IBM Support

IV86839: 'APPLICATION ERROR' WHEN SEARCHING A LOG SOURCE NAME WHEN LOG SOURCES ARE SORTED BY EPS

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When sorted by EPS (Events Per Second) on the Log Sources page,
    and then a search filter for log source name is performed, an
    Application Error is displayed.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist]
    com.q1labs.uiframeworks.action.ExceptionHandler: [ERROR]
    Chained SQL Exception [1/1]: ERROR: for SELECT DISTINCT, ORDER
    BY expressions must appear in select list Position: 1053
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist]
    com.q1labs.uiframeworks.action.ExceptionHandler: [ERROR]
    [NOT:0000003000][172.16.184.116/- -] [-/- -]An exception
    occurred while processing the request:
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist]
    org.postgresql.util.PSQLException: ERROR: for SELECT DISTINCT,
    ORDER BY expressions must appear in select list Position: 1053
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(Qu
    eryExecutorImpl.java:2157)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExe
    cutorImpl.java:1886)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorIm
    pl.java:255)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.postgresql.jdbc3.AbstractJdbc3Statement.getParameterMetaData
    (AbstractJdbc3Statement.java:412)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    com.mchange.v2.c3p0.impl.NewProxyPreparedStatement.getParameterM
    etaData(NewProxyPreparedStatement.java:573)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.getParam
    eterMetaData(DelegatingPreparedStatement.java:459)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.getParam
    eterMetaData(DelegatingPreparedStatement.java:459)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.getParam
    eterMetaData(DelegatingPreparedStatement.java:459)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.getParam
    eterMetaData(DelegatingPreparedStatement.java:459)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    com.q1labs.frameworks.session.PreparedStatementWrapper.getParame
    terMetaData(PreparedStatementWrapper.java:350)
    [tomcat] [admin@127.0.0.1(7651)
    /console/do/core/genericsearchlist] at
    com.q1labs.core.ui.util.QueryUtils.getQueryResults(QueryUtils.ja
    va:796)
    

Local fix

  • Do not use the EPS (Event Per Second) sort, or perform the
    search filter first, then perform the sort.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV86839

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    727

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-07-12

  • Closed date

    2016-09-28

  • Last modified date

    2016-09-28

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"727","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 September 2016