Knowledge Search


×
 

[JSA] Log activity error: “There was a problem connecting to the query server. Please try again later.”

  [KB34618] Show Article Properties


Summary:

This article explains how to troubleshoot the error message "There was a problem connecting to the query server. Please try again later” on the Log Activity tab of the Juniper Secure Analytics WebUI and the qradar.log error "ariel_proxy_server has been manually stopped."

Symptoms:

The following log activity error is output:

When trying to restart the failed service, it fails with the following error:

# systemctl start ariel_proxy_server
Job for ariel_proxy_server.service failed because the control process exited with error code. See "systemctl status ariel_proxy_server.service" and "journalctl -xe" for details.

qradar.log shows the following messages:

May 15 02:28:42 ::ffff:10.228.120.221 [hostcontext.hostcontext] [ProcessMonitor] com.q1labs.hostcontext.processmonitor.ProcessManager: [ERROR] [NOT:0150114103][10.228.120.221/- -] [-/- -]Process ariel_proxy_server.ariel_proxy has failed to start for 14496 intervals. Continuing to try to start...
May 15 02:28:42 ::ffff:10.228.120.221 [hostcontext.hostcontext] [ProcessMonitor] com.q1labs.hostcontext.processmonitor.ProcessManager: [INFO] [NOT:0000006000][10.228.120.221/- -] [-/- -]Starting process ariel_proxy_server.ariel_proxy
May 15 02:28:42 jsa-cons2 ariel_proxy_server[22976]: ariel_proxy_server has been manually stopped.

The above error message points to the service being manually stopped and not able to start on its own.

Solution:

First, check the status of ariel-proxy_server.service. In this case, it might show as below:

# systemctl status ariel_proxy_server
ariel_proxy_server.service - Ariel Proxy Server
Loaded: loaded (/usr/lib/systemd/system/ariel_proxy_server.service; static; vendor preset: disabled)
Drop-In: /etc/systemd/system/ariel_proxy_server.service.d
mqulimit.conf
Active: failed (Result: exit-code) since Wed 2019-05-15 01:34:09 GMT; 54s ago
Process: 14113 ExecStartPre=/opt/qradar/systemd/bin/generate_environment.sh ariel_proxy_server ariel_proxy (code=exited, status=255)
Main PID: 29402 (code=exited, status=143)

Then to resolve this issue, perform the following steps:

  1. Check the allocated RAM and increase it (in case of vJSA) if it is below the recommended value.
  2. Check for ariel_proxy_server*manually_stopped files under /storetmp/ and delete them.

  3. After the files have been deleted, restart the service:
systemctl restart ariel_proxy_server

Note: Restarting the affected service will not have any impact because the service is currently unable to work as expected.

If the above workaround does not resolve the issue, contact Support for further assistance.

Related Links: