IBM Support

QRadar: Users are being logged out due to inactivity

Troubleshooting


Problem

Users receive many timeout session in QRadar Web Console UI, even though user timeout settings is for 0.

Symptom

In Console's /var/log/httpd/ssl_access_log:

"GET /console/core/js/inactivityTimeout.js?version=-1921007956 HTTP/1.1" 200 1147
"GET /console/qradar/js/qradarWidgets/userManagement/nls/UserInactivityTimeoutnl.js HTTP/1.1" 200 262
"GET /console/core/js/inactivityTimeout.js?version=-1921007956 HTTP/1.1" 200 1147

Resolving The Problem

The Persistent Session Timeout setting can be found in:
  1. Admin tab
  2. Authentication:
    image-20240422101155-1
  3. General Authentication Settings:
    image-20240422101257-2
  4. Session Management:
    image-20240422101415-3
It is defined in days and sets the maximum allowable length of activity by a user on the console GUI. At the end of that duration, independent of user activity, QRadar® will forcefully log out the user.
This setting is different from the Inactivity Timeout because that timeout depends on the user's behavior. For more information, see QRadar: How to change the QRadar Console inactivity timeout setting for an individual user.
As an example, consider a console that has the Persistent Session Timeout set to 3 days and Inactivity Timeout set to 30 minutes. The user remains active for a long period and does not violate the Inactivity Timeout by constantly using the console GUI. However, since the Persistent Session Timeout is set, the user is forcefully logged off by the system after 3 days and needs to reauthenticate.
Additionally, you can set the global Inactivity Timeout, for the users that don’t have a personal timeout set, and updated the Login History > Login History Retention setting to avoid database growth and performance concerns.
image-20240422101518-4

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"TS015965911","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Document Information

Modified date:
22 April 2024

UID

ibm17149007

Page Feedback