IBM Support

QRadar: Locale setting can prevent users from modifying response limiters as described in APAR IJ47434

How To


Summary

Users reported an issue where editing an existing rule's response limiter cannot be successfully edited when the user preference is set to a non-English locale. The error described in APAR IJ47434 describes how to temporarily work around the issue.

Environment

Users on QRadar 7.5.0 Update Package 6 reported an issue where response limiter values on existing rules cannot be updated when the locale is set to a non-English value.

Steps

Administrators who need to update a rule response for a non-Enblish locale can temporarily update their user preference as described in the following procedure. This issue does not affect new rules created in QRadar, but users who attempt to update existing rules might need to change the user preference temporarily to English.
Procedure
  1. Log in to the QRadar Console.
  2. Click the user icon, and then click User Preferences to access your user information.
    image-20220628115557-1
  3. In the Locale field, update the user locale to English.
    image-20220628124739-2
  4. Click Save.
  5. Open the Rule Wizard.
  6. Edit the rule and update the response limiter value.
    image-20230705171834-2
  7. Save the rule change.
  8. Confirm that no errors are displayed and the rule saves successfully.

    Results
    The procedure is complete. You can update the user preference to set your locale back to the prior setting. If you continue to experience errors when you attempt to start the Log Source Management app, contact QRadar Support for more assistance. Administrators who experience this issue can subscribe to APAR IJ47434 to receive notifications when this issue is resolved.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Document Information

Modified date:
05 July 2023

UID

ibm17009937