Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[JSA] Network Activity Export fails with error "There was a problem completing your export. Please try again later."

0

0

Article ID: KB35013 KB Last Updated: 11 Sep 2019Version: 1.0
Summary:

When an export is performed in Juniper Secure Analytics (JSA) for the flows from the Network Activity tab for any time period other than real time, it might fail with the "There was a problem completing your export. Please try again later" error.

This article gives a workaround for the issue and also indicates the release in which the issue is resolved.

Symptoms:

Users may find that Network Activity Export is failing with the following error:

Further, the following error messages are found in /var/log/qradar.error:

[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6]
com.q1labs.ariel.ui.UIArielServices: [ERROR][NOT:0000003000][127.0.0.1/- -] [-/- -]Error performing ariel query
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] java.lang.NullPointerException
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.getSearchInfo(UIArielServices.java:6110)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3981)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3167)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3276)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3148)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.getForcePayloadHandle(ExportJobProcessor.java:1602)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.export ArielSearch(ExportJobProcessor.java:1238)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.run(ExportJobProcessor.java:224)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] com.q1labs.core.ui.coreservices.export.ExportJobProcessor:
[ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]Error exporting data
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] java.lang.NullPointerException
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.getForcePayloadHandle(ExportJobProcessor.java:1605)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.exportArielSearch(ExportJobProcessor.java:1238)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.run(ExportJobProcessor.java:224)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] com.q1labs.core.ui.coreservices.export.ExportJobProcessor:
[ERROR] [NOT:0090003100][127.0.0.1/- -] [-/- -]The following error was encountered while performing a data export:java.lang.NullPointerException
at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.getForcePayloadHandle(ExportJobProcessor.java:1605) at
com.q1labs.core.ui.coreservices.export.ExportJobProcessor.export ArielSearch(ExportJobProcessor.java:1238)
at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.run(ExportJobProcessor.java:224)
Cause:

The option “User Readable Search Audit Log Messages” was added under System Settings to support the “Operations” app, which was introduced in JSA 2014.8.r4 patch and later. The “User Readable Search Audit Log Messages” setting is enabled by default. The Operations app is used to view user activities and their impact on the overall system, and also to track user activities, offense details, searches, and other user information.

When an export is executed for searches specifically from the Network Activity tab, the functioning seems to be broken, resulting in the above error.

Solution:

This issue has been resolved in JSA 2014.8 patch 8 release and later.

Meanwhile, perform the following to fix the issue:

  1. Log in to the JSA WebUI.
  2. Navigate to Admin > System Settings > Switch to "Advanced."

  3. Set "User Readable Search Audit Log Messages" to "False."

  4. Click Save.

After saving the settings, perform a "Deploy Full Configuration" by using the Advanced drop-down menu.

Note: There will be service interruption during a Deploy Full Configuration until all required services return to normal function. Refer to KB34452 - [JSA] Understanding the impact of Deploy Full Configuration on events, flows, and offenses.

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search