IBM Support

IV90007: TIMESERIES ACCUMULATION AND/OR REPORTS CAN FAIL TO GENERATE IN SOME INSTANCES AFTER PATCHING TO QRADAR 7.2.7.X

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Timeseries accumulation and/or report generation can fail after
    patching to QRadar 7.2.7.x
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this particular issue is occurring:
    
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Exception processing
    file:/store/ariel/gv/records/GV_10035/2016/6/22/0/GV_#DAILY#1003
    5~0_0~#1#834c8bf7a16f472f~bfeb1394cf7c4f9a, skipped...
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]
    java.lang.NullPointerException
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.cve.accumulation.mappings.AccumulationQueryMappingEX.
    getPayload(AccumulationQueryMappingEX.java:47)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.cve.accumulation.mappings.AccumulationQueryMappingEX.
    getPayload(AccumulationQueryMappingEX.java:14)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.FileReader.doRead(FileReader.java:227)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.FileReader.read(FileReader.java:208)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.service.ids.ArielFile$Crawler.nextReco
    rd(ArielFile.java:31)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.service.ids.ArielFile.next(ArielFile.j
    ava:200)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.service.ids.FilteredSource.next(Filter
    edSource.java:43)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.QueryWorker.execute(QueryWorker.
    java:53)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:63)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    java.lang.Thread.run(Thread.java:798)
    [ariel.ariel_proxy_server]
    [qw_10:ecc9e468-889d-4e66-ac70-712b742c60fd]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    

Local fix

  • Contact Support for a possible workaround that might address
    this issue in some instances.
    

Problem summary

  • Timeseries accumulation and/or report generation can fail after
    patching to QRadar 7.2.7.x
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this particular issue is occurring:
    
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Exception processing
    file:/store/ariel/gv/records/GV_10035/2016/6/22/0/GV_#DAILY#1003
    5~0_0~#1#834c8bf7a16f472f~bfeb1394cf7c4f9a, skipped...
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]
    java.lang.NullPointerException
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.cve.accumulation.mappings.AccumulationQueryMappingEX.
    getPayload(AccumulationQueryMappingEX.java:47)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.cve.accumulation.mappings.AccumulationQueryMappingEX.
    getPayload(AccumulationQueryMappingEX.java:14)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.FileReader.doRead(FileReader.java:227)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.FileReader.read(FileReader.java:208)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.service.ids.ArielFile$Crawler.nextReco
    rd(ArielFile.java:31)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.service.ids.ArielFile.next(ArielFile.j
    ava:200)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.service.ids.FilteredSource.next(Filter
    edSource.java:43)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.QueryWorker.execute(QueryWorker.
    java:53)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:63)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server]
    [qw_2:ecc9e468-889d-4e66-ac70-712b742c60fd]    at
    java.lang.Thread.run(Thread.java:798)
    [ariel.ariel_proxy_server]
    [qw_10:ecc9e468-889d-4e66-ac70-712b742c60fd]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV90007

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    727

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-10-14

  • Closed date

    2017-04-11

  • Last modified date

    2017-04-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R730 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"727","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
11 April 2017