IJ25798: DEPLOY FUNCTION CAN FAIL DUE TO AN INCONSISTENT INDEX FROM THE CONSOLE VS MANAGED HOST(S)

APAR status

• Closed as program error.

Error description

• A QRadar deploy function can fail when there is inconsistency
  in an index (reference_data_element_data1) from what is on the
  Console vs what is on a Managed Host.
  Messages similar to the following might be visible in
  /var/log/qradar.error when this issue is occurring:
  [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
  [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  replication:
  psql:/store/replication/tx0000000000000302764.sql:220939:
  ERROR:  index row size 2928 exceeds maximum 2712 for index
  "reference_data_element_data1"
  [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
  [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  replication: HINT:  Values larger than 1/3 of a buffer page
  cannot be indexed.
  [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
  [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  replication: Consider a function index of an MD5 hash of the
  value, or use full text indexing.
  [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
  [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  replication: CONTEXT:  SQL statement "INSERT INTO
  public.reference_data_element SELECT * FROM
  rep.public_reference_data_element"
  [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
  [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
  replication: PL/pgSQL function
  replicate_restore_dump(text,text) line 24 at EXECUTE
  <hostname>-primary replication[197954]: Could not apply
  /store/replication/tx0000000000000302764.sql.
  

Local fix

• Administrators experiencing issues with deploy changes due to
  reference data indexes can review the associated techincal note
  for APAR IJ25798:
  https://www.ibm.com/support/pages/node/6332315
  

Problem summary

• This issue was fixed in QRadar QRM QVM release of 7.4.1 FixPack
  1.
  

Problem conclusion

• This issue was fixed in QRadar QRM QVM release of 7.4.1 FixPack
  1.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  QRADAR SOFTWARE

• Fixed component ID

  5725QRDSW

Applicable component levels