IBM Support

IV87859: SOME LOG SOURCES CAN FAIL TO BE IMPORTED DURING A CONTENT MANAGEMENT TOOL IMPORT

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When doing a Content Management Tool (CMT) import, the
    sensordevice table database imports can fail due to downstream
    dependencies on sensorprotocolstatus.  When this situation
    occurs, some Log Sources can fail to be imported.
    
    Messages similar to the following might be visible in qradar
    logging when this issue is occurring:
    [[ERROR] Failed to import [sensorprotocolconfig] (Foreign key
    constraint violation). Parameters: [1=18, 2=<value>1, 3=29,
    4=false]
    ERROR: insert or update on table "sensorprotocolconfig"
    violates foreign key constraint "sensor_protocol_status_fkey"
      Detail: Key (status_record)=(29) is not present in table
    "sensorprotocolstatus". {prepstmnt -1673439587 insert into
    sensorprotocolconfig
    (spid,configname,status_record,defaultconfig) values( ?, ?, ?,
    ?)} [code=0, state=23503]
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8 Patch 1
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8 Patch 1
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV87859

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    726

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-08-11

  • Closed date

    2016-11-23

  • Last modified date

    2016-11-23

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"726","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
23 November 2016