IJ44661: QRADAR NAMEVALUEPAIRPARSER CAN EXPERIENCE ERRORS WHEN THE LAST VALUE CONTAINS PAIR SEPARATOR

APAR status

• Closed as program error.

Error description

• The Name Value Pair (NVP) parser for events can experience
  issues where payloads do not parse as expected. This issue
  can can cause incorrectly truncated payloads, issues with
  Custom properties where N/A is displays, or even cause
  performance problems on some appliances where a lot of parsing
  for NVP pairs occurs.
  
  Administrators who use a lot of Name Vair Pair parsing for
  events should review for truncated payloads or issues where
  Custom Event Properties unexpectely display N/A in the user
  interface.
  
  When this issue occurs, the following error can display in
  /var/log/qradar.log:
  java.lang.StringIndexOutOfBoundsException: begin 5, length 4
   at java.lang.String.substring(String.java:2716)
   at
  com.q1labs.core.util.namevaluepair.NameValuePairParser.parseNVPP
  ayload(NameValuePairParser.java:80)
   at
  com.q1labs.core.util.namevaluepair.NameValuePairUtil.extractName
  ValuePairMap(NameValuePairUtil.java:47)
   at
  com.q1labs.core.shared.ariel.ArielPropertyNameValuePairExpressio
  nDefinition.parse(ArielPropertyNameValuePairExpressionDefinition
  .java:8
   at
  com.q1labs.core.shared.ariel.CustomProperty.parse(CustomProperty
  .java:256)
   at
  com.q1labs.core.shared.ariel.CustomProperty.parse(CustomProperty
  .java:213)
  

Local fix

• No workaround available. APARs identified as 'No workaround
  available' require a software delivery to resolve.
  Administrators can subscribe to the APAR to receive updates when
  software releases are published for this issue.
  

Problem summary

• This issue has been resolved in QRadar 7.5.0 Update Package 6.
  

Problem conclusion

• This issue has been resolved in QRadar 7.5.0 Update Package 6.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  QRADAR SOFTWARE

• Fixed component ID

  5725QRDSW

Applicable component levels