Troubleshooting
Problem
In the Log Activity, this error message is displayed at the end of the search result export:
"There was a problem queuing your export job. Please see the system log for details"
Diagnosing The Problem
This error happens due to incorrect permissions, user owner, and (or) group owner on the folder configured for the exports, the default folder is /store/exports/.
These errors are found in the /var/log/qrada.error file:
/console/JSON-RPC/QRadar.queueExportJob] com.q1labs.core.ui.coreservices.export.ExportJob: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]Failed to create temporary file for export. Cannot continue with this export job.
/console/JSON-RPC/QRadar.queueExportJob] java.io.IOException: Permission denied
/console/JSON-RPC/QRadar.queueExportJob] java.io.IOException: Failed to create temporary file for export. Cannot continue with this export job.
Resolving The Problem
- Confirm the folder configured for the exports.
Go the Admin tab, click System Settings, search for Log and Network Activity Data Export Temporary Directory field, the default folder is /store/export but you can use another one. - From the CLI, check the settings for the file by using the next command:
ls -ld <exports folder>
• The user owner must be: nobody• The group owner must be: nobody• Permissions must be:User and group: read, write, and execute.Others: read and execute.
• This capture shows an example of right permissions: -
Correct the folder permissions where needed:
Note: If the folder is different from /store/export, change the folder in the command.
a. If the user or the group (or both) are different, run this command in the QRadar console:chown nobody:nobody /store/export
chmod 775 /store/exports/
Result:
After these changes, the user is able to export the search result without any problem. If the error persists contact QRadar Support for assistance.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
26 May 2022
UID
ibm16567123