Hi

We've installed the Use Case Manager extension on our QRoc, and we are having problems with it. When we open the "Use Case Manager" tab, we get a "Failed to get the report results : Network Error".

We openned a Case with IBM Support, and after a few log check with them, we've been told to open this issue in the IBM Forum as it is most likely a problem with the app.

Here's the content of the logs we analysed with IBM Support :

./app-2021-04-24.log.7:2021-04-24T11:19:06.345Z - error: loadCacheFromQRadarAPIs - Failed to get rules: 'items=13370-13370'

./app-2021-04-24.log.7:2021-04-24T11:19:06.354Z - error: sendApiRequestImpl - Network Error: /api/analytics/rules_with_data?fields=creation_date%2C%20id%2C%20identifier%2C%20linked_rule_identifier%2C%20modification_date%2C%20origin%2C%20owner%2C%20rule_xml&sort=-modification_date : connect ECONNREFUSED 10.182.12.229:443 { Error: connect ECONNREFUSED 10.182.12.229:443

./app-2021-04-24.log.7:2021-04-24T11:19:06.354Z - error: loadCacheFromQRadarAPIs - Failed to get rules: 'items=13371-13430'

./app-2021-04-24.log.7:2021-04-24T11:19:06.363Z - error: sendApiRequestImpl - Network Error: /api/analytics/rules_with_data?fields=creation_date%2C%20id%2C%20identifier%2C%20linked_rule_identifier%2C%20modification_date%2C%20origin%2C%20owner%2C%20rule_xml&sort=-modification_date : connect ECONNREFUSED 10.182.12.229:443 { Error: connect ECONNREFUSED 10.182.12.229:443

(END)

./app-2021-04-26.log:2021-04-26T13:29:45.729Z - error: getFlatResult - Failed to get report results: The column you selected is not valid in current search. { code: 456,

./app-2021-04-26.log:2021-04-26T13:29:45.730Z - error: Failed to get report result: The column you selected is not valid in current search. { code: 456,

./app-2021-04-26.log:2021-04-26T13:29:45.735Z - error: getGroupedResult: Rules Explorer report was not found in the History collection or was deleted from disk. { code: 404,

./app-2021-04-26.log:2021-04-26T13:29:45.902Z - error: getGroupedResult: Rules Explorer report was not found in the History collection or was deleted from disk. { code: 404,

We are not having this issue on our Test bed, only in Production. We have tried to uninstall and reinstall, but the problem is still present.

Please advise.

Regards,

Pierre-Alexandre Forand

it looks that there are connection problems from UCM to qradar. I wonder if you can check.

1- how many rules/bbs do you have ( the log was showing 13430 which is too much)

2- any other parts of the app is working ?? ( CRE events for example ) need to confirm if the connection failure is temporarily or everywhere

I believe this issue might be related to Google Chrome. Do you use Google Chrome? If yes, then you might test this issue by using FireFox and confirming if the issue is still a problem.

We've seen some issues where Chrome does not handle gzip compression when a range of data is involved, causing rules to not download as expected. This issue is exclusive to Chrome and QRadar on Cloud as far as I'm aware.

I would open a case and get QRadar Support to add your case to this issue. Firefox is a workaround for this QRadar on Cloud issue, but if you call in tell Support to add you to UCM-350 if you can view rules in Firefox, but not in Chrome. The issue is still under investigation, but my guess is that this is your issue.

Hope this helps...

Yes, it's working with Firefox. Thanks! I'll open a case to support for UCM-350.

Thanks again!

PA Forand

No problem, happy to help.