IBM Support

QRadar: Rules wizard generates application error due to missing link uuid (APAR IJ40522)

Troubleshooting


Problem

Administrators on QRadar 7.5.0 Update Package 2 or 7.5.0 Update Package 3 can experience application errors when you open the Rules Wizard due to a missing link_uuid value. The application error is displayed as the Rules Wizard is looking for a reference to an anomaly detection engine (ade) rule and not finding a reference. This technical note adds more details to the workaround defined for APAR IJ40522 to assist administrators with the workaround steps.

Symptom

An "Application Error" is displayed to alert users that an error occurred in the rules page.
The Log Activity tab can display Application Error when a disabled users owns a custom property or dependency the UI requires to display results.

Resolving The Problem

This procedure restarts the QRadar web server (Tomcat) service. Administrators who experience this issue can schedule a maintenance window or alert users before you begin this procedure. Restarting the web server logs out users, stops event exports in progress, and prevents scheduled reports from running while the web server restarts.

Procedure

  1. Use SSH to log in to the Console as the root user.
  2. Type the following command to back up your custom rules: 
    pg_dump -U qradar -t custom_rule > /store/custom_rule_backup.sql
  3. To remove missing link_uuids, type the following command: 
    psql -U qradar -c "update custom_rule set link_uuid = null where link_uuid not in (select uuid from custom_rule );"
  4. Type the following command to restart services and clear the Tomcat cache. 
    systemctl stop hostcontext tomcat hostservices; rm -rf /opt/tomcat/work/Catalina; systemctl start hostservices tomcat hostcontext; $(locate wait_for_start.sh | tail -1)
  5. Optional. You can use the wait_for_start.sh utility to confirm hostcontext and related services are started. For more information, see wait_for_start.sh tool.
  6. Wait for services to restart.
    Note: A Tomcat restart can take 15-30 minutes and the user interface is not available while the service restarts. To check on the status of Tomcat from the command line, type: 
    systemctl status tomcat
  7. Clear your browser cache.
  8. Log in to the QRadar Console user interface.
  9. Click the Offenses tab.
  10. Click Rules to open the Rules Wizard.

    Results
    The Rules Wizard opens without displaying an application error. If you continue to experience this issue, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwtrAAA","label":"Rules"}],"ARM Case Number":"TS012717292","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.4.0;7.5.0"}]

Document Information

Modified date:
08 May 2023

UID

ibm16987945

Page Feedback