IBM Support

IV91098: INVAILD SUPER INDEXES CAN CAUSE 'GENERAL FAILURE. PLEASE TRY AGAIN' MESSAGES WHEN USED IN A FILTER IN SEARCHES

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Super indexes can sometimes be generated incorrectly and result
    in a null pointer exception when used in filters for searches.
    A 'General Failure. Please try again' red error message can be
    displayed in the search results after in these instances.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    [NOT:0000003000][X.X.X.X/- -] [-/- -]Error executing query, 0
    records processed, 0 records collected by cursor executing
    query:Id:8430be3a-43d4-4f34-9f11-ed449c48fde9,
    DB:<events@/store/ariel/events/records,
    /store/ariel/events/payloads>, Time:<16-10-04,00:00:00 to
    16-10-05,22:00:00>, Criteria=<UserName:[ZZZZZZ,ZZZZZZ]>,
    MappingFactory=com.q1labs.core.types.event.mapping.NormalizedEve
    ntMappingFactory@4ee, processedRecordsLimit=2147483647,
    executionTimeLimit=9223372036854775807,
    collectedRecordsLimit=2147483647, prio=NORMAL
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]
    java.lang.NullPointerException
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.io.SuperIndex$ExpImpl.<init>(S
    uperIndex.java:186)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.io.SuperIndex$ExpImpl.<init>(S
    uperIndex.java:149)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.io.SuperIndex.use(SuperIndex.j
    ava:382)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor$NodeLeafEx
    pr.use(SuperIndexProcessor.java:155)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor$NodeLeaf.f
    orFile(SuperIndexProcessor.java:130)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor$NodeLeaf.u
    se(SuperIndexProcessor.java:90)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor.use(SuperI
    ndexProcessor.java:265)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.ids.ArielFileWorker.work(Ariel
    FileWorker.java:54)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.QueuedWorker.execute(QueuedWorke
    r.java:37)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:63)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    java.lang.Thread.run(Thread.java:798)
    

Local fix

  • No workaround available.
    

Problem summary

  • Super indexes can sometimes be generated incorrectly and result
    in a null pointer exception when used in filters for searches.
    A 'General Failure. Please try again' red error message can be
    displayed in the search results after in these instances.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]
    com.q1labs.ariel.searches.tasks.ArielQueryTaskBase: [ERROR]
    [NOT:0000003000][X.X.X.X/- -] [-/- -]Error executing query, 0
    records processed, 0 records collected by cursor executing
    query:Id:8430be3a-43d4-4f34-9f11-ed449c48fde9,
    DB:<events@/store/ariel/events/records,
    /store/ariel/events/payloads>, Time:<16-10-04,00:00:00 to
    16-10-05,22:00:00>, Criteria=<UserName:[ZZZZZZ,ZZZZZZ]>,
    MappingFactory=com.q1labs.core.types.event.mapping.NormalizedEve
    ntMappingFactory@4ee, processedRecordsLimit=2147483647,
    executionTimeLimit=9223372036854775807,
    collectedRecordsLimit=2147483647, prio=NORMAL
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]
    java.lang.NullPointerException
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.io.SuperIndex$ExpImpl.<init>(S
    uperIndex.java:186)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.io.SuperIndex$ExpImpl.<init>(S
    uperIndex.java:149)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.io.SuperIndex.use(SuperIndex.j
    ava:382)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor$NodeLeafEx
    pr.use(SuperIndexProcessor.java:155)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor$NodeLeaf.f
    orFile(SuperIndexProcessor.java:130)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor$NodeLeaf.u
    se(SuperIndexProcessor.java:90)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.SuperIndexProcessor.use(SuperI
    ndexProcessor.java:265)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.service.ids.ArielFileWorker.work(Ariel
    FileWorker.java:54)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.QueuedWorker.execute(QueuedWorke
    r.java:37)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase.runTask(ServiceT
    askBase.java:89)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.ServiceTask.runTask(ServiceTask.
    java:63)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    com.q1labs.ariel.searches.tasks.ServiceTaskBase$Runner.run(Servi
    ceTaskBase.java:32)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1157)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:627)
    [ariel.ariel_proxy_server]
    [hour_idx_7:8430be3a-43d4-4f34-9f11-ed449c48fde9]    at
    java.lang.Thread.run(Thread.java:798)
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV91098

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    727

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-11-29

  • Closed date

    2017-04-11

  • Last modified date

    2017-04-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R730 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"727","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
11 April 2017