IBM Security QRadar

 View Only
Expand all | Collapse all

Analyst Custom Searches - Internal Server Error

  • 1.  Analyst Custom Searches - Internal Server Error

    Posted Mon September 19, 2022 07:12 AM

    Hi,

    In some offenses we get "Internal Server Error" instead "Analyst Custom Searches" window.

    Support found following error in app.log, but they referred me for support to the forum.

    2022-08-27 00:55:29,981 [RuleUpdateThread] [INFO] [APP_ID:1202] [NOT:0000006000] Error during Rule ID Map Update: HTTPSConnectionPool(host='my.console.hostname', port=443): Max retries exceeded with url: /api/analytics/rules?fields=id%2Cname (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f4e141daac8>: Failed to establish a new connection: [Errno 113] No route to host',))

    Thanks,

    Daniel



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Analyst Custom Searches - Internal Server Error

    Posted Mon September 19, 2022 07:24 AM

    What do you mean with "Analyst Custom Searches" window ?

    The search buttons in the offense OR the window where the search results should be?



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Analyst Custom Searches - Internal Server Error

    Posted Mon September 19, 2022 07:41 AM

    Hi,

    "the search buttons in the offense"

    Daniel



    #QRadar
    #Support
    #SupportMigration


  • 4.  RE: Analyst Custom Searches - Internal Server Error

    Posted Mon September 19, 2022 08:12 AM

    the error you posted seems unrelated. For the Internal Server Error you should have other logs in your app container logs.


    Can you trigger this error on demand?



    #QRadar
    #Support
    #SupportMigration


  • 5.  RE: Analyst Custom Searches - Internal Server Error

    Posted Mon September 19, 2022 09:56 AM

    Thanks for reply.

    Every time when I enter offenses based on few rules I see "Internal Server Error". Unfortunately there is no new log error entry generated (in docker logs).

    Using direct url to frame, when I change offense ID (2034) to other case ID there is no error or it is if offense is based on affected rule https://myconsole.url/console/plugins/1202/app_proxy/OffenseSearches/2034.

    I found 2 error types in app.stderr file, but not sure if it's related.


    1.

    9/19/2022, 8:48:27 AM [07746c8c74c7] ERROR: ===========================================================

    9/19/2022, 8:48:27 AM [07746c8c74c7] ERROR: [Network error]

    9/19/2022, 8:48:27 AM [07746c8c74c7] ERROR: TypeError: Only absolute URLs are supported

       at getNodeRequestOptions (/opt/app-root/app/node_modules/next/dist/compiled/node-fetch/index.js:1:61917)

       at /opt/app-root/app/node_modules/next/dist/compiled/node-fetch/index.js:1:63448

       at new Promise (<anonymous>)

       at Function.fetch [as default] (/opt/app-root/app/node_modules/next/dist/compiled/node-fetch/index.js:1:63382)

       at fetchWithAgent (/opt/app-root/app/node_modules/next/dist/server/node-polyfill-fetch.js:38:39)

       at fetch (/opt/app-root/app/.next/server/pages/_app.js:10414:20)

       at /opt/app-root/app/node_modules//client/link/http/http.cjs.js:249:13

       at new Subscription (/opt/app-root/app/node_modules/zen-observable/lib/Observable.js:197:34)

       at Observable.subscribe (/opt/app-root/app/node_modules/zen-observable/lib/Observable.js:279:14)

       at /opt/app-root/app/node_modules/zen-observable/lib/Observable.js:319:23

    9/19/2022, 8:48:27 AM [07746c8c74c7] ERROR: ===========================================================

    2.

    9/18/2022, 10:53:24 PM [07746c8c74c7] ERROR: ===========================================================

    You have not declared a namespacesRequired array on your page-level component: Index. This will cause all namespaces to be sent down to the client, possibly negatively impacting the performance of your app. For more info, see: https://github.com/isaachinman/next-i18next#4-declaring-namespace-dependencies

    9/19/2022, 8:48:27 AM [07746c8c74c7] ERROR: ===========================================================


    Daniel



    #QRadar
    #Support
    #SupportMigration