IBM Security QRadar

 View Only

  • 1.  QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    Posted Fri October 07, 2022 12:08 PM

    Today, after upgrading successful QRadar from 7.4.3FP6 to 7.4.3FP7 without any errors, the new UI Interface of QRadar Analyst Workflow 2.31.4 opens the tab with "internal server error". The App has status "running". Restarting successfully the app does not solve this issue. With FP6 the new Analyst Workflow UI worked as expected. Any ideas?

    Regards,

    Ralph



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    Posted Fri October 07, 2022 01:24 PM

    I just deleted the app and reinstalled it successfully. Unfortunately, that didn't fix the problem either. This seems to be a problem after the FP7 update. All other apps work as expected. Then there will hopefully be an update for the QRadar Analyst Workflow App soon :)

    Regards,

    Ralph



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    Posted Tue October 11, 2022 05:22 PM
    I had the same issue on 7.5.0 updatepackage 3.   After some digging in the app logs I found an error saying this directory was missing:

    /opt/app-root/app/public/static/locales/en_us 
    So I created a symlink from

    /opt/app-root/app/public/static/locales/en to /opt/app-root/app/public/static/locales/en_us and after a refresh of my browser tab the QAW app is working again.  This is a temp fix because when you stop and start the app this directory will be gone again probably.  

    You can try this on your own risk and is in no means an official or approved workaround. connect to your QaW app with

    /opt/qradar/support/recon connect <<appId>> which you can find with /opt/qradar/support/recon ps ( on the apphost when you have one)



    ------------------------------
    Erwin
    ------------------------------

    Original Message


  • 4.  RE: QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    IBM Champion
    Posted Tue October 11, 2022 08:24 PM
    Hi Erwin,

    thanks for this tricky hint :) This works for me as well and QAW is working again...
    In parallel i've created a support case to get a final solution regarding to an QAW update with a permanent fix :)


    Regards,
    Ralph

    ------------------------------
    Ralph Belfiore
    SIEM Expert
    pro4bizz GmbH
    Karlsruhe
    +4972190981727
    ------------------------------

    Original Message


  • 5.  RE: QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    Posted Tue October 11, 2022 09:09 PM
    If you sent me the case number I can keep an eye on it

    ------------------------------
    Erwin
    ------------------------------

    Original Message


  • 6.  RE: QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    IBM Champion
    Posted Wed October 12, 2022 02:06 AM
    TS010883962

    ------------------------------
    Ralph Belfiore
    SIEM Expert
    pro4bizz GmbH
    Karlsruhe
    +4972190981727
    ------------------------------

    Original Message


  • 7.  RE: QRadar Analyst Workflow 2.31.4 "Internal Server Error" after upgrade to 7.4.3FP7

    Posted Thu October 13, 2022 08:47 AM
    Edited by Portia Melita Fri October 21, 2022 10:27 AM

    Same issue here,  both with 7.4.3 und 7.5.0 -  TS010884953  and TS010825903



    ------------------------------
    SIEM-2020
    ------------------------------

    Original Message