the ip-addresses one after another in the below format.

cat ip.txt

x.x.x.x

y.y.y.y

z.z.z.z

a.a.a.a

• Create a file named copy-files.sh and add the lines below.

#!/bin/bash

cd /store/configservices/configurationsets

for ip in $(cat ips.txt)

do

echo "scp file for $ip"

scp zipfile_GEN.full.zip globalset_list.xml zipfile_QVM.full.zip $ip:/store/configservices/configurationsets/

done

• Save the file and change the ownership of the file using the command below.

chmod 777 copy-files.sh

• Execute the script with the below command. The script will copy the files

sh copy-files.sh

On the Affected MH:

• Use SSH to log in to the managed host

ssh <managedhost_ip>

• Replicate the PostgreSQL Database on the managed host by running the replication .pl script. Note: The following command is not to be run on the Console or it will corrupt the Console. 

/opt/qradar/bin/replication.pl -download

Expected Output:

Downloading updates to the database.

[replication] [INFO] Using x.x.x.x as our local IP.

[replication] [INFO] Downloading and applying latest database dumps from the console.

[replication] [INFO] No new database updates to apply.

[replication] [INFO] Replication download timing: Downloading: 3651 ms Overall: 3651 ms

• In the managed host, run the local_transformation.sh script to force a local full deploy. The script will ask to stop the hostconext and we need to choose Option 1 to say Yes. Note: The following command is not to be run on the Console or it will corrupt the Console. 

/opt/qradar/bin/local_transformation.sh -l -f

Expected output: 

Starting up...

Deployment status set to 'Initiating Deployment'

Deployment status set to 'In Progress'

Deployment status set to 'Success'

Deploy Global Set: Done.

local_transformation: End.

Once the above steps are performed for all the MH IP-Addresses which are showing error in the Deploy Changes window, we can proceed to perform a Deploy Changes from the Admin tab in the GUI.

Please contact JTAC in case of any assistance required for performing the above steps.