IBM Support

QRadar: User preferences can cause the Dashboard or Log Source Management app to display "Could not load log source data" errors (IJ34850)

Troubleshooting


Problem

An issue is reported in QRadar 7.4.3 versions where the locale set in the User Preference can cause errors in the QRadar API, Dashboard, or Log Source Management app. This error is caused by the pg_collate table in the database where the locale does not have a utf8 encoding. When the problem occurs, the Log Source Management app does not display log source information and the log_sources API endpoint can return 500 errors.

Symptom

There are several symptoms administrators can review to identify this issue:

  1. When you attempt to start the Log Source Management app, the "An unexpected API error has occurred" message is displayed in the user interface.
  2. Administrators who attempt to update or get information from the log_source endpoint in the QRadar API can receive error code 500 responses.
    image-20220628121409-2
  3. If you review /var/log/qradar.log, the following error might be displayed: 
    hostname postgres[26685]: [182-1] ERROR:
collation "pl" for encoding "UTF8" does not exist at character 11
hostname postgres[26685]: [182-2] STATEMENT: SELECT '' COLLATE "pl"

Resolving The Problem

Administrators who experience issues with the Log Source Management app and API errors can update the locale in their user preference until this issue is resolved.
Procedure
  1. Log in to the QRadar Console.
  2. Click the user icon, and then click User Preferences to access your user information.
    image-20220628115557-1
  3. In the Locale field, update the user locale to another language. If your locale is set to English, update it to English (US) or English (CA). This issue was reported for user preferences that are single-word only, such as English or French.
    image-20220628124739-2
  4. Click Save.
  5. Click the Admin tab.
  6. Click Log Sources.

    Results
    After you update your user preference, the Log Source Management app is expected to start correctly without API errors. If you continue to experience errors when you attempt to start the Log Source Management app, contact QRadar Support for more assistance.

Advanced: How to update locale settings in the command line

Important: This procedure allows administrators with root access how to change their user settings in the database to update the user preference. Only QRadar Support or experienced administrators are expected to use this procedure as updating database values incorrectly can cause significant Console issues.

Procedure

  1. Log in to the QRadar Console as the root user.
  2. To confirm the locale, type: 
    psql -U qradar -c "select * from user_settings where locale not in ('en_US','fr_FR','pl_PL','pt_BR')";
    Example output 
    id |         security_id                  |         email      | locale
-------------------------------------------------------------------------
85 | d47ae0f5-ef67-42c2-a287-fa5de2afsdf1 | <user@example.com> | en
  3. If the output lists an incorrect locale, you must update your user preference. For example,
    Incorrect locale value Correct locale value
    en en_US
    fr fr_FR
    pl pl_PL
    pt pt_BR
                                 
  4. To update your user preference, type the following command: 
    psql -U qradar -c "update user_settings set locale = 'en_US' where locale = 'en' ";
  5. To verify the database is updated, type: 
    psql -U qradar -c "select* from user_settings where locale = 'en_US' ";
  6. To stop hostcontext, type: 
    systemctl stop hostcontext
  7. To restart Tomcat, type: 
    systemctl restart tomcat
  8. To stop hostcontext, type: 
    systemctl start hostcontext
  9. Wait for Tomcat to start. It can take 15 - 20 minutes for Tomcat to restart.
  10. Log in to the QRadar Console as an administrator.
  11. Click the Admin tab.
  12. Click Log Sources.

    Results
    After you update your user preference, the Log Source Management app is expected to start without displaying API errors. If you continue to experience errors when you attempt to start the Log Source Management app, contact QRadar Support for more assistance.

Related Information

APAR IJ34850

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"TS009666721","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.3;7.5.0"}]

Document Information

Modified date:
20 February 2023

UID

ibm16596983

Page Feedback