IBM Support

IJ26306: EVENT/FLOW WINDOW IS BLANK FOR HISTORICAL CORRELATION OFFENSES AND VIEWING 'LAST 10 EVENTS/FLOWS' GENERATES ERROR

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • While attempting to view Events or Flows associated with a
    Historical Correlation Offense, the Event/Flow List window
    displays a blank page.
    When attempting to view the "Last 10 Events/Flows" for a
    Historical Correlation Offense, a message similar to the
    following is generated:
    "An error occurred while fetching the Events for this offense"
    or
    "An Error occurred while fetching the Flows for this offense"
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    tomcat[44128]: Caused by:
    tomcat[44128]: java.lang.NoSuchMethodError:
    com/ibm/si/core/offensemapper/OffenseMapperFactory.getOffenseMap
    perType(ILjava/lang/String;Ljava/lang/String;)Lcom/ibm/si/core/o
    ffensemapper/OffenseMapperType; (loaded from
    file:/opt/qradar/webapps/console/WEB-INF/lib/q1labs_core.jar by
    PluginClassLoader
    tomcat[44128]: context: console
    tomcat[44128]: delegate: false
    tomcat[44128]: ----------> Parent Classloader:
    tomcat[44128]: java.net.URLClassLoader@17b2c16d
    tomcat[44128]: ) called from class
    com.ibm.si.hc.HistoricalCorrelationProcessor (loaded from
    file:/opt/qradar/webapps/console/WEB-INF/lib/q1labs_hc.jar by
    PluginClassLoader
    tomcat[44128]: context: console
    tomcat[44128]: delegate: false
    tomcat[44128]: ----------> Parent Classloader:
    tomcat[44128]: java.net.URLClassLoader@17b2c16d
    tomcat[44128]: ).
    tomcat[44128]: at
    com.ibm.si.hc.HistoricalCorrelationProcessor.transformQueryParam
    s(HistoricalCorrelationProcessor.java:2538)
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.2 FixPack
    3.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.2 FixPack
    3.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ26306

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    740

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-07-15

  • Closed date

    2021-04-12

  • Last modified date

    2021-04-12

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"740"}]

Document Information

Modified date:
13 April 2021