IBM Support

QRadar: User interface does not load correctly and displays incoherent text



QRadar user interface screen does not load correctly. Text is not displayed for some sections and might be incoherent for some other sections.


Some samples of the incorrect user interface are provided here:
image 9161
image 9162



The QRadar Console is unable to load property files that are located in the /opt/qradar/conf/localization/ folder because that directory has incorrect permissions that differ from the expected permissions.
On Consoles affected by this issue, the permissions looked like these:
ls -ld /opt/qradar/conf/localization
drw-rw-rw-  2 nobody  nobody  32768 Dec 12 14:48 localization
Ideally, the permissions should be like these:
ls -ld /opt/qradar/conf/localization
drwxrwxr-x  2 nobody  nobody  32768 Dec 12 14:48 localization
It is uncommon for those permissions to get modified. Support has observed this modification happening around upgrades and auto-updates but a definite root-cause is unknown at this point.

Diagnosing The Problem

When the user interface loads, messages like these will be seen in the /var/log/qradar.log file:
Mar 29 18:00:23 ::ffff:N.N.N.N [reporting_executor.reporting_executor] [Report Queue] com.q1labs.core.shared.localization.PropertyMessageResources: [ERROR] [NOT:0000003000][N.N.N.N/- -] [-/- -]Failed to load property file /opt/qradar/conf/localization/
Mar 29 18:00:23 ::ffff:N.N.N.N [reporting_executor.reporting_executor] [Report Queue] /opt/qradar/conf/localization/ (Permission denied)
Mar 30 15:39:45 ::ffff:N.N.N.N [tomcat.tomcat] [ArielQueryManager] com.q1labs.core.shared.localization.PropertyMessageResources: [ERROR] [NOT:0000003000][N.N.N.N/- -] [-/- -]Failed to load property file /opt/qradar/conf/localization/
Mar 30 15:39:45 ::ffff:N.N.N.N [tomcat.tomcat] [ArielQueryManager] /opt/qradar/conf/localization/ (Permission denied)

Resolving The Problem

  1. Confirm the permission assigned to the /opt/qradar/conf/localization folder:
    ls -ld /opt/qradar/conf/localization
  2. Confirm if the folder has the following permissions (775):
    drwxrwxr-x 2 nobody nobody 32768 Feb  8 16:45 /opt/qradar/conf/localization
  3. If the permissions of the /opt/qradar/conf/localization folder are not set to 775, then change the permissions accordingly:
    chmod 775 /opt/qradar/conf/localization
  4. Restart the tomcat service:
    systemctl restart tomcat
  5. Confirm the tomcat service is active:
    systemctl status httpd
    systemctl status tomcat
  6. Clear the browser cache, and try to access the user interface again.
RESULT: The user interface should get loaded correctly and the text displayed should be legible.

Document Location


[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtIAAQ","label":"Dashboard"}],"ARM Case Number":"TS005320571","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Document Information

Modified date:
10 May 2021