Troubleshooting
Problem
The QRadar Rule Wizard shows an 'Application Error' when Creating or Editing a Rule.
Cause
Punctuation mistake in .xml file.
Environment
QRadar 7.4.x
Diagnosing The Problem
The qrader.error log contains the following error related to the Rule Wizard Component:
[tomcat.tomcat]/console/do/rulewizard] com.q1labs.uiframeworks.action.ExceptionHandler: [ERROR] [-/- -]An exception occurred while processing the request:
/console/do/rulewizard] javax.xml.bind.UnmarshalException
- with linked exception:
[org.xml.sax.SAXParseException: The content of elements must consist of well-formed character data or markup.]
The issue is caused by an invalid .xml file.Resolving The Problem
Check the file /opt/qradar/conf/templates/custom_alerts/alert-config.xml for recent changes.
Revert the changes or review the file and find the punctuation mistake
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtrAAA","label":"Rules"},{"code":"a8m0z000000cwtrAAA","label":"Rules"},{"code":"a8m0z000000cwtrAAA","label":"Rules"}],"ARM Case Number":"TS011460747","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.3"}]
Was this topic helpful?
Document Information
Modified date:
21 December 2022
UID
ibm16848495