IBM Support

QRadar: Unable to see the add button in User Behavior Analytics (UBA) app

Troubleshooting


Problem

Administrators cannot see the add button in user import configuration. When this issue is present on the system, it can prevent administrator from adding users in User Behavior Analytics (UBA) app.

Symptom

In the user import configuration, the add button is not present:
image-20230407145217-1

Cause

Tomcat server cache needs to be cleared.

Diagnosing The Problem

  1. Log in to the QRadar user interface.
  2. Click the User Analytics tab.
    image-20230407145444-2
  3. Click the User Import button.image-20230407145526-3

    Result
    The administration can confirm that the add button is not present in the user import window.
    image-20230407145637-4

Resolving The Problem

In order to fix the issue, clear the Tomcat cache.
Important: The administrator might need a maintenance window to clear the Tomcat cache. The following steps stop the Tomcat process and this action makes the user interface unavailable.
  1. Log in to the QRadar Console as the root user.
  2. Create the backup directory: 
    mkdir /store/IBM_Support
  3. Run the following command to stop the Tomcat service: 
    systemctl stop tomcat
  4. To back up the /opt/tomcat/work/Catalina/localhost directory, enter the following command: 
    cp -pr /opt/tomcat/work/Catalina/localhost/console/org/apache/jsp  /store/ibm_support/
  5. To clear the cached files from the /opt/tomcat/work/Catalina/localhost/console directory, enter the following command: 
    rm -rfv /opt/tomcat/work/Catalina/localhost/console/org/apache/jsp
  6. Run the following command to start the Tomcat service: 
    systemctl restart tomcat
    Result
    The add button appears in the user import window. If the administrator continues to experience issues, contact QRadar Support for assistance.

Related Information

How to clear the Tomcat cache

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.3;and future releases"}]

Document Information

Modified date:
11 April 2023

UID

ibm16980427

Page Feedback