IBM Support

IJ10111: FALSE POSITIVE QRADAR LOG MESSAGES THAT APPEAR TO INDICATE A PROBLEM WITH QRADAR MAGISTRATE (MPC) AFTER DEPLOY

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as Permanent restriction.

Error description

  • It has been identified that QRadar can sometimes display false
    positive messages in /var/log/qradar.log after a Deploy that
    appear to indicate a problem with the QRadar magistrate that is
    used in Offense creation (MPC).  If these messages (see below)
    are observed in QRadar logging and QRadar continues to generate
    Offenses as expected, the log messages can be safely ignored
    (benign).
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000049767]
    com.q1labs.sem.magi.contrib.ModelPersister: [WARN]
    [NOT:0180002100][127.0.0.1/- -] [-/- -]Exception encounted when
    executing transaction 49767.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]
    com.q1labs.frameworks.cache.ResizableBufferPool: [WARN]
    [NOT:0000004000][127.0.0.1/- -] [-/- -]null
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]
    java.lang.InterruptedException
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireInt
    erruptibly(AbstractQueuedSynchronizer.java:1231)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.concurrent.locks.ReentrantLock.lockInterruptibly(Reent
    rantLock.java:346)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.concurrent.LinkedBlockingQueue.take(LinkedBlockingQueu
    e.java:450)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ResizableBufferPool.borrow(Resizable
    BufferPool.java:85)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.readChainEntry(Chai
    nAppendCache.java:1229)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.findOnDisk(ChainApp
    endCache.java:1162)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.needsDiskUpdate(Cha
    inAppendCache.java:515)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.access$000(ChainApp
    endCache.java:43)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache$1.removeEldestEntry
    (ChainAppendCache.java:465)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.HashMap.putVal(HashMap.java:675)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.LinkedHashMap.afterNodeInsertion(LinkedHashMap.java:31
    0)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.HashMap.put(HashMap.java:623)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache$1.put(ChainAppendCa
    che.java:392)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache$1.put(ChainAppendCa
    che.java:367)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.put(ChainAppendCach
    e.java:1108)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.core.dao.sem.light.Target.updateCaches(Target.java:44
    6)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.core.dao.sem.light.Target.updateCaches(Target.java:34
    9)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.PersistenceContext.updateCaches(Pers
    istenceContext.java:3542)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.PersistenceContext.commitToCache(Per
    sistenceContext.java:3344)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister.processCurrentTransac
    tion(ModelPersister.java:602)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:417)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister.process(ModelPersiste
    r.java:257)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.TxStateManager.playCurrent(TxStateMa
    nager.java:259)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister$Persister.playCurrent
    (ModelPersister.java:2854)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister$Persister.run(ModelPe
    rsister.java:2810)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]
    com.q1labs.sem.magi.contrib.ModelPersister: [WARN]
    [NOT:0180002100][127.0.0.1/- -] [-/- -]Exception encounted when
    executing transaction 2.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]
    java.lang.NullPointerException
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ResizableBufferPool.dispose(Resizabl
    eBufferPool.java:98)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.readChainEntry(Chai
    nAppendCache.java:1320)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.findOnDisk(ChainApp
    endCache.java:1162)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.needsDiskUpdate(Cha
    inAppendCache.java:515)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.access$000(ChainApp
    endCache.java:43)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache$1.removeEldestEntry
    (ChainAppendCache.java:465)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.LinkedHashMap.afterNodeInsertion(LinkedHashMap.java:31
    0)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.HashMap.putVal(HashMap.java:675)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    java.util.HashMap.put(HashMap.java:623)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache$1.put(ChainAppendCa
    che.java:392)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache$1.put(ChainAppendCa
    che.java:367)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.frameworks.cache.ChainAppendCache.put(ChainAppendCach
    e.java:1108)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.core.dao.sem.light.Target.updateCaches(Target.java:44
    6)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.core.dao.sem.light.Target.updateCaches(Target.java:34
    9)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.PersistenceContext.updateCaches(Pers
    istenceContext.java:3542)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.PersistenceContext.commitToCache(Per
    sistenceContext.java:3344)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister.processCurrentTransac
    tion(ModelPersister.java:602)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:417)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister.process(ModelPersiste
    r.java:257)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.TxStateManager.playCurrent(TxStateMa
    nager.java:259)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister$Persister.playCurrent
    (ModelPersister.java:2854)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000000002]    at
    com.q1labs.sem.magi.contrib.ModelPersister$Persister.run(ModelPe
    rsister.java:2810)
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue will not be fixed for now.
    

Problem conclusion

  • This issue will not be fixed for now.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ10111

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED PRS

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-10-04

  • Closed date

    2020-07-13

  • Last modified date

    2020-07-13

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
14 July 2020