IBM Support

IV90906: TIMES SERIES NOT WORKING FOR SOME NON-ADMIN QRADAR USERS

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • It has been observed in some customer environments that Time
    Series accumulation does not work for some non-admin user
    profiles.  A message similar to 'no time series available' is
    displayed in the window where a resulting graph should be
    displayed and a NullPointerException is generated in QRadar
    logging.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occuring:
    
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] java.lang.NullPointerException
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    com.q1labs.ariel.ui.UIArielServices.setAccumulationForField(UIAr
    ielServices.java:10774)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
    Impl.java:95)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
    AccessorImpl.java:56)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    java.lang.reflect.Method.invoke(Method.java:620)
    

Local fix

  • No workaround available.
    

Problem summary

  • It has been observed in some customer environments that Time
    Series accumulation does not work for some non-admin user
    profiles.  A message similar to 'no time series available' is
    displayed in the window where a resulting graph should be
    displayed and a NullPointerException is generated in QRadar
    logging.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occuring:
    
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] java.lang.NullPointerException
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    com.q1labs.ariel.ui.UIArielServices.setAccumulationForField(UIAr
    ielServices.java:10774)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
    Impl.java:95)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
    AccessorImpl.java:56)
    [tomcat] [admin@127.0.0.1 (1242)
    /console/JSON-RPC/QRadar.setAccumulationForField
    QRadar.setAccumulationForField] at
    java.lang.reflect.Method.invoke(Method.java:620)
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV90906

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    728

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-11-18

  • Closed date

    2017-04-11

  • Last modified date

    2017-04-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R730 PSY

       UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"728","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
11 April 2017