IBM Support

IJ26163: ASSET SEARCH CAN FAIL WHEN FILTERING BASED ON CONTENTS OF A REFERENCE SET WHERE MORE THAN ONE DOMAIN EXISTS

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • An Asset Search can fail when filtering based on the contents
    of a reference set when more than one domain is added to the
    reference set.
    For example:
    1. Go to Admin > Reference Set Management, select one of
    Reference Set, and double click it.
    2. In Content tab, click Add, and enter the Value, and select
    domain1. Then click Add button.
    3. Perform Step 2 again, but select a different domain.
    4. Go to Assets main tab, click Search > New Search
    5. In the bottom Search Parameter(s), Select "IP Address", "In
    reference set", then select the Reference set used in step 1,
    then click the Search button
    Result: The search will fail and generate an error similar to
    the following in /var/log/qradar.error:
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    com.q1labs.assets.ui.assetservices.UIAssetList: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Error running filter
    based asset list query for
    performance.org.apache.openjpa.lib.jdbc.ReportingSQLException:
    ERROR: more than one row returned by a subquery used as an
    expression {stmnt 669393640 select DISTINCT(asset.asset.id)
    from asset.asset  where (1=1) AND asset.asset.id NOT IN (SELECT
    assetid FROM asset.pendingassetupdate WHERE action=3) AND
    asset.asset.id in (SELECT DISTINCT(asset.interface.assetid)
    FROM asset.interface LEFT OUTER JOIN asset.ipaddress ON
    asset.interface.id=asset.ipaddress.interfaceid WHERE (1=1)  AND
     ( asset.ipaddress.ipaddress NOT IN (
                                    SELECT
    convert_from(data,'UTF8')::inet AS ipv4address FROM
    public.reference_data_element
                                    WHERE
    public.reference_data_element.rdk_id = (SELECT id FROM
    public.reference_data_key
                                    WHERE
    public.reference_data_key.rd_id = (SELECT id FROM
    public.reference_data WHERE name LIKE $ItrXqTU$Steve2$ItrXqTU$))
                    ) ) )} [code=0, state=21000]
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    com.q1labs.assets.ui.assetservices.UIAssetList: [WARN]
    [NOT:0000004000][127.0.0.1/- -] [-/- -]Asset UI Performance
    optimization
    failing.:org.apache.openjpa.lib.jdbc.ReportingSQLException:
    ERROR: more than one row returned by a subquery used as an
    expression {stmnt 669393640 select DISTINCT(asset.asset.id)
    from asset.asset  where (1=1) AND asset.asset.id NOT IN (SELECT
    assetid FROM asset.pendingassetupdate WHERE action=3) AND
    asset.asset.id in (SELECT DISTINCT(asset.interface.assetid)
    FROM asset.interface LEFT OUTER JOIN asset.ipaddress ON
    asset.interface.id=asset.ipaddress.interfaceid WHERE (1=1)  AND
     ( asset.ipaddress.ipaddress NOT IN (
                                    SELECT
    convert_from(data,'UTF8')::inet AS ipv4address FROM
    public.reference_data_element
                                    WHERE
    public.reference_data_element.rdk_id = (SELECT id FROM
    public.reference_data_key
                                    WHERE
    public.reference_data_key.rd_id = (SELECT id FROM
    public.reference_data WHERE name LIKE $ItrXqTU$Steve2$ItrXqTU$))
                    ) ) )} [code=0, state=21000]
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    com.q1labs.core.sql.queryframework.QueryFramework: [WARN]
    [NOT:0000004000][127.0.0.1/- -] [-/- -]SELECT * FROM (
            SELECT
                0               AS "assetid"
            FROM asset.pendingassetupdate
            WHERE (1=1)
            AND asset.pendingassetupdate.assetid IS NULL AND
    asset.pendingassetupdate.action != 3
             AND asset.pendingassetupdate.updatedby =
    $pGISzQS$Steve$pGISzQS$
        ) ASSET_PENDING_LIST_VIEW
        UNION ALL
        SELECT * FROM
        (
            SELECT
                DISTINCT(asset.asset.id)                  AS
    "assetid"
            FROM asset.asset
            INNER JOIN asset.interface ON asset.interface.assetid =
    asset.asset.id INNER JOIN asset.ipaddress ON
    asset.ipaddress.interfaceid = asset.interface.id
            WHERE (1=1)
            AND asset.asset.id NOT IN (SELECT assetid FROM
    asset.pendingassetupdate WHERE action=3)
             AND  ( asset.ipaddress.ipaddress NOT IN (
                                    SELECT
    convert_from(data,'UTF8')::inet AS ipv4address FROM
    public.reference_data_element
                                    WHERE
    public.reference_data_element.rdk_id = (SELECT id FROM
    public.reference_data_key
                                    WHERE
    public.reference_data_key.rd_id = (SELECT id FROM
    public.reference_data WHERE name LIKE $eIQrWGn$Steve2$eIQrWGn$))
                    ) )
            --Additional ordering/limits for any base SQL query type
        ) ASSET_LIST_VIEW
             OFFSET 0;
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    com.q1labs.core.sql.queryframework.QueryFramework: [ERROR]
    Chained SQL Exception [1/2]: ERROR: current transaction is
    aborted, commands ignored until end of transaction block {stmnt
    -1679308538 SELECT * FROM (
            SELECT
                0               AS "assetid"
            FROM asset.pendingassetupdate
            WHERE (1=1)
            AND asset.pendingassetupdate.assetid IS NULL AND
    asset.pendingassetupdate.action != 3
             AND asset.pendingassetupdate.updatedby =
    $pGISzQS$Steve$pGISzQS$
        ) ASSET_PENDING_LIST_VIEW
        UNION ALL
        SELECT * FROM
        (
            SELECT
                DISTINCT(asset.asset.id)                  AS
    "assetid"
            FROM asset.asset
            INNER JOIN asset.interface ON asset.interface.assetid =
    asset.asset.id INNER JOIN asset.ipaddress ON
    asset.ipaddress.interfaceid = asset.interface.id
            WHERE (1=1)
            AND asset.asset.id NOT IN (SELECT assetid FROM
    asset.pendingassetupdate WHERE action=3)
             AND  ( asset.ipaddress.ipaddress NOT IN (
                                    SELECT
    convert_from(data,'UTF8')::inet AS ipv4address FROM
    public.reference_data_element
                                    WHERE
    public.reference_data_element.rdk_id = (SELECT id FROM
    public.reference_data_key
                                    WHERE
    public.reference_data_key.rd_id = (SELECT id FROM
    public.reference_data WHERE name LIKE $eIQrWGn$Steve2$eIQrWGn$))
                    ) )
            --Additional ordering/limits for any base SQL query type
        ) ASSET_LIST_VIEW
             OFFSET 0;} [code=0, state=25P02]
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    com.q1labs.core.sql.queryframework.QueryFramework: [ERROR]
    Chained SQL Exception [2/2]: ERROR: current transaction is
    aborted, commands ignored until end of transaction block
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    com.q1labs.core.sql.queryframework.QueryFramework: [WARN]
    [NOT:0000004000][127.0.0.1/- -] [-/-
    -]QueryFramework.executeQuery(): Could not execute the above
    SQL statement.
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]
    org.apache.openjpa.lib.jdbc.ReportingSQLException: ERROR:
    current transaction is aborted, commands ignored until end of
    transaction block {stmnt -1679308538 SELECT * FROM (
            SELECT
                0               AS "assetid"
            FROM asset.pendingassetupdate
            WHERE (1=1)
            AND asset.pendingassetupdate.assetid IS NULL AND
    asset.pendingassetupdate.action != 3
             AND asset.pendingassetupdate.updatedby =
    $pGISzQS$Steve$pGISzQS$
        ) ASSET_PENDING_LIST_VIEW
        UNION ALL
        SELECT * FROM
        (
            SELECT
                DISTINCT(asset.asset.id)                  AS
    "assetid"
            FROM asset.asset
            INNER JOIN asset.interface ON asset.interface.assetid =
    asset.asset.id INNER JOIN asset.ipaddress ON
    asset.ipaddress.interfaceid = asset.interface.id
            WHERE (1=1)
            AND asset.asset.id NOT IN (SELECT assetid FROM
    asset.pendingassetupdate WHERE action=3)
             AND  ( asset.ipaddress.ipaddress NOT IN (
                                    SELECT
    convert_from(data,'UTF8')::inet AS ipv4address FROM
    public.reference_data_element
                                    WHERE
    public.reference_data_element.rdk_id = (SELECT id FROM
    public.reference_data_key
                                    WHERE
    public.reference_data_key.rd_id = (SELECT id FROM
    public.reference_data WHERE name LIKE $eIQrWGn$Steve2$eIQrWGn$))
                    ) )
            --Additional ordering/limits for any base SQL query type
        ) ASSET_LIST_VIEW
             OFFSET 0;} [code=0, state=25P02]
    [tomcat.tomcat] [admin@127.0.0.1 (8838)
    /console/do/assetprofile/SearchForm]    at
    org.apache.openjpa.lib.jdbc.LoggingConnectionDecorator.wrap(Logg
    ingConnectionDecorator.java:218)
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.3.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.3.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ26163

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    732

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-07-10

  • Closed date

    2021-05-25

  • Last modified date

    2021-05-25

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"732"}]

Document Information

Modified date:
26 May 2021