IBM Support

IV90066: 'GENERAL FAILURE. PLEASE TRY AGAIN' WHEN PERFORMING A 'GROUP BY' SEARCH OF A PROPERTY, FILTERED AGAINST A REFERENCE SET

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When performing a 'group by' search of a property, and then
    filtering that property against a reference set, a 'General
    failure. Please try again' error message is displayed.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Error executing query, 0
    records processed, 0 records collected by cursor executing
    query:Id:397e326d-2e4f-4523-9dc2-04580f729d96,
    DB:<events@/store/ariel/events/records,
    /store/ariel/events/payloads>, Time:<16-09-12,13:49:00 to
    16-09-12,14:04:00>, progress details 15, Sort
    order:<Switch,asc>,
    Criteria=(<Switch:pr=ReferenceSetPredicate[11:Switches]> AND
    <DeviceId:[1362,1362]>),
    MappingFactory=com.q1labs.core.types.event.mapping.NormalizedEve
    ntMappingFactory@4ee, processedRecordsLimit=2147483647,
    executionTimeLimit=9223372036854775807,
    collectedRecordsLimit=2147483647, retentionTime=86400000,
    search top 1000, remoteServers=[localhost/127.0.0.1:32011],
    prio=NORMAL
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]
    com.q1labs.frameworks.exceptions.CIDRNetworkException: Failed
    to parse IP address: N/A
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.parseIPAddress(Host.java:207)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.fromString(Host.java:74)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.fromString(Host.java:56)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.types.HostKeySerializer.keyFromString(HostKeySer
    ializer.java:52)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.types.HostKeySerializer.keyFromString(HostKeySer
    ializer.java:17)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.types.networkevent.ReferenceSetPredicate.evaluat
    e(ReferenceSetPredicate.java:83)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.IndexPredicate$DelegatedPredicate.evaluate(Inde
    xPredicate.java:142)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.IndexPredicate.evaluate(IndexPredicate.java:247
    )
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.frameworks.util.predicate.AndPredicate.evaluate(AndPr
    edicate.java:15)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.service.ids.FilteredSource.next(Filter
    edSource.java:44)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.QueryWorker.execute(QueryWorker.
    java:53)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:63)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Thread.run(Thread.java:798)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96] Caused by:
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]
    java.lang.NumberFormatException: For input string: "N/A"
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.NumberFormatException.forInputString(NumberFormatExcep
    tion.java:77)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Integer.parseInt(Integer.java:504)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Short.parseShort(Short.java:129)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Short.parseShort(Short.java:155)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.parseUnsignedByte(Host.java:215)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.parseIPAddress(Host.java:197)
    

Local fix

  • Perform the identical search without the 'Group By' completes
    successfully.
    

Problem summary

  • When performing a 'group by' search of a property, and then
    filtering that property against a reference set, a 'General
    failure. Please try again' error message is displayed.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Error executing query, 0
    records processed, 0 records collected by cursor executing
    query:Id:397e326d-2e4f-4523-9dc2-04580f729d96,
    DB:<events@/store/ariel/events/records,
    /store/ariel/events/payloads>, Time:<16-09-12,13:49:00 to
    16-09-12,14:04:00>, progress details 15, Sort
    order:<Switch,asc>,
    Criteria=(<Switch:pr=ReferenceSetPredicate[11:Switches]> AND
    <DeviceId:[1362,1362]>),
    MappingFactory=com.q1labs.core.types.event.mapping.NormalizedEve
    ntMappingFactory@4ee, processedRecordsLimit=2147483647,
    executionTimeLimit=9223372036854775807,
    collectedRecordsLimit=2147483647, retentionTime=86400000,
    search top 1000, remoteServers=[localhost/127.0.0.1:32011],
    prio=NORMAL
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]
    com.q1labs.frameworks.exceptions.CIDRNetworkException: Failed
    to parse IP address: N/A
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.parseIPAddress(Host.java:207)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.fromString(Host.java:74)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.fromString(Host.java:56)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.types.HostKeySerializer.keyFromString(HostKeySer
    ializer.java:52)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.types.HostKeySerializer.keyFromString(HostKeySer
    ializer.java:17)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.types.networkevent.ReferenceSetPredicate.evaluat
    e(ReferenceSetPredicate.java:83)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.IndexPredicate$DelegatedPredicate.evaluate(Inde
    xPredicate.java:142)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.IndexPredicate.evaluate(IndexPredicate.java:247
    )
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.frameworks.util.predicate.AndPredicate.evaluate(AndPr
    edicate.java:15)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.service.ids.FilteredSource.next(Filter
    edSource.java:44)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.QueryWorker.execute(QueryWorker.
    java:53)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:63)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Thread.run(Thread.java:798)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96] Caused by:
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]
    java.lang.NumberFormatException: For input string: "N/A"
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.NumberFormatException.forInputString(NumberFormatExcep
    tion.java:77)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Integer.parseInt(Integer.java:504)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Short.parseShort(Short.java:129)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    java.lang.Short.parseShort(Short.java:155)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.parseUnsignedByte(Host.java:215)
    [ariel.ariel_proxy_server]
    [aqw_local_2:397e326d-2e4f-4523-9dc2-04580f729d96]    at
    com.q1labs.core.dao.util.Host.parseIPAddress(Host.java:197)
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0 and 7.2.8
    Patch 12.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV90066

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    727

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-10-18

  • Closed date

    2017-04-11

  • Last modified date

    2018-05-09

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R730 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"727","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
09 May 2018