IBM Support

IJ21347: ROUTING RULES CAN FAIL TO WORK AS EXPECTED WHEN A HUNG THREAD DOES NOT RESTART AS EXPECTED

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that in some instances an RPC call from
    the event collection service can fail to restart as expected.
    When this issue is occuring, routing rules can fail to work as
    expected until the ecs-ec service is restarted successfully.
    Messages similar to the following might be visible in qradar
    logging when this issue is occurring:
    "87393acc-aa0a-4cd2-97da-6c6a8a65454f/SequentialEventDispatcher"
    Id=83 in BLOCKED on lock=java.util.HashMap@8607f58e
         owned by SelectiveForwardingStatisticsReportingTimer Id=89
        at
    com.q1labs.semsources.selectiveforwarding.SelectiveForwardingCom
    municator.notifyStatisticsUpdated(SelectiveForwardingCommunicato
    r.java:268)
        at
    com.q1labs.core.shared.selectiveforwardingset.SelectiveForwardin
    gSetCache.notifyDestinationChangeListener(SelectiveForwardingSet
    Cache.java:591)
        at
    com.q1labs.core.shared.selectiveforwardingset.SelectiveForwardin
    gSetCache.messageReceived(SelectiveForwardingSetCache.java:756)
        at
    com.q1labs.frameworks.events.jms.JMSMessageEvent.dispatchEvent(J
    MSMessageEvent.java:107)
        at
    com.q1labs.frameworks.events.SequentialEventDispatcher$DispatchT
    hread.run(SequentialEventDispatcher.java:129)
    "SelectiveForwardingStatisticsReportingTimer" Id=89 in RUNNABLE
    (running in native)
        at java.net.SocketInputStream.socketRead0(Native Method)
        at
    java.net.SocketInputStream.socketRead(SocketInputStream.java:127
    )
        at
    java.net.SocketInputStream.read(SocketInputStream.java:182)
        at
    java.net.SocketInputStream.read(SocketInputStream.java:152)
        at com.ibm.jsse2.b.a(b.java:262)
        at com.ibm.jsse2.b.a(b.java:33)
        at com.ibm.jsse2.av.a(av.java:579)
          - locked java.lang.Object@47749733
        at com.ibm.jsse2.av.i(av.java:574)
          - locked java.lang.Object@91bc8eee
        at com.ibm.jsse2.av.a(av.java:280)
        at com.ibm.jsse2.av.startHandshake(av.java:431)
        at
    com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:167)
        at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:62)
        at
    sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(Htt
    pURLConnection.java:1346)
          - locked com.ibm.net.ssl.www2.protocol.https.e@93c90c60
        at
    sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Http
    URLConnection.java:1321)
          - locked com.ibm.net.ssl.www2.protocol.https.e@93c90c60
        at
    com.ibm.net.ssl.www2.protocol.https.b.getOutputStream(b.java:53)
          - locked com.ibm.net.ssl.www2.protocol.https.b@2111733
        at
    com.q1labs.core.shared.jsonrpc.RPC.executeMethod(RPC.java:452)
        at
    com.q1labs.core.shared.jsonrpc.RPC.executeMethod(RPC.java:302)
        at
    com.q1labs.core.shared.jsonrpc.RPC.executeMethodWithTimeout(RPC.
    java:233)
        at
    com.q1labs.core.shared.jsonrpc.RPC.executeMethod(RPC.java:256)
        at
    com.q1labs.semsources.selectiveforwarding.SelectiveForwardingCom
    municator.reportStats(SelectiveForwardingCommunicator.java:326)
          - locked java.util.HashMap@8607f58e
        at
    com.q1labs.semsources.selectiveforwarding.SelectiveForwardingCom
    municator$1.run(SelectiveForwardingCommunicator.java:185)
        at java.util.TimerThread.mainLoop(Timer.java:566)
        at java.util.TimerThread.run(Timer.java:516)
    

Local fix

  • From SSH command line session, restart the ecs-ec service
    manually using the following command:
    # systemctl restart ecs-ec
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.2.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.2.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ21347

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-12-04

  • Closed date

    2020-11-27

  • Last modified date

    2020-11-27

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Line of Business":{"code":"LOB10","label":"Data and AI"},"Business Unit":{"code":"BU029","label":"Software"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731"}]

Document Information

Modified date:
28 November 2020