IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Qradar daily report

    Posted Tue November 21, 2023 03:14 PM

    Hi,

    I have an issue with my daily report, I notice that the report is not generated for Saturday and Sunday but data for those days are available when you run a search in the log activity.

    I went through the report details but everything seems correct.

    Can someone help me.

    Thanks



    ------------------------------
    Benjamin Yabre
    ------------------------------


  • 2.  RE: Qradar daily report
    Best Answer

    Posted Wed November 22, 2023 07:27 AM

    Hi Benjamin

    Looking at this you are hitting a known issue covered by the following APAR

    https://www.ibm.com/support/pages/apar/IJ47894

    This is resolved in 7.5.0 UP7.

    I would recommend to open a support case for this.

    Thanks

    John



    ------------------------------
    John Dawson
    ------------------------------



  • 3.  RE: Qradar daily report

    Posted Wed November 22, 2023 08:35 AM

    Hi Dawson,

    Thanks for your reply



    ------------------------------
    Benjamin Yabre
    ------------------------------



  • 4.  RE: Qradar daily report

    Posted Wed November 22, 2023 10:26 AM

    This is the solution of the issue I have raised :

    Error description

    • Users on QRadar 7.5.0 Update Package 6 reported an issue where
      daily reports are not created during the weekend. Daily reports
      are expected to generate daily, when selected.
      
      To reproduce this issue:
      1. Create a scheduled report that is to run daily.
      
      2. Configure the report containers. Note: The contents of the
      report containers do not impact the report generation.
      3. Wait for the report to run.
      
      Results
      The reports generate daily, but are missing on Saturday and
      Sunday. There are no logs that indicate that the report did not
      run as expected.
      

    Local fix

    • As a temporary workaround, administrators can manually run the
      report on Saturday or Sunday.
      
      Note: This is an advanced procedure. If you are unsure about
      updating files, contact QRadar Support for assistance.
      
      Procedure
      1. Log in to the Console as the root user.
      2. Create a copy of the ReportWizard-schedule.jsp to
      /store/ibm_support.
      cp -p
      /opt/qradar/webapps/console/reports/jsp/wizard/ReportWizard-sche
      dule.jsp /store/IBM_Support/
      3. Modify the fieldValue in ReportWizard-Schedule.jsp file to
      display checked:
      
      Before
      <s:checkbox id="daily_sunday" name="values['daily_sunday']"
      fieldValue="unchecked" value="isChecked('daily_sunday')" />
      <s:checkbox id="daily_saturday" name="values['daily_saturday']"
      fieldValue="unchecked" value="isChecked('daily_saturday')" />
      
      After
      <s:checkbox id="daily_sunday" name="values['daily_sunday']"
      fieldValue="checked" value="isChecked('daily_sunday')" />
      <s:checkbox id="daily_saturday" name="values['daily_saturday']"
      fieldValue="checked" value="isChecked('daily_saturday')" />
      
      Note: The only required change is to ensure that sunday and
      saturday fieldValue= parameters display as checked. Do not make
      any other changes to this file.
      
      4. Save the changes to the file.
      5. Log in to QRadar as a user.
      6. Click the Reports tab.
      7. Edit and save the report. Note: No changes are required, but
      confirm the weekend days are checked (selected).
      8. Save and run the report.
      
      Results
      The report is expected to run on the weekend without requiring
      the user to run manually on Saturday or Sunday as previous
      mentioned in this APAR. If you continue to experience issues
      after this workaround, contact QRadar Support.


    ------------------------------
    Benjamin Yabre
    ------------------------------