IBM Support

IV89204: QRADAR ASSET PROFILER TREATS HOSTNAMES WITH DIFFERENT CASE CHARACTERS AS SEPARATE ASSETS

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Depending on the order of events received into QRadar, it is
    possible that QRadar can create multiple assets with the same
    DNS name.  This has been observed when QRadar received updates
    with different upper/lower case character combinations for that
    DNS name.
    

Local fix

  • Where possible:  Configure the device sending logs to always be
    lower case.
    

Problem summary

  • Depending on the order of events received into QRadar, it is
    possible that QRadar can create multiple assets with the same
    DNS name.  This has been observed when QRadar received updates
    with different upper/lower case character combinations for that
    DNS name.
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV89204

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    720

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-09-16

  • Closed date

    2017-04-11

  • Last modified date

    2017-04-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R730 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"720","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
11 April 2017