IBM Support

IV91226: QVM SCAN CAN FAIL TO START/PROGRESS WHEN THERE ARE A LARGE NUMBER OF IP ADDRESS SCAN EXCLUSIONS DUE TO A POSTGRES EXCEPTION

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been observed that QVM scans can fail to start/progress
    when a large number of ip exclusions are defined, and the scan
    has been edited and saved before the scan "start up" phase
    completes.
    
    This may occur if the following Postgres Exception is
    written to /var/log/qradar-sql.log
    
    /console/JSON-RPC/QVM.runScans QVM.runScans]
    org.postgresql.util.PSQLException: ERROR: null value in column
    "exclusionid" violates not-null constraint
      Detail: Failing row contains (null, 3859295).
      Where: SQL statement "INSERT INTO
    q1_exclusions_ipexceptions_map
            (
                    exclusionid,
                    config_ipexceptions_uniqueid
            )
            VALUES
            (
                (
                    SELECT DISTINCT exclusionid
                    FROM  Config_IPExceptions c
                    INNER JOIN tt_new_rows_mapped_q1_exclusion_rules
    tt ON (tt.classa = c.classa
    
    AND tt.classb = c.classb
    
    AND tt.classc = c.classc
    
    AND tt.classd = c.hostip)
                    WHERE c.uniqueid = i
                ),
                i
            )"
    PL/pgSQL function config_exclusions_checkmaster(integer) line
    196 at SQL statement
    SQL statement "SELECT
    Config_Exclusions_CheckMaster(v_joborderid)"
    PL/pgSQL function jobscheduling_queu_singlejob(integer,integer)
    line 94 at PERFORM
    SQL statement "SELECT
    JobScheduling_Queu_SingleJob(v_joborderid,NULL)"
    PL/pgSQL function cw_job_runnow(integer,integer) line 13 at
    PERFORM
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 731 patch 7.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 731 patch 7.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV91226

  • Reported component name

    QR VULNERABILIT

  • Reported component ID

    5725QVMSW

  • Reported release

    726

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-12-02

  • Closed date

    2018-12-12

  • Last modified date

    2018-12-12

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QR VULNERABILIT

  • Fixed component ID

    5725QVMSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSHLPS","label":"IBM Security QRadar Vulnerability Manager"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"726","Edition":""}]

Document Information

Modified date:
12 December 2018