Troubleshooting
Problem
Log activity events can be exported into either xml or csv format in the user interface. However, QRadar can run one export at a time, and all other exported are queued. The queued exported are executed by QRadar in the order that they are submitted.
The user can opt to be notified by email when their specific export completes. However, there is no indication in the UI of which export is running.
The following data can assist with troubleshooting which export is active, which are queued, and when they are complete.
Symptom
![There is already an export running image](/support/pages/system/files/inline-images/image-20230913224628-6.png)
Cause
Diagnosing The Problem
The files and directories on the QRadar console that contain information about the export events are:
- /var/log/qradar.log
- /var/log/audit/audit log
- /store/exports
- Use the following Linux command to search for entries in audit.log that pinpoint when an export is initialized from the UI. The following example command is a search specifically for "Full Export|Visible Columns" exports:
grep -iE "Full Export|Visible Columns" /var/log/audit/audit.log|grep -v grep
Jul 13 18:45:39 admin@x.x.x.x (5753) /console/JSON-RPC/QRadar.auditMenuItemSelected QRadar.auditMenuItemSelected | [Action] [AuditLogs] [AuditStarted] Selected Menu Item : Full Export (All Columns) by | Username : admin | Security ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Jul 13 19:17:40 user1@x.x.x.x (8058) /console/JSON-RPC/QRadar.auditMenuItemSelected QRadar.auditMenuItemSelected | [Action] [AuditLogs] [AuditStarted] Selected Menu Item : Full Export (All Columns) by | Username : user1 | Security ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Jul 13 19:49:36 user2@x.x.x.x (8184) /console/JSON-RPC/QRadar.auditMenuItemSelected QRadar.auditMenuItemSelected | [Action] [AuditLogs] [AuditStarted] Selected Menu Item : Full Export (All Columns) by | Username : user2 | Security ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- To identify the current export file that is being written and also the files for the queued exports use the command:
ls -ltr /store/exports
-rw-r--r-- 1 nobody nobody 0 Jul 13 19:17 user116892908525672030791404275189805.zip
-rw-r--r-- 1 nobody nobody 0 Jul 13 19:49 user216892909000217755202499081823793.zip
-rw-r--r-- 1 nobody nobody 274770734 Jul 13 19:28 admin16892908252664454563789275095125.zip
- Entry from qradar.log when starting an export:
Jul 13 19:47:05 [tomcat.tomcat] [ExportJob-admin-4abee769-3312-44e2-bd45-4aadbb4ba65c] com.q1labs.core.ui.coreservices.export.ExportJobProcessor: [INFO] [NOT:0000006000]Initiating EventViewer data export requested by admin, job is assigned id 4abee769-3312-44e2-bd45-4aadbb4ba65c
- Entry from qradar.log when clicking the “Notify when done” button:
Jul 13 19:49:24 [tomcat.tomcat] [admin@x.x.x.x (1561) /console/JSON-RPC/QRadar.backgroundExportJob QRadar.backgroundExportJob] com.q1labs.core.ui.coreservices.export.ExportJob: [INFO] [NOT:0000006000]Backgrounding export job 4abee769-3312-44e2-bd45-4aadbb4ba65c for user admin
- Entry from qradar.log when export completes:
Jul 13 20:09:59 [tomcat.tomcat] [ExportJob-admin-d761f42c-13a0-4088-b6d7-a742e475bbfe] com.q1labs.core.ui.coreservices.export.ExportJobProcessor: [INFO] [NOT:0000006000]Export job d761f42c-13a0-4088-b6d7-a742e475bbfe for user admin is complete
Resolving The Problem
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
03 November 2023
UID
ibm17012041