IBM Support

IJ25798: DEPLOY FUNCTION CAN FAIL DUE TO AN INCONSISTENT INDEX FROM THE CONSOLE VS MANAGED HOST(S)

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • A QRadar deploy function can fail when there is inconsistency
    in an index (reference_data_element_data1) from what is on the
    Console vs what is on a Managed Host.
    Messages similar to the following might be visible in
    /var/log/qradar.error when this issue is occurring:
    [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
    replication:
    psql:/store/replication/tx0000000000000302764.sql:220939:
    ERROR:  index row size 2928 exceeds maximum 2712 for index
    "reference_data_element_data1"
    [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
    replication: HINT:  Values larger than 1/3 of a buffer page
    cannot be indexed.
    [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
    replication: Consider a function index of an MD5 hash of the
    value, or use full text indexing.
    [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
    replication: CONTEXT:  SQL statement "INSERT INTO
    public.reference_data_element SELECT * FROM
    rep.public_reference_data_element"
    [hostcontext.hostcontext] [Thread-68701] ComponentOutput:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream
    replication: PL/pgSQL function
    replicate_restore_dump(text,text) line 24 at EXECUTE
    <hostname>-primary replication[197954]: Could not apply
    /store/replication/tx0000000000000302764.sql.
    

Local fix

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.1 FixPack
    1.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.1 FixPack
    1.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ25798

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    740

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-06-23

  • Closed date

    2020-09-18

  • Last modified date

    2020-10-06

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Line of Business":{"code":"LOB10","label":"Data and AI"},"Business Unit":{"code":"BU029","label":"Software"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"740"}]

Document Information

Modified date:
07 October 2020