JSA Event processor services are in a failed state due to a "CertificateException: Server certificate not recognized" error.

1. Review the logs in /var/log/qradar.error to verify that this error is visible:

com.q1labs.core.shared.jsonrpc.RPC: [ERROR] [NOT:0000003000][X.X.X.X /- -] [-/- -]java.security.cert.CertificateException: Server certificate not recognized

May 19 09:10:09 ::ffff:X.X.X.X [ecs-ec.ecs-ec] [ECS Runtime Thread] javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Server certificate not recognized.

2. Check the services using systemctl status and confirm whether the following services are in a failed state:

 UNIT            LOAD  ACTIVE SUB  DESCRIPTION

● accumulator.service    loaded failed failed Accumulator

● accumulator_rollup.service loaded failed failed Accumulator_rollup

● ariel_query_server.service loaded failed failed Ariel Query Server

● ecs-ec.service       loaded failed failed Event Correlation Services Event Collector

● ecs-ep.service       loaded failed failed Event Correlation Services Event Processor

● elxmilid.service      loaded failed failed SYSV: mili2d is the service required to manage Emulex OneConnect hardware.

● offline_forwarder.service loaded failed failed offline_forwarder daemon

● vis.service        loaded failed failed VA Integration Server

Workaround: Remove the affected JSA node from your manage hosts, and add it again; this will generate new certificates.

1. Removing a Managed Host
2. Configuring a Managed Host
3. Adding a Managed Host

If the problem persists, contact JTAC support for assistance.