IBM Support

IJ31102: LOG SOURCES CONFIGURED TO USE THE IBMSIMJDBC PROTOCOL CAN FAIL TO WORK AS EXPECTED DUE TO A JAR DEPENDENCY

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • Log Sources configured to use the IBM Security Identity Manager
    Protocol can stop working with a 'NoClassDefFoundError' due to
    a jar dependency.
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue occurs:
    [ecs-ec-ingress.ecs-ec-ingress] [Thread-25]
    com.eventgnosis.ecs: [ERROR] [NOT:0000003000][127.0.0.1/- -]
    [-/- -]Error attempting to load
    (device):ecs-ec-ingress/EC_Ingress/Q1_I BMSIMJDBCEventSource
    Error : java.lang.NoClassDefFoundError:
    com.microsoft.sqlserver.jdbc.SQLServerException
    

Local fix

  • In the following path
    /opt/ibm/si/services/ecs-ec-ingress/eventgnosis/lib/q1labs/IBMSI
    MJDBC/
    1) Make a copy of mssql-jdbc-7.2.0.jar
    2) Name it mssql-IBMSIMJDBC-7.2.0.jar
    

Problem summary

  • To fix this issue, download and install the following RPMs from
    IBM Fix Central:
    PROTOCOL-IBMSIMJDBC-7.4-20210609121049.noarch.rpm
    PROTOCOL-JDBC-7.4-20210609145121.noarch.rpm
    
    PROTOCOL-IBMSIMJDBC-7.3-20210608181231.noarch.rpm
    PROTOCOL-JDBC-7.3-20210608181231.noarch.rpm
    

Problem conclusion

  • To fix this issue, download and install the following RPMs from
    IBM Fix Central:
    PROTOCOL-IBMSIMJDBC-7.4-20210609121049.noarch.rpm
    PROTOCOL-JDBC-7.4-20210609145121.noarch.rpm
    
    PROTOCOL-IBMSIMJDBC-7.3-20210608181231.noarch.rpm
    PROTOCOL-JDBC-7.3-20210608181231.noarch.rpm
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ31102

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    730

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2021-03-01

  • Closed date

    2021-07-05

  • Last modified date

    2021-07-05

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
06 July 2021