IBM Support

IJ10925: RIGHT CLICK FUNCTIONALITY FOR 'ADD TO BLACKLIST' FAILS WITH 'REFERENCESETUTIL CAUGHT AN ERROR...' MESSAGE

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as documentation error.

Error description

  • It has been identified that attempting to use the right-click
    functionality for 'Add to blacklist' can generate a message
    similar to 'ReferenceSetUtil caught an error :
    java.lang.ExceptionInInitializerError'
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    [ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing resource
    loggers:
    [Lcom.q1labs.frameworks.core.IFrameworksContext$ResourceLogger;@
    f6b5f46b
    [ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Frameworks instance
    name: ReferenceSetUtil
    [ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing with URL:
    file:/opt/qradar/conf/
    [ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Frameworks booting -
    logging, loader complete
    [ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Loading
    frameworks.properties
    Oct 25 13:47:24 ::ffff:127.0.0.1[ReferenceSetUtil] [main]
    com.q1labs.frameworks.util.NamedThreadFactory: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Thread factory created:
    Spillover Cache Vacuum
    Oct 25 13:47:24 ::ffff:127.0.0.1[ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Frameworks global cache
    manager was initialized using: /opt/qradar/conf/ehcache.xml
    Oct 25 13:47:24 ::ffff:127.0.0.1[ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.JMXHelper: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing JMX for RMI
    Oct 25 13:47:24 ::ffff:127.0.0.1[ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.JMXHelper: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]No port specified for
    JMX Server, server will not be started
    Oct 25 13:47:24 ::ffff:127.0.0.1[ReferenceSetUtil] [main]
    com.q1labs.frameworks.logging.LogManagementAgent: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Log management agent
    started.
    Oct 25 13:47:24 ::ffff:127.0.0.1[ReferenceSetUtil] [main]
    com.q1labs.frameworks.core.FrameworksContext: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing jpa
    

Local fix

  • Manually run the ReferenceSetUtil.sh script via an SSH session
    to the QRadar console with arguments.
    Example:
    # /opt/qradar/bin/ReferenceSetUtil.sh add Blacklist <ip_address>
    

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IJ10925

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED DOC

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-10-31

  • Closed date

    2019-06-11

  • Last modified date

    2019-06-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Edition":""}]

Document Information

Modified date:
11 June 2019