IBM Support

IJ24334: OFFENSE PURGING CAN SOMETIMES FAIL WITH A BATCHUPDATEEXCEPTION

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • In some instances, Offense purging can fail with an
    BatchUpdateException being written to QRadar logging.
    When this occurs, the Offense model within QRadar can
    experience unneccessary bloat.
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occuring:
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]
    com.ibm.si.mpc.magi.contrib.commands.offense.OffensePurgeCommand
    : [ERROR] Chained SQL Exception [1/2]: Batch entry 0 select *
    from purge_offense(1338)  as result was aborted: ERROR: INSERT
    has more expressions than target columns
      Where: PL/pgSQL function purge_offense(bigint) line 6 at SQL
    statement  Call getNextException to see other errors in the
    batch.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]
    com.ibm.si.mpc.magi.contrib.commands.offense.OffensePurgeCommand
    : [ERROR] Chained SQL Exception [2/2]: ERROR: INSERT has more
    expressions than target columns
      Where: PL/pgSQL function purge_offense(bigint) line 6 at SQL
    statement
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]
    com.ibm.si.mpc.magi.contrib.commands.offense.OffensePurgeCommand
    : [ERROR] [NOT:0000003000][X.X.X.X/- -] [-/- -]database
    executing purge command failed.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]
    java.sql.BatchUpdateException: Batch entry 0 select * from
    purge_offense(1338)  as result was aborted: ERROR: INSERT has
    more expressions than target columns
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    Where:
    PL/pgSQL function purge_offense(bigint) line 6 at SQL statement
     Call getNextException to see other errors in the batch.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.jdbc.BatchResultHandler.handleError(BatchResultHa
    ndler.java:148)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExe
    cutorImpl.java:2184)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorIm
    pl.java:481)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.jdbc.PgStatement.executeBatch(PgStatement.java:84
    0)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.jdbc.PgPreparedStatement.executeBatch(PgPreparedS
    tatement.java:1538)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.commands.base.BasePurgeCommand.execu
    te(BasePurgeCommand.java:105)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:2528)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:2492)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.executePurgeCommands(
    ModelPersister.java:833)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.process(ModelPersiste
    r.java:1258)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCurrentTransac
    tion(ModelPersister.java:579)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:453)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.process(ModelPersiste
    r.java:293)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.TxStateManager.playCurrent(TxStateMa
    nager.java:259)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister$Persister.playCurrent
    (ModelPersister.java:2918)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister$Persister.run(ModelPe
    rsister.java:2874)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127] Caused by:
    org.postgresql.util.PSQLException: ERROR: INSERT has more
    expressions than target columns
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    Where:
    PL/pgSQL function purge_offense(bigint) line 6 at SQL statement
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(Qu
    eryExecutorImpl.java:2440)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExe
    cutorImpl.java:2183)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    ... 14 more
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]
    com.ibm.si.mpc.magi.contrib.ModelPersister: [WARN]
    [NOT:0180002100][X.X.X.X/- -] [-/- -]Exception encounted when
    executing transaction 753127.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]
    com.ibm.si.mpc.magi.contrib.PersistenceException: Failed to
    persist sem model
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCurrentTransac
    tion(ModelPersister.java:676)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:453)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.process(ModelPersiste
    r.java:293)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.TxStateManager.playCurrent(TxStateMa
    nager.java:259)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister$Persister.playCurrent
    (ModelPersister.java:2918)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister$Persister.run(ModelPe
    rsister.java:2874)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127] Caused by:
    java.sql.BatchUpdateException: Batch entry 0 select * from
    purge_offense(1338)  as result was aborted: ERROR: INSERT has
    more expressions than target columns
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    Where:
    PL/pgSQL function purge_offense(bigint) line 6 at SQL statement
     Call getNextException to see other errors in the batch.
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.jdbc.BatchResultHandler.handleError(BatchResultHa
    ndler.java:148)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExe
    cutorImpl.java:2184)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorIm
    pl.java:481)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.jdbc.PgStatement.executeBatch(PgStatement.java:84
    0)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.jdbc.PgPreparedStatement.executeBatch(PgPreparedS
    tatement.java:1538)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.commands.base.BasePurgeCommand.execu
    te(BasePurgeCommand.java:105)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:2528)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCommands(Model
    Persister.java:2492)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.executePurgeCommands(
    ModelPersister.java:833)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.process(ModelPersiste
    r.java:1258)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    com.ibm.si.mpc.magi.contrib.ModelPersister.processCurrentTransac
    tion(ModelPersister.java:579)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    ... 5 more
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127] Caused by:
    org.postgresql.util.PSQLException: ERROR: INSERT has more
    expressions than target columns
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    Where:
    PL/pgSQL function purge_offense(bigint) line 6 at SQL statement
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(Qu
    eryExecutorImpl.java:2440)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    at
    org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExe
    cutorImpl.java:2183)
    [ecs-ep.ecs-ep] [MPC/PersisterThread@0000753127]    ... 14 more
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.3.3
    FixPack 3 InterimFix 01, 7.4.0 FixPack 1 InterimFix 01, 7.4.0
    FixPack 2 and 7.3.3 FixPack 4.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.3.3
    FixPack 3 InterimFix 01, 7.4.0 FixPack 1 InterimFix 01, 7.4.0
    FixPack 2 and 7.3.3 FixPack 4.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ24334

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    733

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-04-16

  • Closed date

    2020-05-01

  • Last modified date

    2020-07-14

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"733"}]

Document Information

Modified date:
15 July 2020