Troubleshooting
Problem
QRadar user interface screen does not load correctly. Text is not displayed for some sections and might be incoherent for some other sections.
Symptom
Some samples of the incorrect user interface are provided here:
Cause
The QRadar Console is unable to load property files that are located in the /opt/qradar/conf/localization/ folder because that directory has incorrect permissions that differ from the expected permissions.
On Consoles affected by this issue, the permissions looked like these:
ls -ld /opt/qradar/conf/localization
drw-rw-rw- 2 nobody nobody 32768 Dec 12 14:48 localization
Ideally, the permissions should be like these:
ls -ld /opt/qradar/conf/localization
drwxrwxr-x 2 nobody nobody 32768 Dec 12 14:48 localization
It is uncommon for those permissions to get modified. Support has observed this modification happening around upgrades and auto-updates but a definite root-cause is unknown at this point.
Diagnosing The Problem
When the user interface loads, messages like these will be seen in the /var/log/qradar.log file:
Mar 29 18:00:23 ::ffff:N.N.N.N [reporting_executor.reporting_executor] [Report Queue] com.q1labs.core.shared.localization.PropertyMessageResources: [ERROR] [NOT:0000003000][N.N.N.N/- -] [-/- -]Failed to load property file /opt/qradar/conf/localization/loginmodules.properties
Mar 29 18:00:23 ::ffff:N.N.N.N [reporting_executor.reporting_executor] [Report Queue] java.io.FileNotFoundException: /opt/qradar/conf/localization/loginmodules.properties (Permission denied)
OR
Mar 30 15:39:45 ::ffff:N.N.N.N [tomcat.tomcat] [ArielQueryManager] com.q1labs.core.shared.localization.PropertyMessageResources: [ERROR] [NOT:0000003000][N.N.N.N/- -] [-/- -]Failed to load property file /opt/qradar/conf/localization/UniversalCloudRESTAPI.properties
Mar 30 15:39:45 ::ffff:N.N.N.N [tomcat.tomcat] [ArielQueryManager] java.io.FileNotFoundException: /opt/qradar/conf/localization/UniversalCloudRESTAPI.properties (Permission denied)
Resolving The Problem
- Confirm the permission assigned to the /opt/qradar/conf/localization folder:
ls -ld /opt/qradar/conf/localization - Confirm if the folder has the following permissions (775):
drwxrwxr-x 2 nobody nobody 32768 Feb 8 16:45 /opt/qradar/conf/localization - If the permissions of the /opt/qradar/conf/localization folder are not set to 775, then change the permissions accordingly:
chmod 775 /opt/qradar/conf/localization - Restart the tomcat service:
systemctl restart tomcat - Confirm the tomcat service is active:
systemctl status httpd systemctl status tomcat - Clear the browser cache, and try to access the user interface again.
RESULT: The user interface should get loaded correctly and the text displayed should be legible.
Document Location
Worldwide
[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtIAAQ","label":"Dashboard"}],"ARM Case Number":"TS005320571","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]
Was this topic helpful?
Document Information
Modified date:
10 May 2021
UID
ibm16440563