IBM Support

IJ40522: ANOMALY ISSUE IN 7.5.0 UP2 PREVENT RULES WIZARD FROM LAUNCHING AND AFFECTS OFFENSE CREATION

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • After upgrading to 7.5.0 Update Pack 2, a mismatch of rules can
cause the rule wizard page to be unavailable and offenses to not
be created. This occurs when the link_uuid for a rule is not
present.

Note: This issue was reported as resolved in another
release (7.5.0 Update Pack 3), but reopened as the issue can
occur again for certain users.

Local fix

  • Anomaly rules without a link_uuid value can be set to null to
prevent this issue. To apply a workaround for this issue, run
the following command on the QRadar Console:

psql -U qradar -c "update custom_rule set link_uuid = null where
link_uuid not in (select uuid from custom_rule );"

Problem summary

  • This issue has been resolved in QRadar 7.5.0 Update Package 6.

Problem conclusion

  • This issue has been resolved in QRadar 7.5.0 Update Package 6.

Temporary fix

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    IJ40522
    • 

  • Reported component name
    QRADAR SOFTWARE
    • 

  • Reported component ID
    5725QRDSW
    • 

  • Reported release
    750
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt / Xsystem
    • 

  • Submitted date
    2022-06-09
    • 

  • Closed date
    2023-06-26
    • 

  • Last modified date
    2023-06-26
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    

  • Fixed component name
    QRADAR SOFTWARE
    • 

  • Fixed component ID
    5725QRDSW
    • 



Applicable component levels


    








      
              
                            

              

              [{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"750","Line of Business":{"code":"LOB24","label":"Security Software"}}]
              

                          

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            26 June 2023
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback