QRadar: Application error message when opening events

Resolving The Problem

1. SSH into the QRadar Console as the root user.
2. It is always advisable to create a backup of the table to which we are going to apply the changes, therefore first run this command to generate the backup:

   ​pg_dump -U qradar -t ariel_aql_property > /store/tmp/ariel_aql_property.sql

3. Confirm which user is assigned to the problematic AQL property ID. Use the AQL property ID found in the original error from the /var/log/qradar.error file as the "id" value:

   psql -Uqradar -c "select username from ariel_aql_property where id='99555295-29ae-4c23-9ef6-6f7e8fc5d2c2';"

   You see an output with a username similar to this:

   ​username
   -----------
   QradarTest
   ​
4. After you identify the username, you must reassign the problematic AQL properties to the username admin.  Run the following update statement with the username (found in the previous step) in the "where" clause:

   psql -Uqradar -c "​update ariel_aql_property set username='admin' where username='QradarTest';"

5. After the update, a message "UPDATE 1" is displayed. This message means that the changes were successful.
   Important
   When you restart the QRadar web service, the QRadar UI is not available to all users. Any running event exports or reports stop. Administrators with strict outage or change management policies are advised to complete the next step during a scheduled maintenance window in compliance with their organization's policies.
6. Restart the hostcontext and tomcat services with the following commands:

   ​systemctl stop hostcontext
   systemctl restart tomcat
   systemctl start hostcontext