Description:
This explains how to enable the Change monitor in order to troubleshoot issues regarding security rule cache not updating.
Environments:
- Qlik Sense Enterprise for Windows February 2019 and later
Resolution:
The SecurityFilterCache relies on the change monitor. (Relying on notifications from postgres)
By activating trace logging (will be printed in the repository trace system log) there are possibilities to get more information about sent and received notifications. (Since it is both send and receive it is good to enable this on all the nodes)
Log in to the Qlik Sense server as the service account and run the following script in PowerShell to activate the change monitor trace (Update the user by a user that is RootAdmin and the server name to your server name) :
$body = ''
$hdrs = @{}
$hdrs.Add("X-Qlik-xrfkey","iX83QmNlvu87yyAB")
$hdrs.Add("X-Qlik-user","UserDirectory=DOMAIN;UserId=Administrator")
$url = "https://qlikserver1.domain.local:4242/qrs/internal/management/trace/activate?facility=ChangeMonitor&xrfkey=iX83QmNlvu87yyAB"
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My" | Where {$_.Subject -like '*QlikClient*'}
Invoke-RestMethod -Uri $url -Method Post -Body $body -ContentType 'application/json' -Headers $hdrs -Certificate $cert
The trace logging is deactivated with this request:
$body = ''
$hdrs = @{}
$hdrs.Add("X-Qlik-xrfkey","iX83QmNlvu87yyAB")
$hdrs.Add("X-Qlik-user","UserDirectory=DOMAIN;UserId=Administrator")
$url = "https://qlikserver1.domain.local:4242/qrs/internal/management/trace/deactivate?facility=ChangeMonitor&xrfkey=iX83QmNlvu87yyAB"
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My" | Where {$_.Subject -like '*QlikClient*'}
Invoke-RestMethod -Uri $url -Method Post -Body $body -ContentType 'application/json' -Headers $hdrs -Certificate $cert
(The trace logging is also deactivated automatically when the Repository service is restarted.)
Collect the Qlik Sense with the log collector and provide them to Qlik Support when the problem is occurring with these trace logs activated. This might give some more information on what is happening.
Example of output from the trace logs (Found in the Repository Trace System logs):
TRACE ChangeMonitor: Sending change notification over PostgreSQL EntityChangeChannel; [Add] SystemRule, impactSecurityAccess: True, isHandledType: True, payload: {"changeid":"305e2003-e187-4c68-a5e0-5f467f45f8cf","changetype":1,"entitytype":"SystemRule","entityid":"06bd4ca5-8d6c-4ab2-959a-6e479bd56bd8","entitycreateddate":"2019-11-27T12:57:57.5738719Z","entitymodifieddate":"2019-11-27T12:57:57.5738719Z","entityimpactsecurityaccess":true,"entitypropertyvalues":{},"changedproperties":["id","createdDate","modifiedDate","modifiedByUserName","category","type","name","rule","resourceFilter","actions","disabled","seedId","version"],"time":"2019-11-27T12:57:57.5808698Z","senderid":"28e9c4db-7aa2-4cfb-97e5-75164cdc8745","originatornodeid":"c6fa1cba-b971-461b-aa70-8ce140d7ca24","originatorhostname":"selun-ext_bnd.qliktech.com"}
TRACE ChangeMonitor: Sending notification on EntityChangeChannel; payloadLength: 905, connectionState: Open, payload: %7b%22changeid%22%3a%22305e2003-e187-4c68-a5e0-5f467f45f8cf%22%2c%22changetype%22%3a1%2c%22entitytype%22%3a%22SystemRule%22%2c%22entityid%22%3a%2206bd4ca5-8d6c-4ab2-959a-6e479bd56bd8%22%2c%22entitycreateddate%22%3a%222019-11-27T12%3a57%3a57.5738719Z%22%2c%22entitymodifieddate%22%3a%222019-11-27T12%3a57%3a57.5738719Z%22%2c%22entityimpactsecurityaccess%22%3atrue%2c%22entitypropertyvalues%22%3a%7b%7d%2c%22changedproperties%22%3a%5b%22id%22%2c%22createdDate%22%2c%22modifiedDate%22%2c%22modifiedByUserName%22%2c%22category%22%2c%22type%22%2c%22name%22%2c%22rule%22%2c%22resourceFilter%22%2c%22actions%22%2c%22disabled%22%2c%22seedId%22%2c%22version%22%5d%2c%22time%22%3a%222019-11-27T12%3a57%3a57.5808698Z%22%2c%22senderid%22%3a%2228e9c4db-7aa2-4cfb-97e5-75164cdc8745%22%2c%22originatornodeid%22%3a%22c6fa1cba-b971-461b-aa70-8ce140d7ca24%22%2c%22originatorhostname%22%3a%22selun-ext_bnd.qliktech.com%22%7d
