Troubleshooting
Problem
User is unable to access cases application and receives following error message:
There are one or more invalid characters in the search query. additional information - Type: search_phase_execution_exception reason: all shards failed
Cause
This issue is caused due to elasticsearch not being initialized via elastic client pod. Root cause can be corrupted secrets for elastic.
Diagnosing The Problem
First check should be performed in isc-cases-application pod via "kubectl logs -lname=isc-cases-application -c cases-application-client-log-tailer -f". In order for you to view the error, you will need to reload cases page on Cloud Pak for Security UI.
Second check to perform "kubectl logs ibm-dba-ek-isc-cases-elastic-ibm-dba-ek-client-xxxxxx-xxxxx" and verify that elasticsearch initializing error is same as what is found in isc-cases-application log tailer.
Also please check if there are errors for ibm-dba-ek-isc-cases-elastic-ibm-dba-ek-client timeout for connecting to ibm-dba-ek-isc-cases-elastic-ibm-dba-ek-master-0.
Resolving The Problem
Best method to resolve this issue is to redeploy elastic:
Remove elastic:
helm delete --tls --purge ibm-dba-ek-isc-cases-elastic (Please ensure all elastic pods are terminated before proceeding to next step)
Delete secrets:
kubectl delete secret isc-cases-elastic-ibm-dba-ek-creds isc-cases-elastic-ibm-dba-ek-tls isc-cases-elastic-odcfg
Reinstall elastic:
./ibm-security-foundations-prod/ibm_cloud_pak/pak_extensions/support/runcr.sh elastic isc-cases-elastic
Document Location
Worldwide
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m0z0000001h8pAAA","label":"Cases"}],"ARM Case Number":"TS004238594","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]
Was this topic helpful?
Document Information
Modified date:
20 October 2020
UID
ibm16336505