IBM Support

IJ13244: EXCEPTION GENERATED IN QRADAR LOGGING WHEN CUSTOM EVENT PROPERTIES (CEP) ARE ADDED TO A QRADAR DOMAIN

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that when Custom Event Properties (CEP)
    are added to domains within QRadar, an exception is generated
    in QRadar logging.
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]
    com.q1labs.frameworks.session.SessionContext: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]1 leak(s) detected in
    session context: 2174390b-71b6-402e-97c7-e0d3c92f3096
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]
    com.q1labs.frameworks.session.SessionContext: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/-
    -]java.sql.PreparedStatement leak detected. Object created in
    following code path
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]
    java.lang.Exception
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.frameworks.session.BaseWrapper.<init>(BaseWrapper.jav
    a:16)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.frameworks.session.PreparedStatementWrapper.<init>(Pr
    eparedStatementWrapper.java:35)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.frameworks.session.ConnectionWrapper.prepareStatement
    (ConnectionWrapper.java:262)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheMapOfM
    aps.saveData(ReferenceDataCacheMapOfMaps.java:667)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheMapOfM
    aps.access$800(ReferenceDataCacheMapOfMaps.java:40)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheMapOfM
    aps$3.call(ReferenceDataCacheMapOfMaps.java:202)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheMapOfM
    aps$3.call(ReferenceDataCacheMapOfMaps.java:146)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.RefDataCacheLock.writeCa
    cheAccess(RefDataCacheLock.java:125)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheMapOfM
    aps.addElement(ReferenceDataCacheMapOfMaps.java:145)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.dao.referencedata.light.RefDataDomainProtection.
    addElement(RefDataDomainProtection.java:39)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.shared.referencedata.ReferenceDataManager.addToR
    eferenceDataCollection(ReferenceDataManager.java:780)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.util.domain.CaptureResultReferenceMap.save(Captu
    reResultReferenceMap.java:113)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.api.impl.DomainAPIImpl.saveDomain(DomainAPIImpl.
    java:354)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.domain.UIDomainService.saveDomain(UIDomainService.jav
    a:735)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
    Impl.java:90)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
    AccessorImpl.java:55)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    java.lang.reflect.Method.invoke(Method.java:508)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.application.ReflectiveExportedMethod.cal
    lWithContext(ReflectiveExportedMethod.java:170)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.application.ComponentExportedMethod.call
    (ComponentExportedMethod.java:84)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.application.ExportedMethod.call(Exported
    Method.java:146)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.ui.servlet.RemoteJavaScript.doGet(RemoteJavaScri
    pt.java:366)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.ui.servlet.RemoteJavaScript.doPost(RemoteJavaScr
    ipt.java:609)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.servlet.HttpServlet.service(HttpServlet.
    java:22)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:231)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.ja
    va:52)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.auth.EulaFilter.doFilter(EulaFilter.java
    :113)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.servlet.AddUserHeaderFilter.doFilter(Add
    UserHeaderFilter.java:88)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.servlet.ThreadNameFilter.doFilter(Thread
    NameFilter.java:50)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.core.ui.filters.StrutsParamFilter.doFilter(StrutsPara
    mFilter.java:41)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.servlet.DestroySessionFilter.doFilter(De
    stroySessionFilter.java:26)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.q1labs.uiframeworks.servlet.AddHSTSHeaderFilter.doFilter(Add
    HSTSHeaderFilter.java:22)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    com.ibm.si.console.cors.ProcessCorsFilter.doFilter(ProcessCorsFi
    lter.java:136)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.StandardWrapperValve.invoke(StandardWra
    pperValve.java:198)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.core.StandardContextValve.invoke(StandardCon
    textValve.java:96)
    [tomcat.tomcat] [admin@127.0.0.1 (9202)
    /console/JSON-RPC/QRadar.saveDomain QRadar.saveDomain]    at
    org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authe
    nticatorBase.java:610)
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.3.2 Patch 4.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.3.2 Patch 4.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ13244

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-02-04

  • Closed date

    2019-08-16

  • Last modified date

    2019-08-16

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 August 2019