IBM Support

IJ23859: 'APPLICATION ERROR' POP UP CAN OCCUR WHEN DISABLING A USER THAT HAS DEPENDENCIES (E.G. CEP, SAVED SEARCH)

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as Permanent restriction.

Error description

  • An "Application Error" can be generated after disabling a user
    which has dependencies (e.g. Custom Event Properties or Saved
    Searches).
    Messages similar to the following might be generated in
    /var/log/qradar.log when this issue is occuring:
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]
    com.q1labs.core.shared.ariel.AqlCustomKeyCreator: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Exception creating AQL
    key creator for property ID 58099b2f-d650-4b70-ac93-f5d770d24062
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]
    com.q1labs.ariel.ql.parser.AQLParserException: Catalog "events"
    does not exist.
    concat(REFERENCEMAP('
    ^
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.ariel.ql.parser.ParserBase.getCatalog(ParserBase.java
    :179)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.ariel.ql.parser.Parser.parseExpression(Parser.java:30
    0)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.core.shared.ariel.AqlCustomKeyCreator.createKeyCreato
    r(AqlCustomKeyCreator.java:145)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.core.shared.ariel.AqlCustomKeyCreator.initialize(AqlC
    ustomKeyCreator.java:122)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.frameworks.util.Utils.initialize(Utils.java:459)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.events.ui.bean.EventForm.copyFromDAO(EventForm.java:7
    82)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.ariel.ui.UIArielServices.getRecordBean(UIArielService
    s.java:5872)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.ariel.ui.action.ArielDetails.viewDetails(ArielDetails
    .java:36)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    sun.reflect.GeneratedMethodAccessor1170.invoke(Unknown Source)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
    AccessorImpl.java:55)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    java.lang.reflect.Method.invoke(Method.java:508)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.struts.actions.DispatchAction.dispatchMethod(Dispatch
    Action.java:280)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.struts.actions.DispatchAction.execute(DispatchAction.
    java:216)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.actions.DispatchAction.execute(DispatchA
    ction.java:64)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.struts.action.RequestProcessor.processActionPerform(R
    equestProcessor.java:484)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.action.RequestProcessor.processActionPer
    form(RequestProcessor.java:101)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.struts.action.RequestProcessor.process(RequestProcess
    or.java:275)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.struts.action.ActionServlet.process(ActionServlet.jav
    a:1482)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.action.ActionServlet.process(ActionServl
    et.java:122)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.struts.action.ActionServlet.doPost(ActionServlet.java
    :525)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.encoding.AddEncodingToRequestFilter.doFi
    lter(AddEncodingToRequestFilter.java:56)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.servlet.DestroySessionFilter.doFilter(De
    stroySessionFilter.java:26)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.servlet.AddHSTSHeaderFilter.doFilter(Add
    HSTSHeaderFilter.java:22)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
    (ApplicationFilterChain.java:193)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.ApplicationFilterChain.doFilter(Applica
    tionFilterChain.java:166)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.StandardWrapperValve.invoke(StandardWra
    pperValve.java:199)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.StandardContextValve.invoke(StandardCon
    textValve.java:96)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authe
    nticatorBase.java:493)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.StandardHostValve.invoke(StandardHostVa
    lve.java:137)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    com.q1labs.uiframeworks.valve.ErrorReportValve.invoke(ErrorRepor
    tValve.java:47)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.core.StandardEngineValve.invoke(StandardEngi
    neValve.java:87)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapte
    r.java:343)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:476
    )
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.coyote.AbstractProcessorLight.process(AbstractProcess
    orLight.java:66)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.coyote.AbstractProtocol$ConnectionHandler.process(Abs
    tractProtocol.java:808)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(Nio
    Endpoint.java:1498)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcess
    orBase.java:49)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1160)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:635)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(T
    askThread.java:61)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]    at
    java.lang.Thread.run(Thread.java:812)
    [tomcat.tomcat] [admin@127.0.0.1(6637)
    /console/do/ariel/arielDetails]
    com.q1labs.uiframeworks.action.ExceptionHandler: [INFO]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Following message
    suppressed 1 times in 300000 milliseconds
    

Local fix

Problem summary

  • We won't add dependency checks while disabling a user as a
    feature.
    

Problem conclusion

  • We won't add dependency checks while disabling a user as a
    feature.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ23859

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    732

  • Status

    CLOSED PRS

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-03-26

  • Closed date

    2021-02-03

  • Last modified date

    2021-12-09

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"732"}]

Document Information

Modified date:
10 December 2021