Knowledge Search


×
 

[JSA] Network Activity Export fails with error "There was a problem completing your export. Please try again later."

  [KB35013] Show Article Properties


Summary:

When an export is performed in Juniper Secure Analytics (JSA) for the flows from the Network Activity tab for any time period other than real time, it might fail with the "There was a problem completing your export. Please try again later" error.

This article gives a workaround for the issue and also indicates the release in which the issue is resolved.

Symptoms:

Users may find that Network Activity Export is failing with the following error:

Further, the following error messages are found in /var/log/qradar.error:

[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6]
com.q1labs.ariel.ui.UIArielServices: [ERROR][NOT:0000003000][127.0.0.1/- -] [-/- -]Error performing ariel query
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] java.lang.NullPointerException
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.getSearchInfo(UIArielServices.java:6110)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3981)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3167)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3276)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.ariel.ui.UIArielServices.performQuery(UIArielServices.java:3148)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.getForcePayloadHandle(ExportJobProcessor.java:1602)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.export ArielSearch(ExportJobProcessor.java:1238)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.run(ExportJobProcessor.java:224)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] com.q1labs.core.ui.coreservices.export.ExportJobProcessor:
[ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]Error exporting data
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] java.lang.NullPointerException
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.getForcePayloadHandle(ExportJobProcessor.java:1605)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.exportArielSearch(ExportJobProcessor.java:1238)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.run(ExportJobProcessor.java:224)
[tomcat] [ExportJob-admin-88473e2c-d2ac-48cf-96e8-2d2a17857ab6] com.q1labs.core.ui.coreservices.export.ExportJobProcessor:
[ERROR] [NOT:0090003100][127.0.0.1/- -] [-/- -]The following error was encountered while performing a data export:java.lang.NullPointerException
at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.getForcePayloadHandle(ExportJobProcessor.java:1605) at
com.q1labs.core.ui.coreservices.export.ExportJobProcessor.export ArielSearch(ExportJobProcessor.java:1238)
at com.q1labs.core.ui.coreservices.export.ExportJobProcessor.run(ExportJobProcessor.java:224)
Cause:

The option “User Readable Search Audit Log Messages” was added under System Settings to support the “Operations” app, which was introduced in JSA 2014.8.r4 patch and later. The “User Readable Search Audit Log Messages” setting is enabled by default. The Operations app is used to view user activities and their impact on the overall system, and also to track user activities, offense details, searches, and other user information.

When an export is executed for searches specifically from the Network Activity tab, the functioning seems to be broken, resulting in the above error.

Solution:

This issue has been resolved in JSA 2014.8 patch 8 release and later.

Meanwhile, perform the following to fix the issue:

  1. Log in to the JSA WebUI.
  2. Navigate to Admin > System Settings > Switch to "Advanced."

  3. Set "User Readable Search Audit Log Messages" to "False."

  4. Click Save.

After saving the settings, perform a "Deploy Full Configuration" by using the Advanced drop-down menu.

Note: There will be service interruption during a Deploy Full Configuration until all required services return to normal function. Refer to KB34452 - [JSA] Understanding the impact of Deploy Full Configuration on events, flows, and offenses.

Related Links: