IBM Support

IJ32741: REAL TIME EVENT STREAMING CAN STOP WHEN A "JAVA.IO.EXCEPTION: BROKEN PIPE" ERROR OCCURS AFTER A TOMCAT PROCESS RESTART

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • In some instances where tomcat is restarted on the QRadar
    Console, a "java.io.exception error: Broken pipe" error can
    occur after which real time event streaming in the QRadar User
    Interface can stop functioning
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue occurs:
    [tomcat.tomcat] [ReceiverServer(0.0.0.0:7801)]
    com.q1labs.core.shared.ariel.streaming.StreamConsumer$Receiver
    0.0.0.0:7801: [WARN] [NOT:0000004000][127.0.0.1/- -] [-/-
    -]Error: /127.0.0.1:49432 : IOException : Broken pipe
    [tomcat.tomcat] [ReceiverServer(0.0.0.0:7801)]
    java.io.IOException: Broken pipe
    [tomcat.tomcat] [ReceiverServer(0.0.0.0:7800)]
    com.q1labs.core.shared.ariel.streaming.StreamConsumer$Receiver
    0.0.0.0:7800: [WARN] [NOT:0000004000][127.0.0.1/- -] [-/-
    -]Error: /127.0.0.1:52834 : IOException : Broken pipe
    [tomcat.tomcat] [ReceiverServer(0.0.0.0:7800)]
    java.io.IOException: Broken pipe
    

Local fix

  • Perform a restart of the ecs-ep process on the QRadar deployment
    from an SSH session to the QRadar Console:
    /opt/qradar/support/all_servers.sh -C "systemctl restart ecs-ep"
    
    OR
    
    Perform a Deploy full configuration:
    Admin > Advanced > Deploy Full Configuration
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.3 FixPack
    4 and 7.3.3 FixPack 10.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.3 FixPack
    4 and 7.3.3 FixPack 10.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ32741

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    733

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2021-05-17

  • Closed date

    2021-11-15

  • Last modified date

    2021-11-29

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"733"}]

Document Information

Modified date:
30 November 2021