IBM Support

QRadar SIEM: Application Error on About Page

Troubleshooting


Problem

Seeing an "application error" message when trying to access the "about" page in QRadar SIEM Web UI.

Symptom

“Application error
An error has occurred. Return and attempt the action again."

image-20240626093632-1

The following error is located within /var/log/qradar.error:

[tomcat.tomcat] [(..) (7687) /console/do/qradar/about] org.apache.jsp.qradar.jsp.About_jsp: [ERROR] [NOT:0000003000][X.X.X.X/- -] [-/- -]An error occurred in the _jspService method for org.apache.jsp.qradar.jsp.About_jsp: multiple points
[tomcat.tomcat] [(..) (7687) /console/do/qradar/about] java.lang.NumberFormatException: multiple points
[tomcat.tomcat] [(..) (7687) /console/do/qradar/about] at sun.misc.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:1927)
(..)



Cause

The issue is occurring because you have two unsupported rpms installed from AWS:
amazon-cloudwatch-agent-1.300041.0b681-1.x86_64
amazon-ssm-agent-3.3.484.0-1.x86_64
QRadar SIEM does not support 3rd party installations on QRadar systems as they interfere with the system.

Resolving The Problem

Your team should uninstall the RPMs because even if you resolve this issue you bound to hit other issues in the future such as failed upgrades etc, that may result in reinstalling the appliance. You can reach out to the AWS team to see how removing those will affect the interface.
As a curtesy, you can work around the issue with the following unsupported solution:
  1. Backup file: 
    mkdir -p /store/ibm_support
cp -p /opt/qradar/bin/fix_extra_version.sh /store/ibm_support/
  2. Edit "fix_extra_version.sh": 
    vi /opt/qradar/bin/fix_extra_version.sh
    Change: 
    RPM_LIST=`( rpm -qva | egrep -i "DSM-|VIS-|PROTOCOL-|AGENT-|ContentPackage-" ; cat $NVACONF/dsm_list 2> /dev/null ; ) | sort -u` 
    To 
    RPM_LIST=`( rpm -qva | egrep -i "DSM-|VIS-|PROTOCOL-|AGENT-WINCOLLECT|ContentPackage-" ; cat $NVACONF/dsm_list 2> /dev/null ; ) | sort -u`  
    Note: the delta is "AGENT-" to "AGENT-WINCOLLECT".
  3. Run a deploy (Admin > Deploy Changes).
  4. About page should now open.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"TS016535091","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
26 June 2024

UID

ibm17158854

Page Feedback