IBM Support

IV84615: RULE OR BUILDING BLOCK DELETION CAN FAIL WHEN THERE ARE INVALID SEARCHES

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Deleting a Rule or Building Block can fail on a dependency if
    there is an invalid search.  This can occur even if that search
    has nothing to do with the Rule or Building Block.  The invalid
    search causes the delete dependency to fail and not allow the
    Rule or BB to be deleted.
    
    Messages similar to following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [tomcat] [pool-1-thread-1]
    com.q1labs.core.shared.datadeletion.CustomRuleDeletion: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Error while getting
    Saved Search dependents for this ruleId: 105300
    [tomcat] [pool-1-thread-1] java.lang.RuntimeException:
    java.lang.RuntimeException: Error processing criteria
    destinationPort
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSear
    chForm.java:1153)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSear
    chForm.java:802)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSear
    chForm.java:759)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSear
    chForm.java:753)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSear
    chForm.java:744)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.datadeletion.CustomRuleDeletion.getArielS
    avedSearchDependentsByRuleId(CustomRuleDeletion.java:186)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.datadeletion.CustomRuleDeletion.getUsage(
    CustomRuleDeletion.java:58)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.datadeletion.task.FindDependentsTask.getA
    ctualUsage(FindDependentsTask.java:223)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.datadeletion.task.FindDependentsTask.getC
    hildUsage(FindDependentsTask.java:193)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.datadeletion.task.FindDependentsTask.getD
    efaultUsage(FindDependentsTask.java:150)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.datadeletion.task.FindDependentsTask.run(
    FindDependentsTask.java:96)
    [tomcat] [pool-1-thread-1]    at
    java.util.concurrent.Executors$RunnableAdapter.call(Executors.ja
    va:483)
    [tomcat] [pool-1-thread-1]    at
    java.util.concurrent.FutureTask.run(FutureTask.java:274)
    [tomcat] [pool-1-thread-1]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [tomcat] [pool-1-thread-1]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [tomcat] [pool-1-thread-1]    at
    java.lang.Thread.run(Thread.java:798)
    [tomcat] [pool-1-thread-1] Caused by:
    [tomcat] [pool-1-thread-1] java.lang.RuntimeException: Error
    processing criteria destinationPort
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.getCriteria(CriteriaBuilder
    .java:1185)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.getQueryParams(CriteriaBuil
    der.java:349)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSear
    chForm.java:1074)
    [tomcat] [pool-1-thread-1]    ... 15 more
    [tomcat] [pool-1-thread-1] Caused by:
    [tomcat] [pool-1-thread-1]
    java.lang.reflect.InvocationTargetException
    [tomcat] [pool-1-thread-1]    at
    sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
    Method)
    [tomcat] [pool-1-thread-1]    at
    sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeCons
    tructorAccessorImpl.java:86)
    [tomcat] [pool-1-thread-1]    at
    sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Delega
    tingConstructorAccessorImpl.java:58)
    [tomcat] [pool-1-thread-1]    at
    java.lang.reflect.Constructor.newInstance(Constructor.java:542)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.core.shared.util.ReflectionUtils.stringToObject(Refle
    ctionUtils.java:191)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.addExpression(CriteriaBuild
    er.java:1272)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.updateExpression(CriteriaBu
    ilder.java:673)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.updateCriteria_Expression(C
    riteriaBuilder.java:780)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.updateCriteria(CriteriaBuil
    der.java:987)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.cve.utils.CriteriaBuilder.getCriteria(CriteriaBuilder
    .java:1092)
    [tomcat] [pool-1-thread-1]    ... 17 more
    [tomcat] [pool-1-thread-1] Caused by:
    [tomcat] [pool-1-thread-1] java.lang.NumberFormatException: For
    input string: "10616 "
    [tomcat] [pool-1-thread-1]    at
    java.lang.NumberFormatException.forInputString(NumberFormatExcep
    tion.java:77)
    [tomcat] [pool-1-thread-1]    at
    java.lang.Integer.parseInt(Integer.java:504)
    [tomcat] [pool-1-thread-1]    at
    java.lang.Integer.parseInt(Integer.java:539)
    [tomcat] [pool-1-thread-1]    at
    com.q1labs.frameworks.nio.Port.<init>(Port.java:52)
    [tomcat] [pool-1-thread-1]    ... 27 more
    

Local fix

  • Correct or delete the invalid search.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8 Patch 1
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8 Patch 1
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV84615

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    726

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-05-10

  • Closed date

    2016-11-23

  • Last modified date

    2016-11-23

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"726","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
23 November 2016