IBM Support

IV83701: ERRORS VISIBLE IN QRADAR LOGGING AFTER A CUSTOM EVENT PROPERTY HAS BEEN SUCCESSFULLY DELETED

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Deleting a Custom Event Property that has a search index
    enabled through Index Management completes successfully, but an
    error message similar to the following occurs at 20 minutes
    past every hour in /var/log/qradar.log:
    
    [ariel.ariel_proxy_server] [q1labs_worker_1]
    com.q1labs.core.shared.ariel.CustomProperty: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Custom property with ID
    10dd8c85-607c-4444-bb44-0a5243b0318f doesn't exist but it is
    referenced in a currently active search.
    [ariel.ariel_proxy_server] [q1labs_worker_1]
    com.q1labs.ariel.searches.service.IndexConfig: [ERROR]
    [NOT:0000003000]127.0.0.1/- -] [-/- -]The indexer
    com.q1labs.core.shared.ariel.CustomKeyCreator cannot be
    created. It will not be used
    [ariel.ariel_proxy_server] [q1labs_worker_1]
    java.lang.IllegalStateException: Can't instantiate
    com.q1labs.core.shared.ariel.CustomKeyCreator because of Can't
    instantiate class com.q1labs.core.shared.ariel.CustomKeyCreator
    because of null
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.util.Util.createInstanceFromClassNameWithObject
    Parameter(Util.java:515)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.util.Util.createInstanceFromClassName(Util.java
    :504)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.searches.service.IndexConfig.rebuild(IndexConfi
    g.java:80)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.searches.service.IndexConfig.<init>(IndexConfig
    .java:39)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.searches.service.IndexRoller.<init>(IndexRoller
    .java:48)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.searches.AbstractAccessManager$SuperIndexMainte
    nace.run(AbstractAccessManager.java:128)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.util.concurrent.Executors$RunnableAdapter.call(Executors.ja
    va:483)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.util.concurrent.FutureTask.runAndReset(FutureTask.java:316)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFuture
    Task.access$301(ScheduledThreadPoolExecutor.java:190)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFuture
    Task.run(ScheduledThreadPoolExecutor.java:305)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.lang.Thread.run(Thread.java:798)
    [ariel.ariel_proxy_server] [q1labs_worker_1] Caused by:
    [ariel.ariel_proxy_server] [q1labs_worker_1]
    java.lang.IllegalStateException: Can't instantiate class
    com.q1labs.core.shared.ariel.CustomKeyCreator because of null
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.util.Util.createInstanceFromClassWithObjectPara
    meter(Util.java:535)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.util.Util.createInstanceFromClassNameWithObject
    Parameter(Util.java:511)
    [ariel.ariel_proxy_server] [q1labs_worker_1] ... 12 more
    [ariel.ariel_proxy_server] [q1labs_worker_1] Caused by:
    [ariel.ariel_proxy_server] [q1labs_worker_1]
    java.lang.reflect.InvocationTargetException
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
    Method)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeCons
    tructorAccessorImpl.java:86)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Delega
    tingConstructorAccessorImpl.java:58)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    java.lang.reflect.Constructor.newInstance(Constructor.java:542)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.ariel.util.Util.createInstanceFromClassWithObjectPara
    meter(Util.java:531)
    [ariel.ariel_proxy_server] [q1labs_worker_1] ... 13 more
    [ariel.ariel_proxy_server] [q1labs_worker_1] Caused by:
    [ariel.ariel_proxy_server] [q1labs_worker_1]
    java.lang.IllegalStateException: Custom property with ID
    10dd8c85-607c-4444-bb44-0a5243b0318f doesn't exist but it is
    referenced in a currently active search.
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.core.shared.ariel.CustomProperty.getCustomProperty(Cu
    stomProperty.java:335)
    [ariel.ariel_proxy_server] [q1labs_worker_1] at
    com.q1labs.core.shared.ariel.CustomKeyCreator.<init>(CustomKeyCr
    eator.java:43)
    [ariel.ariel_proxy_server] [q1labs_worker_1] ... 18 more
    

Local fix

  • Contact Support for a possible workaround that might work in
    some instances.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8 Patch 1
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8 Patch 1
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV83701

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    726

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-04-13

  • Closed date

    2016-11-23

  • Last modified date

    2016-11-23

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"726","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
23 November 2016