IBM Support

IV90460: QRADAR DEPLOY FUNCTION CAN FAIL AFTER PATCHING TO QRADAR 7.2.8 GA

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been observed in some QRadar environments that after
    patching to version 7.2.8 GA, QRadar's Deploy function can fail
    and some services can fail to start on attached Managed Hosts
    that were origianlly built using version 7.2.2 or earlier.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    [hostcontext.hostcontext] [main]
    com.q1labs.hostcontext.capabilities.CapabilitiesReporter:
    [WARN] [NOT:0000004000][127.0.0.1/- -] [-/- -]Failed to report
    host capabilities... initializing thread for repeat attempts
    [hostcontext.hostcontext] [main]
    com.q1labs.configservices.hostcontext.exception.HostContextExcep
    tion: Failed to create Configuration Services Proxy
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.util.HostContextUtilities.getConfigServic
    esProxy(HostContextUtilities.java:260)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.capabilities.CapabilitiesReporter.reportH
    ostCapabilities(CapabilitiesReporter.java:269)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.capabilities.CapabilitiesReporter.reportH
    ostCapabilities(CapabilitiesReporter.java:116)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.HostContext.reportCapabilities(HostContex
    t.java:688)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.HostContext.init(HostContext.java:217)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.HostContext.init(HostContext.java:959)
    [hostcontext.hostcontext] [main]    at
    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    [hostcontext.hostcontext] [main]    at
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
    Impl.java:95)
    [hostcontext.hostcontext] [main]    at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
    AccessorImpl.java:56)
    [hostcontext.hostcontext] [main]    at
    java.lang.reflect.Method.invoke(Method.java:620)
    [hostcontext.hostcontext] [main]    at
    org.apache.commons.daemon.support.DaemonLoader.load(DaemonLoader
    .java:197)
    [hostcontext.hostcontext] [main] Caused by:
    [hostcontext.hostcontext] [main]
    com.q1labs.configservices.common.CSProxyInitException: Unable
    to connect to:
    'https://127.0.0.1/console/services/configservices'
    [hostcontext.hostcontext] [main]    at
    com.q1labs.configservices.soap.ConfigServicesProxy.connect(Confi
    gServicesProxy.java:79)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.hostcontext.util.HostContextUtilities.getConfigServic
    esProxy(HostContextUtilities.java:256)
    [hostcontext.hostcontext] [main]    ... 10 more
    [hostcontext.hostcontext] [main] Caused by:
    [hostcontext.hostcontext] [main] org.xml.sax.SAXException: Bad
    envelope tag:  html
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.AxisFault.makeFault(AxisFault.java:101)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.SOAPPart.getAsSOAPEnvelope(SOAPPart.java:701)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.Message.getSOAPEnvelope(Message.java:424)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.handlers.soap.MustUnderstandChecker.invoke(MustU
    nderstandChecker.java:62)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.client.AxisClient.invoke(AxisClient.java:206)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.client.Call.invokeEngine(Call.java:2765)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.client.Call.invoke(Call.java:2748)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.client.Call.invoke(Call.java:2424)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.client.Call.invoke(Call.java:2347)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.client.Call.invoke(Call.java:1804)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.configservices.soap.ConfigservicesSoapBindingStub.tes
    tConnection(ConfigservicesSoapBindingStub.java:1465)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.configservices.soap.ConfigServicesProxy.testConnectio
    n(ConfigServicesProxy.java:401)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.configservices.soap.ConfigServicesProxy.createConnect
    ion(ConfigServicesProxy.java:232)
    [hostcontext.hostcontext] [main]    at
    com.q1labs.configservices.soap.ConfigServicesProxy.connect(Confi
    gServicesProxy.java:66)
    [hostcontext.hostcontext] [main]    ... 11 more
    [hostcontext.hostcontext] [main] Caused by:
    [hostcontext.hostcontext] [main] org.xml.sax.SAXException: Bad
    envelope tag:  html
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.message.EnvelopeBuilder.startElement(EnvelopeBui
    lder.java:70)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.encoding.DeserializationContext.startElement(Des
    erializationContext.java:1048)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.parsers.AbstractSAXParser.startElement(Unknown
    Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.impl.XMLNSDocumentScannerImpl.scanStartElement
    (Unknown Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.impl.XMLNSDocumentScannerImpl$NSContentDispatc
    her.scanRootElementHook(Unknown Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.impl.XMLDocumentFragmentScannerImpl$FragmentCo
    ntentDispatcher.dispatch(Unknown Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocume
    nt(Unknown Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.parsers.XML11Configuration.parse(Unknown
    Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.parsers.XML11Configuration.parse(Unknown
    Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.parsers.AbstractSAXParser.parse(Unknown
    Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.jaxp.SAXParserImpl$JAXPSAXParser.parse(Unknown
    Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.xerces.jaxp.SAXParserImpl.parse(Unknown Source)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.encoding.DeserializationContext.parse(Deserializ
    ationContext.java:227)
    [hostcontext.hostcontext] [main]    at
    org.apache.axis.SOAPPart.getAsSOAPEnvelope(SOAPPart.java:696)
    [hostcontext.hostcontext] [main]    ... 23 more
    replication[24950]: Console returned a null filename -- It may
    be in the process of shutting down.
    [hostcontext.hostcontext] [DaemonStart]
    com.q1labs.hostcontext.HostContext: [ERROR]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]An error occured
    starting hostcontext.
    [hostcontext.hostcontext] [DaemonStart]
    com.q1labs.hostcontext.lifecycle.LifeCycleException: Unable to
    reset running lock
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.BackupRecoveryEngine.start(BackupR
    ecoveryEngine.java:4896)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.HostContext.start0(HostContext.java:664)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.HostContext.access$600(HostContext.java:8
    7)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.HostContext$4.run(HostContext.java:746)
    [hostcontext.hostcontext] [DaemonStart] Caused by:
    [hostcontext.hostcontext] [DaemonStart]
    com.q1labs.configservices.hostcontext.exception.BackupException:
    unable to release running lock, future actions will not run
    until this lock is released
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.BackupRecoveryEngine.releaseRunnin
    gLock(BackupRecoveryEngine.java:1560)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.BackupRecoveryEngine.start(BackupR
    ecoveryEngine.java:4891)
    [hostcontext.hostcontext] [DaemonStart]    ... 3 more
    [hostcontext.hostcontext] [DaemonStart] Caused by:
    [hostcontext.hostcontext] [DaemonStart]
    com.q1labs.configservices.hostcontext.exception.BackupException:
    Unable to determine if backup already running
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.BackupRecoveryEngine.setBackupRunn
    ing(BackupRecoveryEngine.java:493)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.BackupRecoveryEngine.releaseRunnin
    gLock(BackupRecoveryEngine.java:1556)
    [hostcontext.hostcontext] [DaemonStart]    ... 4 more
    [hostcontext.hostcontext] [DaemonStart] Caused by:
    [hostcontext.hostcontext] [DaemonStart] java.lang.Exception:
    Tomcat is not run. Unable to update a backup running lock
    (key:BACKUP_RUNNING_303, jsonObject:null)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.core.BackupUtils.setBackupRunningL
    ock(BackupUtils.java:2186)
    [hostcontext.hostcontext] [DaemonStart]    at
    com.q1labs.hostcontext.backup.BackupRecoveryEngine.setBackupRunn
    ing(BackupRecoveryEngine.java:489)
    

Local fix

  • Contact Support for a possible workaround that might address
    this issue in some instances.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 728 Patch 1
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 728 Patch 1
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV90460

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    728

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-11-03

  • Closed date

    2018-03-26

  • Last modified date

    2018-03-26

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"728","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
26 March 2018