IBM Support

IV87841: RULE TEST CONTAINING 'ANY OF THESE REFENCE SET(S)' ONLY MATHCES THE FIRST REFERENCE SET DEFINED IN THE TEST

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When using the rule test:
    'and when any of these event properties are contained in any of
    these reference set(s)'
    Only items in the first reference set cause the rule test to
    match.  All subsequent reference sets are not tested against
    the events.
    

Local fix

  • Merge multiple reference sets into one reference sets.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV87841

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    727

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-08-10

  • Closed date

    2016-09-28

  • Last modified date

    2016-09-28

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"727","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 September 2016