Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[JSA / STRM] deployed changes on 31 December 2020 can impact product functionality. Log message: Waiting for Valid License

0

0

Article ID: KB36416 KB Last Updated: 11 Mar 2021Version: 3.0
Summary:
No events are seen in the event viewer on the log activity tab even though all services are running properly.
Symptoms:
When this issue occurs, the following message might be displayed for specific services in /var/log/qradar.log:
[ecs-ec-ingress.ecs-ec-ingress] [main] com.eventgnosis.ecs: [INFO] [NOT:6000][X.X.X.X/- -] [-/- -]Waiting for valid license...
[ecs-ep.ecs-ep] [main] com.eventgnosis.ecs: [INFO] [NOT:6000][X.X.X.X/- -] [-/- -]Waiting for valid license...
[ecs-ec.ecs-ec] [main] com.eventgnosis.ecs: [INFO] [NOT:6000][X.X.X.X/- -] [-/- -]Waiting for valid license...
Cause:
Development has recently identified a defect in the product licensing function, which may cause the deployment to stop functioning.  Administrators who have automatic updates configured to auto restart or automatically deploy changes after a download might experience service issues. The issue is related to the function that validates a license key.

Our Juniper Secure Analytics (JSA) development team has worked on an emergency fix to resolve this issue.
Solution:
All JSA appliance versions are affected by this issue. A permanent fix has been made available in versions 7.3.3 FP/patch 7 and 7.4.2 FP/patch1. 

A fix has also been included in automatic updates, but the 'Results' section below applies to this fix methodology as well.  If you didn't have automatic updates enabled and you enable it to get this fix, to verify, you will see the following in the first run update history. 

Admin tab > Autoupdates > View Update History > look for an entry that looks like the following:

patch_2021_1.sh Minor Installed Jan 09, 2021, 4:19:25 
Subsequent autoupdates will overwrite this information with the last run info, but if log activity is streaming logs, you have likely gotten the fix already.

Please complete the following steps to manually fix the issue:
  1. Use SSH to log in to the console as the root user.
  2. To update the license file, enter the following command on your console. Note: You can double-click the command to highlight the full text.
    /opt/qradar/support/all_servers.sh -Ck 'if [ -f /opt/qradar/ecs/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/qradar/ecs/license.txt ; fi ; if [ -f /opt/ibm/si/services/ecs-ec-ingress/current/eventgnosis/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/ibm/si/services/ecs-ec-ingress/current/eventgnosis/license.txt ; fi ; if [ -f /opt/ibm/si/services/ecs-ep/current/eventgnosis/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/ibm/si/services/ecs-ep/current/eventgnosis/license.txt ; fi ; if [ -f /opt/ibm/si/services/ecs-ec/current/eventgnosis/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/ibm/si/services/ecs-ec/current/eventgnosis/license.txt ; fi ; if [ -f /usr/eventgnosis/ecs/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /usr/eventgnosis/ecs/license.txt ; fi ; if [ -f /opt/qradar/conf/templates/ecs_license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/qradar/conf/templates/ecs_license.txt ; fi'
    Note: This command runs from the console and the change is applied to all appliances by the all_servers utility.
  3. Wait 5 minutes for the changes to complete.
    Note: Administrators are not required to restart any services for this change as the file loads automatically.
  4. Log in to the console.
  5. Click the Log Activity tab.
  6. Verify events are received from remote appliance.
    Results
    The procedure is complete. If you upgrade (patch) your JSA appliances, you must reapply the license fix on your console appliance after the software upgrade is complete for your deployment. If you experience an issue with this command or continue to experience services or license messages in qradar.log, open a case with Juniper Support for assistance. After you apply the workaround for this issue, you can use JSA normally and complete standard administrative tasks, such as deploy changes.
Modification History:
2021-03-11: Article updated with fix information
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search