IBM Security QRadar SOAR

 View Only
  • 1.  Issues after upgrade to 46.1.48

    Posted Fri September 30, 2022 09:23 AM
    Hello,

    After upgrade SOAR from 46.0.8134 to 46.1.48 I got a lot of errors in my playbooks. The errors related to fn_utilites and QRadar Integration apps. The errors happens only if playbook has activation type = Automation. The same playbook with activation type = Manual works flawless. Also my fn_utilites 2.1.1 do no pass selftest and got the error:

    fn-utilities:
    ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
    selftest: failure
    selftest output:
    {'state': 'failure', 'reason': "('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))"}
    Elapsed time: 0.267000 seconds

    ERROR: running selftest for App.
    Error Code: 1

    In client.log I see some errors and warnings like:

    04:49:28.604 [Camel (camel-1) thread #11 - JmsConsumer[acks.%3E]] ERROR [] org.hibernate.internal.SessionImpl - HHH000088: Exception in interceptor beforeTransactionCompletion()

    06:19:59.441 [Camel (camel-1) thread #14 - JmsConsumer[acks.%3E]] ERROR [] com.co3.broker.AcknowledgementProcessor - Error processing message: { "message_type": 0, "message": "Completed", "complete": true, "results": { "version": "1.0", "success": true, "reason": null, "content": { "timeout_type": "FIRST_SEEN", "number_of_elements": 11360, "data": { "xxx": { "Hostname": { "last_seen": 1656076954240, "first_seen": 1655817626389, "source": "Table_Users_Hostname", "value": "xxx", "domain_id": null }, "Log Source": { "last_seen": 1656076954240, "first_seen": 1655817626389, "source": "Table_Users_Hostname", "value": "xxx", "domain_id": null }, "Logon Time": { "last_seen": 1656079534261, "first_seen": 1655817626389, "source": "Table_Users_Hostname", "value": "1656079481000", "domain_id": null }, "Logon Type": {
    java.lang.IllegalStateException: Unable to commit transaction

    06:20:00.348 [Camel (camel-1) thread #13 - JmsConsumer[acks.%3E]] WARN [] com.co3.broker.GenericProcessor - GenericProcessor Exception on message
    org.camunda.bpm.engine.OptimisticLockingException: ENGINE-03005 Execution of 'UPDATE ExecutionEntity[e5162656-4087-11ed-b9b7-005056a8bf41]' failed. Entity was updated by another transaction concurrently.

    In UI I see only one reason:
    An error occurred while processing the action acknowledgement.

    ------------------------------
    Gule Fahid
    ------------------------------


  • 2.  RE: Issues after upgrade to 46.1.48

    Posted Wed October 12, 2022 06:59 AM
    Some extras related to error "An error occurred while processing the action acknowledgement".
    I have errors in /usr/share/co3/logs/client.log like this:

    10:37:42.434 [Camel (camel-1) thread #15 - JmsConsumer[acks.%3E]] ERROR [] com.co3.broker.AcknowledgementProcessor - Error processing message: { "message_type": 0, "message": "Completed", "complete": true, "results": { "qrhost": "1.1.1.1", "offenseid": "14828", "current_time": 1665571057000, "assets": [ { "id": "132923", "domain": { "id": "0", "name": "", "__typename": "Domain" }, "hostnames": [ { "id": "76865", "created": "1662232934000", "name": "test", "type": "DNS", "__typename": "AssetHostname" } ], "products": [ { "id": "402454", "productVariantId": 1, "__typename": "AssetProduct" }, { "id": "402455", "productVariantId": null, "__typename": "AssetProduct" }, { "id": "402453", "productVariantId": null, "__typename": "AssetProduct" }, { "id": "402450",
    java.lang.IllegalStateException: Unable to commit transaction
    at com.co3.jta.JtaTransactionImpl.doCommitTransaction(JtaTransactionImpl.java:205)
    at com.co3.jta.JtaTransactionImpl.commitTransaction(JtaTransactionImpl.java:151)
    at com.co3.context.DefaultCo3ContextImpl.commitTransaction(DefaultCo3ContextImpl.java:823)
    at com.co3.context.DefaultCo3ContextImpl.endTransaction(DefaultCo3ContextImpl.java:1480)
    at com.co3.context.DefaultCo3ContextImpl.endTransaction(DefaultCo3ContextImpl.java:1474)
    at com.co3.context.DefaultCo3ContextImpl.endTransaction(DefaultCo3ContextImpl.java:1464)
    at com.co3.broker.GenericProcessor.establishContextAndProcessMessage(GenericProcessor.java:100)
    at com.co3.broker.GenericProcessor.lambda$processMessageAndRetry$3(GenericProcessor.java:86)
    at com.co3.broker.GenericProcessor$$Lambda$1298/0x000000001c048ad0.run(Unknown Source)
    at net.jodah.failsafe.Functions.lambda$toSupplier$10(Functions.java:240)
    at net.jodah.failsafe.Functions$$Lambda$779/0x000000001c0264c0.get(Unknown Source)
    at net.jodah.failsafe.Functions.lambda$get$0(Functions.java:48)
    at net.jodah.failsafe.Functions$$Lambda$789/0x000000000c025cc0.get(Unknown Source)
    at net.jodah.failsafe.RetryPolicyExecutor.lambda$supply$0(RetryPolicyExecutor.java:62)
    at net.jodah.failsafe.RetryPolicyExecutor$$Lambda$794/0x00000000f8036f30.get(Unknown Source)
    at net.jodah.failsafe.FallbackExecutor.lambda$supply$0(FallbackExecutor.java:43)
    at net.jodah.failsafe.FallbackExecutor$$Lambda$798/0x000000000c027eb0.get(Unknown Source)
    at net.jodah.failsafe.Execution.executeSync(Execution.java:129)
    at net.jodah.failsafe.FailsafeExecutor.call(FailsafeExecutor.java:376)
    at net.jodah.failsafe.FailsafeExecutor.run(FailsafeExecutor.java:210)
    at com.co3.broker.GenericProcessor.processMessageAndRetry(GenericProcessor.java:86)
    at com.co3.broker.GenericProcessor.lambda$processMessage$4(GenericProcessor.java:219)
    at com.co3.broker.GenericProcessor$$Lambda$1293/0x000000001c035fe0.call(Unknown Source)
    at com.resilient.guice.ResilientGuiceUtils.lambda$callVoidInRequestScope$0(ResilientGuiceUtils.java:52)
    at com.resilient.guice.ResilientGuiceUtils$$Lambda$174/0x00000000d08de9a0.call(Unknown Source)
    at com.google.inject.servlet.ServletScopes$4.call(ServletScopes.java:450)
    at com.resilient.guice.ResilientGuiceUtils.callInRequestScope(ResilientGuiceUtils.java:73)
    at com.resilient.guice.ResilientGuiceUtils.callVoidInRequestScope(ResilientGuiceUtils.java:56)
    at com.co3.broker.GenericProcessor.processMessage(GenericProcessor.java:216)
    at com.co3.broker.GenericProcessor$GenericProcessorRoute.lambda$configure$0(GenericProcessor.java:206)
    at com.co3.broker.GenericProcessor$GenericProcessorRoute$$Lambda$523/0x00000000f90a3e00.process(Unknown Source)
    at org.apache.camel.processor.DelegateSyncProcessor.process(DelegateSyncProcessor.java:63)
    at org.apache.camel.processor.RedeliveryErrorHandler.process(RedeliveryErrorHandler.java:548)
    at org.apache.camel.processor.CamelInternalProcessor.process(CamelInternalProcessor.java:201)
    at org.apache.camel.processor.Pipeline.process(Pipeline.java:138)
    at org.apache.camel.processor.Pipeline.process(Pipeline.java:101)
    at org.apache.camel.processor.CamelInternalProcessor.process(CamelInternalProcessor.java:201)
    at org.apache.camel.component.jms.EndpointMessageListener.onMessage(EndpointMessageListener.java:124)
    at org.springframework.jms.listener.AbstractMessageListenerContainer.doInvokeListener(AbstractMessageListenerContainer.java:736)
    at org.springframework.jms.listener.AbstractMessageListenerContainer.invokeListener(AbstractMessageListenerContainer.java:696)
    at org.springframework.jms.listener.AbstractMessageListenerContainer.doExecuteListener(AbstractMessageListenerContainer.java:674)
    at org.springframework.jms.listener.AbstractPollingMessageListenerContainer.doReceiveAndExecute(AbstractPollingMessageListenerContainer.java:331)
    at org.springframework.jms.listener.AbstractPollingMessageListenerContainer.receiveAndExecute(AbstractPollingMessageListenerContainer.java:270)
    at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.invokeListener(DefaultMessageListenerContainer.java:1237)
    at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.executeOngoingLoop(DefaultMessageListenerContainer.java:1227)
    at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.run(DefaultMessageListenerContainer.java:1120)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.lang.Thread.run(Thread.java:830)
    Caused by: javax.transaction.RollbackException: The transaction was set to rollback only
    at com.atomikos.icatch.jta.TransactionImp.rethrowAsJtaRollbackException(TransactionImp.java:46)
    at com.atomikos.icatch.jta.TransactionImp.commit(TransactionImp.java:182)
    at com.atomikos.icatch.jta.TransactionManagerImp.commit(TransactionManagerImp.java:428)
    at com.atomikos.icatch.jta.UserTransactionImp.commit(UserTransactionImp.java:86)
    at com.co3.jta.JtaTransactionImpl.doCommitTransaction(JtaTransactionImpl.java:203)
    ... 48 common frames omitted
    Caused by: com.atomikos.icatch.RollbackException: The transaction was set to rollback only
    at com.atomikos.icatch.imp.TransactionStateHandler.commit(TransactionStateHandler.java:215)
    at com.atomikos.icatch.imp.CompositeTransactionImp.doCommit(CompositeTransactionImp.java:234)
    at com.atomikos.icatch.imp.CompositeTransactionImp.commit(CompositeTransactionImp.java:274)
    at com.atomikos.icatch.jta.TransactionImp.commit(TransactionImp.java:168)
    ... 51 common frames omitted



    ------------------------------
    Gule Fahid
    ------------------------------



  • 3.  RE: Issues after upgrade to 46.1.48

    Posted Thu October 27, 2022 09:27 AM
    Hello!
      I believe that you are encountering a problem that was hot-fxed in 46.1.49. Please take a look at IBM Security QRadar SOAR Release Download Locations to download.
    -P.J. McKenna

    ------------------------------
    Patrick (PJ) McKenna
    SOAR Development
    ------------------------------



  • 4.  RE: Issues after upgrade to 46.1.48

    Posted Mon October 31, 2022 05:33 AM