IBM Support

QRadar: Error "There was a problem queuing your export job" when exporting search results

Troubleshooting


Problem

In the Log Activity, this error message is displayed at the end of the search result export:
"There was a problem queuing your export job. Please see the system log for details"
image-20220328172428-1

Diagnosing The Problem

This error happens due to incorrect permissions, user owner, and (or) group owner on the folder configured for the exports, the default folder is /store/exports/.
These errors are found in the /var/log/qrada.error file:
/console/JSON-RPC/QRadar.queueExportJob] com.q1labs.core.ui.coreservices.export.ExportJob: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]Failed to create temporary file for export. Cannot continue with this export job.
/console/JSON-RPC/QRadar.queueExportJob] java.io.IOException: Permission denied
/console/JSON-RPC/QRadar.queueExportJob] java.io.IOException: Failed to create temporary file for export. Cannot continue with this export job.

Resolving The Problem

  1. Confirm the folder configured for the exports.
    Go the Admin tab, click System Settings, search for Log and Network Activity Data Export Temporary Directory field, the default folder is /store/export but you can use another one.
  2. From the CLI, check the settings for the file by using the next command: 
    ls -ld  <exports folder>
    •  The user owner must be: nobody
    •  The group owner must be: nobody
    •  Permissions must be:
        User and group: read, write, and execute.
        Others: read and execute.
     •  This capture shows an example of right permissions:
    image-20220509152851-5
  3. Correct the folder permissions where needed:
    Note: If the folder is different from /store/export, change the folder in the command.
    a. If the user or the group (or both) are different, run this command in the QRadar console: 
    chown nobody:nobody /store/export
    b. In case the permissions of the folder are incorrect, run this command in the QRadar console: 
    chmod 775 /store/exports/
Result:
After these changes, the user is able to export the search result without any problem. If the error persists contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
26 May 2022

UID

ibm16567123

Page Feedback