IBM Support

IJ10110: 'THE SERVER ENCOUNTERED AN ERROR READING ON OR MORE FILES' WHEN PERFORMING A NETWORK ACTIVITY SEARCH AFTER UPGRADE

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that QRadar can display a red error
    message similar to "The server encountered an error reading one
    or more files" when performing a Network Activity search after
    upgrading QRadar (7.2.8 -> 7.3.1).
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Exception processing
    file:/store/ariel/flows/records/2018/9/21/14/flows~44_0~7585cc5d
    01e4ad2~9c46d726237b4bd6~0, skipped... executing
    query:Id:d5436ad2-67d0-4487-9496-59ab991daff9,
    DB:<flows@/store/ariel/flows/records,
    /store/ariel/flows/payloads>, Time:<18-09-21,13:45:00 to
    18-09-21,14:45:00>, progress details 60, Sort order:<Total
    Bytes (Sum),desc>,
    Criteria=<EndTime:[1537548300000,1537551900000]>,
    MappingFactory=MappingFactoryImpl[com.q1labs.core.types.flow.map
    ping.FlowRecordMappingEx@1], Transformer=GROUP BY SourceHost
    DISPLAY: sourceHost AS 'Source IP', UniqueCount(Type) AS 'Flow
    Type (Unique Count)', MIN(FirstPacketTime) AS 'First Packet
    Time (Minimum)', MIN(EndTime) AS 'Storage Time (Minimum)',
    UniqueCount(SourcePortNA) AS 'Source Port (Unique Count)',
    UniqueCount(DestinationIP) AS 'Destination IP (Unique Count)',
    UniqueCount(DestinationPortNA) AS 'Destination Port (Unique
    Count)', SUM(SourceBytes) AS 'Source Bytes (Sum)',
    SUM(DestinationBytes) AS 'Destination Bytes (Sum)',
    SUM(TotalBytes) AS 'Total Bytes (Sum)', SUM(SourcePackets) AS
    'Source Packets (Sum)', SUM(DestinationPackets) AS 'Destination
    Packets (Sum)', SUM(TotalPackets) AS 'Total Packets (Sum)',
    UniqueCount(Protocol) AS 'Protocol (Unique Count)',
    UniqueCount(ApplicationName) AS 'Application (Unique Count)',
    UniqueCount(IcmpType, IcmpCode) AS 'ICMP Type/Code (Unique
    Count)', UniqueCount(SourceTCPFlags) AS 'Source Flags (Unique
    Count)', UniqueCount(DestinationTCPFlags) AS 'Destination Flags
    (Unique Count)', UniqueCount(SourceDSCP, SourcePrecedence) AS
    'Source QoS (Unique Count)', UniqueCount(DestinationDSCP,
    DestinationPrecedence) AS 'Destination QoS (Unique Count)',
    UniqueCount(FlowSourceName) AS 'Flow Source (Unique Count)',
    UniqueCount(InterfaceName) AS 'Flow Interface (Unique Count)',
    UniqueCount(SourceIfIndex) AS 'Source If Index (Unique Count)',
    UniqueCount(DestinationIfIndex) AS 'Destination If Index
    (Unique Count)', UniqueCount(SourceASN) AS 'Source ASN (Unique
    Count)', UniqueCount(DestinationASN) AS 'Destination ASN
    (Unique Count)', COUNT(*) AS Count,
    Filter=com.q1labs.cve.flowproc.FlowBundleExtractor@b,
    retentionTime=86400000, search top 1000,
    remoteServers=[localhost/127.0.0.1:32011], prio=NORMAL
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]
    java.lang.IllegalStateException: Potential mapping error. Array
    size: 1245186 Max is 1000000
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.frameworks.nio.MappingBase.getSizeInt(MappingBase.jav
    a:41)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.frameworks.nio.MappingBase.getSizeInt(MappingBase.jav
    a:30)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.ibm.si.ariel.tags.Serializer.get(TagValues.java:161)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.ibm.si.ariel.tags.Serializer.get(TagValues.java:136)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.core.types.flow.mapping.FlowRecordMapping.getData(Flo
    wRecordMapping.java:398)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.core.types.flow.mapping.FlowRecordMapping.get(FlowRec
    ordMapping.java:226)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.core.types.flow.mapping.FlowRecordMapping.get(FlowRec
    ordMapping.java:40)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.FileReader.doRead(FileReader.java:193)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.FileReader.read(FileReader.java:185)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.service.ids.ArielFile$Crawler.nextReco
    rd(ArielFile.java:31)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.service.ids.ArielFile.next(ArielFile.j
    ava:206)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.service.ids.FilteredSource.next(Filter
    edSource.java:39)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.tasks.QueryWorker.execute(QueryWorker.
    java:53)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:69)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1160)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:635)
    [ariel_proxy.ariel_proxy_server]
    [aqw_local_1:d5436ad2-67d0-4487-9496-59ab991daff9]    at
    java.lang.Thread.run(Thread.java:811)
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.3.1 patch 8
    and 7.3.2 GA.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.3.1 patch 8
    and 7.3.2 GA.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ10110

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    728

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-10-04

  • Closed date

    2019-03-08

  • Last modified date

    2019-03-08

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"728","Edition":""}]

Document Information

Modified date:
08 March 2019