Flashes (Alerts)
Abstract
Administrators who have installed the QRadar Weekly Auto Update for Friday June 15, 2018 might experience an issue where the user interface is unavailable until Tomcat is restarted from the command-line interface.
Content
Urgency
IMPORTANT: Administrators who have installed the QRadar weekly auto update published on Friday, June 15th, 2018 can experience a user interface connection issue after the installation completes. Administrators using QRadar 7.2.x and 7.3.x who experience the user interface access issue can restart Tomcat from the Console's command-line interface to restore connectivity.
How to Identify the Issue
Administrators can identify this issue as they are unable to access the user interface for the Console and the following error message is displayed in /var/log/qradar.log:
tomcat[32125]: 16-Jun-2018 11:19:42.061 WARNING [HttpServletRequest-7396-Idle]org.apache.catalina.authenticator.FormAuthenticator.forwardToLoginPage Unexpected error forwarding to login page
tomcat[32125]: javax.servlet.ServletException: javax.xml.parsers. FactoryConfigurationError: Provider javax.xml.parsers.DocumentBuilderFactory could not be instantiated: java.lang.IllegalStateException: java.io.FileNotFoundException: /opt/qradar/webapps/console/WEB-INF/lib/azure-storage-5.5.0.jar (No such file or directory)
tomcat[32125]: at org.apache.jasper.servlet.JspServlet.service (JspServlet.java:338)
tomcat[32125]: at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
tomcat[32125]: at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
Workaround
Administrators who experience this issue can restart Tomcat from the command-line interface on the Console appliance to resolve the issue.
Procedure
- Using SSH, log in to the Console as the root user.
- To restart Tomcat, select the command for your QRadar version:
For QRadar 7.3.x, type: systemctl restart tomcat
For QRadar 7.2.x, type: service tomcat restart
Results
It will take several minutes for the Web Server (Tomcat) to restart on the Console. After the service restart completes, access is restored for users to the QRadar Console.
We are currently taking steps to remove the affected Weekly Auto Update from the servers while we investigate the root cause and apologize for any inconvenience.
Where do you find more information?
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Admin Console","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1;7.3;7.2.8;7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
26 September 2022
UID
swg22017414