IBM QRadar

Something went wrong! Unknown error occured; see logs for more detail

Version of app is 1.0.2.

CLI logs from app:

UnicodeEncodeError: 'ascii' codec can't encode character u'\xf3' in position 6: ordinal not in range(128)

2021-05-07 00:10:45,347 [abstract_qpylib.log] [Thread-38581] [INFO] - 127.0.0.1 [APP_ID/1051][NOT:0000006000] Starting backup of network hierarchy

2021-05-07 00:10:45,347 [abstract_qpylib.log] [Thread-38581] [INFO] - 127.0.0.1 [APP_ID/1051][NOT:0000006000] Reading configuration file /store/config.json

2021-05-07 00:10:45,347 [abstract_qpylib.log] [Thread-38581] [ERROR] - 127.0.0.1 [APP_ID/1051][NOT:0000003000] Error reading configuration file /store/config.json; [Errno 2] No such file or directory: '/store/config.json'

Hi,

You can ignore the config error as this app works without any further configuration after installation.

Issue here is this one:

UnicodeEncodeError: 'ascii' codec can't encode character u'\xf3' in position 6: ordinal not in range(128)

There are characters in the description field of the QRadar network hierarchy which the app is not able to parse the character properly. This might need a fix from the dev side, but until then you can follow the below steps to fix it.

On the app.log file from the Network Hierarchy container, look for the line

Retreived network hierarchy ...

That line will have the entire network hierarchy entries in a single line. You might need to copy that line to another editor and search for this '\xf3' character and you should see that line in a particular description field. Then, go to Qradar Admin->Network Hierarchy and you need to find that particular description field under a group and remove this character (might look like a double space).

Use {group...name....description} from container log where you see the special characters to help you find the entry in Qradar network hierarchy window

After you save the network hierarchy, Perform deploy changes and it should backed up the NH successfully. If it fails, check log and if it complains with same error then repeat the process till you fix all of it.

Note: 📝 Don't put any customer sensitive data here and this is not a QRadar issue rather it's from the app side.

Thanks for the help, I was able to review the app.log file from the Network Hierarchy container, and I found the line with the wrong character on the Retreived network hierarchy.

To resolve I have modified the description of one of the groups and then saved and deploy policy.