To eliminate the chance that AntiVirus, AntiMalware, and other security-related software cause corruption or lock up files in the Qlik environment, or cause issues during an installation/upgrade/patch, some folders should be excluded from live scanning.

Impact of AntiVirus/Endpoint Detection and Response (EDR)/Advanced Threat Protection (ATP) scans locking Qlik related files (such as .qvw files, binary Qlik Sense app files as well as NPrinting task files, etc...) can result in loading and refresh failures as well as performance issues.

Please note that usual anti-virus exclusions might not apply to the EDR and ATP setup, talk to the solution vendor to get the exclusions in place. As an example if you use Microsofts Advanced Threat Protection (Microsoft Defender for Endpoint), then the exclusion list is handled by Microsoft and you need to open a ticket with Microsoft to get an exclusion in place.

If Crowdstrike Antivirus monitoring is installed on any Qlik Server

1. Start a support case with crowdstrike support
2. Enable 'bypass mode' for any Qlik programs including
   1. ALL nodes in a cluster
   2. Postgres
   3. Storage Server
3. Then retest any reported issues with 'bypass mode' enabled

Qlik Sense Enterprise all versions

Antivirus exceptions for Qlik Sense- McAfee, Symantec & Other Anti-Virus exclusions absolutely required
Qlik Sense Folder And Files To Exclude From AntiVirus Scanning

You can obtain a list of exclusions to use with your EDR or ATP system by running the following script: 

$Scanfolders = @("C:\Program Files\Common Files\Qlik","C:\Program Files\Qlik","C:\ProgramData\Qlik")

Foreach ($i in $Scanfolders)

{
  Get-ChildItem -Path $i -Recurse -Include "*.exe" | % {Get-FileHash $_.FullName -Algorithm  MD5} | Out-File C:\temp\exclusion_findings.txt -Append -Width 1000
}

This script was uses Qlik Sense Enterprise on Windows as an example. Replace the defined folders, such as C:\Program Files\Qlik, should they not apply for the product you are using.

In addition, if you need to use a different hash than MD5, replace it by any of the available values:

• SHA1
• SHA256
• SHA384
• SHA512
• MD5

For generic information not necessarily related to Advanced Threat Prevention, see:

QlikView all versions

QlikView Folder And Files To Exclude From Anti-Virus Scanning

Qlik Replicate and Qlik Enterprise Manager

Qlik Replicate and Qlik Enterprise Manager directory to exclude from Anti-Virus scanning  

NPrinting 17 and newer

NPrinting Server and NP Designer Anti Virus Folder Exclusions

Qlik Alerting

Qlik Alerting Anti Virus Folder Exclusion

Antivirus TroubleShooting and Upgrade

Troubleshooting your upgrade 

• A Service Account Owner (SAO) is the only user who has admin rights to manage Qlik Sense Enterprise SaaS and Qlik Sense Business subscriptions on my Qlik portal (e.g. subscribe, renew, upgrade/downgrade number of users, access to personal information, and subscription details, payment details and invoices).

Relevant resources:

How to Access My Qlik Portal
Managing Your Subscription in My Qlik

Who is the default Service Account Owner?

• For subscriptions purchased through Qlik Sales or via a Qlik Partner:
  The default Service Account Owner is the Sold To contact email address on the quote linked to your purchased order. If you don’t know who the Sold To is, please reach out to your dedicated Qlik Sales Representative or Qlik Partner.
   
• For subscriptions purchased directly from My Qlik portal:
  The default Service Account Owner is the email address linked to the Qlik Account you have used to purchase your subscription online on my Qlik Portal. If you can’t remember the email address linked to your Qlik Account, see How to create a case to contact Qlik Support.

Is the Service Account Owner also the Tenant Admin?

• The Service Account Owner is the Tenant Admin by default. One exception is if the Tenant Admin was already changed in the past to someone else (see: Managing tenant admins).

Can I change the Service Account Owner?

• Yes, you can change the Service Account Owner(SAO) associated with your purchased subscription.

How to change the Service Account Owner (SAO)?

• The change is a manual process and requires you to contact Qlik Support (see How to contact Qlik Support). When raising such a request, please make sure to provide the below information:
  
  
  • Reason for change
  • Old email/New email
  • Subscription ID/License key
  • Tenant URL

Please do the following before requesting the change:

• Advise NEW SAO to register for a Qlik account
• Advise NEW SAO to log in at least once to  myqlik.qlik.com/portal
• Advise OLD SAO to transfer the Tenant admin rights to NEW SAO

When changing the Service Account Owner, does the Tenant Admin automatically change?

• No, the Tenant Admin will not change. If a change of Tenant Admin is needed, the current Tenant Admin will need to invite the new Tenant Admin and give him/her Tenant Admin Role in the Management Console. It is always recommended but not a requirement to assign two Tenant Admins per subscription. If one Tenant Admin leaves the company, the other one will still be able to administrate the tenant. If there is only one Tenant Admin who has left the company, please contact Qlik Support for further assistance (see How to contact Qlik Support)
  
  Additional Note:
  
  If the old Tenant Admin stored apps in his/her personal space, it is important for the new Tenant Admin to do either (a) or (b):
  1. Update who is the apps’ owner (See Changing app owners Changing app owners)
  2. Publish and share apps on a shared space (See Working in shared spaces)

Areas that are particularly sensitive when you remove a user:

• All private content on published apps will be lost. There is no API method to transfer ownership
• The connections created by the OLD SAO will be deleted and this will have to be recreated.
  • All data connections with credentials. These will all need to have their credentials updated once the data connection ownership is transferred

How to change the Tenant Admin?

Does the Tenant Admin need to consume a Professional or Analyzer user?

Qlik Sense allows for Data Encryption for Qlik Sense Apps (QVF) and Data (QVD) Files.

Qlik Sense Engine can encrypt data by using a data encryption key (DEK), which is generated from a certificate-based key encryption key (KEK). The DEK is unique to each encrypted file and is stored alongside the encrypted data (inside the QVF and QVD files) in an encrypted format using RSA. The industry standard AES-256 GCM is used as the data encryption algorithm. Decryption requires access to the same certificate as used during encryption, which mean that the KEK certificate thumbprint in the certificate store must match the thumbprint used for the DEK generation. 

Instructions

Data encryption can be enabled in the Service Cluster configuration of the Qlik Sense Management Console. See the Online Help at Qlik Sense Enterprise on Windows > Administer Qlik Sense Enterprise on Windows > Managing a Qlik Sense Enterprise on Windows site > QMC resources overview > Service cluster > Data encryption

Detailed Instructions with Example

This is a simple example of how to explore data encryption in Qlik Sense Enterprise on Windows.  

1. Create a new sample app, like the attached ascii-table.qvf
   1. Add a simple script to generate an ASCII table

      ASCII:
      Load
       if(RecNo()>=65 and RecNo()<=90,RecNo()-64) as Num,
       Chr(RecNo()) as AsciiAlpha,
       RecNo() as AsciiNum
      autogenerate 255
       Where (RecNo()>=32 and RecNo()<=126) or RecNo()>=160 ;

   2. Create a folder connection to a folder where the QVD can be written
   3. Generate QVD of a data table. Note, change the lib:// reference to match a valid data connection

      STORE ASCII INTO [lib://MyData (domain_administrator)/ascii.qvd] (QVD);

2. Reload the app
3. Copy the app and qvd files to allow comparison after enabling encryption 
   1. Default app location: C:\ProgramData\Qlik\Sense\Apps 
   2. The QVD location is per the app's folder data connection path
4. Create a certificate to test, following Encryption Certificates.
   1. Run Powershell as the Qlik Sense service account or log in to Windows as the Qlik Sense service account.
      
      

      Doing this with the correct account is crucial to make the generated certificate available to the service account.

      
      
      
   2. Generate a self-signed certificate to use as an encryption key
      
      Windows Server 2016
      
      

      New-SelfSignedCertificate -Subject "QlikSenseDataEncrytion" `
                                -KeyAlgorithm RSA `
                                -KeyLength 4096 `
                                -Provider "Microsoft Software Key Storage Provider" `
                                -KeyExportPolicy ExportableEncrypted `
                                -CertStoreLocation "cert:\CurrentUser\My"

      
      Windows Server 2012 R2
      
      

      New-SelfSignedCertificate -DnsName "QlikSenseDataEncrytion" `
                                -CertStoreLocation "cert:\CurrentUser\My"
      

   3. Validate that cert is available 
5. Get the cert thumbprint from generation result. This thumbprint can be used as key-encryption key (KEK) by Qlik Sense. 
   
   
   
   Note: When copying the certificate thumbprint, an invisible character may be added at the beginning of the certificate thumbprint. Verify the thumbprint before executing the command in PowerShell:
   
   
   
   
6. Enable encryption in Service Cluster settings per Data Encryption
   
   
   
   
7. Restart Qlik Sense Engine service
8. Reload the app to generate data encryption keys (DEK) for encrypted QVF and QVD files. 
   
   

Disable Encryption

Files remain encrypted after disabling encryption until the next following app reload or QVD generation. 

1. Disable encryption in QMC > Service Cluster
   1. Uncheck both encryption options
   2. Remove encryption key
      
2. Restart Qlik Sense Engine Service on all nodes
3. Complete a full successful app reload cycle, including QVD generators
   1. All QVF files have been decrypted
   2. All QVD files have been decrypted
      
      

File Comparison

Compare the unencrypted and encrypted files to validate successful encryption

Qlik Sense app (.qvf) file is a binary file, which makes it harder to visually confirm the encryption effect.

Encrypted app files have multiple references to ciphertext, which in turn refers to secrets used for the encryption.

App file without encryption has no such references. The cypher text portion of QVF represents the data encryption key (DEK) used to encrypt the app data and bookmarks. 

Encrypted data (.qvd) files has "Encryption Info" defined, which includes the data encryption (DEK) references.
Data part is also significantly different, even though both version have exactly the same static data content. 

Encryption Scope

• Encryption only applies at rest, meaning when stored on disk.  
• Data in memory is not encrypted
• Exported app (QVF) file is not encrypted
• Encrypted file (from apps storage folder) can not be imported in an other Qlik Sense instance.
  The import fails as the importing server is unable to parse the encrypted file. 
  
  

Related Content:

Qlik Sense on Windows: Data Encryption Key Rotation
Using Server Certificates for Data Encryption

The purpose of this article is to provide details about enabling Full Load Passthru filter in Qlik Cloud Data Integration (QCDI) and get the selected data from the source during the initial load of the Landing or Replication Tasks.

Enable Passthrough filter in the Qlik Data Movement Gateway  server configuration

1. Navigate to the path /opt/qlik/gateway/movement/bin on the Qlik Data Movement Gateway Linux server
2. Edit the file repctl.cfg
3. Set the parameter enable_passthrough_filter to true and save the file
4. Restart the Gateway server using the service repagent restart command

Build the filter in the Qlik Cloud Data Integration tenant

1. Log in to our QCDI tenant
2. Open the Landing Task in the project.
3. Click on the filter button (top right corner above the table details)
   
   
   
   Syntax:
   
   --filter: filter_condition
   
   Example One:
   
   --filter: id > 2
   
   
   
   Example Two:
   
   --filter: id between 1 and 2
   
   
   
   
4. We can add any valid condition using the syntax supported by the source Database and the tool internally constructs the select statement using the condition to filter the data from the source.
5. Once the filter is added, prepare the landing task and then do a Reload of the table to validate the results
6. Please note that the filter is at the table level and every table can have its own filter condition for a column specific to that table.

The information in this article is provided as-is and will be used at your discretion. Depending on the tool(s) used, customization(s), and/or other factors, ongoing support on the solution below may not be provided by Qlik Support.

Environment

• Qlik Cloud Data Integration

With the new inclusion of the Get Chart Image block in the Qlik Reporting connector in Qlik Application Automation, you now have more options to notify a group of users with more in-depth data and charts using Slack, Microsoft Teams, and email.

This article will guide you in sending your first chart image to Slack with Qlik Application Automation.

It explains a basic example of a template configured in Qlik Application Automation for this scenario.

You can make use of the template which is available in the template picker. You can find it by navigating to Add new -> New automation -> Search templates and searching for 'Send a Chart Image to Slack' or 'Embed a chart image in an email' in the search bar, and clicking the Use template option.

For guidance on sending charts via Microsoft Teams and mail, go to the "Next Steps" section at the end of this article.

You can download examples of the automations from this article: Send-chart-image-to-slack.json, Send-chart-image-to-outlook.json, Send-chart-image-to-mail.json, Send-chart-image-to-microsoft-teams.json

Full Automation

Configure the Automation

1. Open the automation editor and search for the Qlik Cloud Services connector on the left-hand menu.
   
   
2. Drag the blocks “Select Field Value” and “Create Bookmark” to the canvas and fill in the required inputs. You can add multiple Select Field Value blocks to apply selections to various fields. The Create Bookmark block is then used to create a temporary bookmark that can pass the selections to the Get Chart Image block.
   
   
   
   
   
   
   

   Warning: Whenever the “Get Chart Image” block is to be used, we advise you to only use it with temporary bookmarks or pre-existing persistent bookmarks.

2. Search for the Qlik Reporting connector on the left-side menu, then drag the "Get Chart Image" block to the editor and attach it below the previous block.
   
   Choose the same app you chose when creating the temporary bookmark and use the ID value received from the “Create Bookmark” block. 
   
   
   
   The height and width inputs are not required and default to 1000 if the fields are empty.
   
   Manually insert the Object ID input; it can not yet be retrieved through an API call.
   
   To find the chart ID from the app, open the app, then click Edit Sheet, right-click the chart, and open the Share/Embed menu from the menu dropdown that appears. You will see the object ID of the chart under the chart preview section as shown below:
   
   
   

    

3. Add the 'Condition' block to check whether the "Get Chart Image" block has returned a successful response.
   
   
   
   
   1. If the condition block outcome evaluates to true:
      
      
      • Search for Slack connector from the left-side menu, add the "Upload File To Channel" block, and fill in all the required inputs.
        
        
        
        
      • The chart image gets posted on the Slack channel as shown below:
        
        
         

   2.  If the condition block outcome evaluates to false:

      • Add the "Update Run Title" block to specify that the "Get Chart Image" block failed due to an error.
        
        
        
        
      • Add an "Error" block to throw an error message from the "Get Chart Image" block and set the current automation run to be in a failed state.
        
        
        

Configure and send the Output

Embed the chart in the email

1. To embed the image in an email, you'll need to replace the Slack block with Send Mail block from the Microsoft Outlook 365 connector or the Send Mail block from the Mail connector and configure the block's Type parameter to HTML.
2. In the body of the HTML, start adding a <img> tag and set the src parameter of the img tag to "data&colon;image/png;base64,".
   

   
   

3. Add the Get Chart Image block output at the end of the src parameter.
   

   
   

4. Click the Get Chart Image label in the input parameter, and pick the Add formula option; then search for the "base64 encode" formula to apply it to the output from the Get Chart Image block.
   
   
   
   
   

   
   

5. Finalize the img tag with an optional width and height to style the image.
   
   

Send the chart to a channel in Microsoft Teams

1. To send the image to Microsoft Teams, replace the Slack block with the Send Html Message With Base 64 Image block from the Microsoft Teams connector.
2. Configure the "Base 64" parameter of the block by mapping it to the output of the Get Chart Image block.
   

   
   

3. Click the field mapping for the Get Chart Image again and open the formula picker. Search for the base64 encode formula and apply it.
   
   
   
   
    
4. Set the Image Content Type parameter to image/png and (optionally) provide additional HTML content that will be inserted before or after the image.
   

   
   

The information in this article is provided as-is and will be used at your discretion. Depending on the tool(s) used, customization(s), and/or other factors, ongoing support on the solution below may not be provided by Qlik Support.

Environment

• Qlik Cloud 
• Qlik Application Automation 

Related Content

• Distributing Chart Images through Automation

The Qlik Replicate console no longer displays correctly after an upgrade (for example: moving from November 2022 to November 2023).

The user interface may only show an empty menu bar and otherwise remain blank:

Resolution

Update the currently used browser. See Supported browsers.

Example situation:

• Currently installed Chrome version: 72.0.3626.121
• Recommended version (at the time of writing this article): 129.0.6668.60

Cause

Incompatible browser version. 

Environment

• Qlik Replicate

Activating a Qlik GeoAnalytics license using the license tool may display the following warning:

The type initializer for 'Qlik.Sense.Lef.LefParser' threw an exception.

Only LEF licenses are affected. Signed key license keys will apply without a warning.

Resolution

This warning does not affect any functionality. It refers to an additional check failing, but still applies the license as expected. The warning can be safely ignored. 

Cause

The defect QB-29901 is, as of the writing of this article, still under investigation. 

Internal Investigation ID(s)

QB-29901

Environment

• Qlik Geo Analytics

While using Server Side Extensions (SSE) or Analytic connections in Qlik Sense, the error Failed to initialize gRPC communication for SSEPlugin is logged

This issue can be identified by reviewing the Qlik Sense Engine logs (How To Collect Log Files From Qlik Sense Enterprise on Windows). They will read:

Failed to initialize gRPC communication for SSEPlugin Python_S3.GenerateSecret

In this message, Python_S3.GenerateSecret is the plugin name.

Resolution

This error means that Qlik Sense could not connect to your Server Side Extension. The root cause is most frequently found in network connectivity. Possible troubleshooting steps to identify the network error are:

• Check the port communication from the Qlik Sense server to the SSE and from the SSE back to the Qlik Sense server. See How To Check Open Ports Using PowerShell.
• Verify if a 3rd-party network appliance (such as a load balancer) is part of the network communication between Sense and the SSE plugin; try testing locally on the Qlik Sense Server to remove this factor.
• In a multi-node installation, verify if this happens from all nodes or only the central node, and verify communication between the rim and central nodes.
• If all the above return good results, test with one of the example SSE plugins to see if the issue persists with the example or if it only occurs with your SSE plugin (to verify if your plugin may be the issue). Precompiled versions of the plugin are available in the Releases section of the repository, but please note that these are not officially supported.

Qlik does not support the configuration or implementation of non-Qlik or Operating System-related software.

Debugging or writing custom code is supported by the Qlik Professional Services or Presales teams. No Support or maintenance is implied or provided. Further customization is expected to be necessary and it is the responsibility of the end administrator to test and implement their custom code for their specific use case.

Related Content

Qlik Server-Side Extension (SSE) with Analytic Connections

Environment

• Qlik Sense Enterprise on Windows 

With Microsoft and Google terminating support for Basic Authentication, Qlik suggests using a dedicated tool (such as Sendgrid, Mailchimp, or Mailgun) for bulk emails. While Qlik does not specifically endorse any of these services over the others, here's an example on how to setup Qlik Cloud Services SMTP settings with Sendgrid, taking advantage of their free tier. Going beyond that tier might require adopting a paying subscription from either Sendgrid or any of their competitors.

Environment

Qlik Cloud 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

1. Go to Sendgrid.com  and click on "Try For Free"
   
   
   
   
   
   
2. Create a free account, by providing your email address and picking a password
   
   
   
   
   
   
3. After completing a form with the personal/company information, create a Single Sender from the main dashboard
   
   
   
   
   
   
4. Complete the creation of a sender by adding the details
   
   
   
   
   
   
   
5. After verifying the email address, check that the information is correct
   
   
   
   
   
6. In the "Email API" section, select "Integration Guide" and then "SMTP Relay"
   
   
   
   
   
7. Create a key by giving it a name of your choice
   
   
   
   
   
8. Mark down the settings to use for the SMTP config
   
   Server: smtp.sendgrid.net
   Port: 465 (SSL)
   Username: apikey
   Password: Your API Key
   
    
   
   
   
   
9. Open a new browser tab and, in your Qlik Cloud tenant, go to Management Console --> Settings -->  Email Server and enter the information from above
   
   
   
   
   
   
   
10. After testing the sending of an email, go back to the Sendgrid page, select the checkbox and  Verify integration
    
    
    
    
11. Go to the Activity Feed in Sendgrid to check the status of sent emails
    
    
    
    
    
12. The same settings can be applied in the "Send Mail" block in Qlik Application Automation, under the "Connection" tab. This block can also be used with Qlik Reporting Service.
    
    

Related Content

Implement advanced SMTP authentication options for alerts and subscriptions in Qlik Cloud
How to use Mailchimp bulk email service SMTP with Qlik Cloud Services and Qlik Application Automation 

Qlik Replicate task fails during run time:

RetCode: SQL_ERROR SqlState: S1000 NativeError: 4 Message: [SAP AG][LIBODBCHDB DLL][HDBODBC] General error;4 cannot allocate enough memory: OOM. please check traces for further information [1022502] (ar_odbc_stmt.c:2789)

Resolution

To address the memory error:

1. If not already stopped, manually stop the current task
2. Edit the source SAP HANA endpoint / from Advanced tab
3. Add the following three Internal Parameters:
   
   
   • fetchQueryHints 
     value:  NO_CS_EXPR_JOIN
   • hextobinLocation
   • value: excludingJoin
   • maxFetchIntervalSize (note that this internal parameter is depreciated in 2023.5 and 2023.11 as the parameter now appears as an endpoint setting)
     value: 10000
     
     
     

For more information on how to set Internal Parameters, see: Qlik Replicate: How to set Internal Parameters and what are they for? 

Environment

Qlik Replicate 
SAP Hana Endpoint

Analyzing endpoints for Qlik Sense Enterprise on Windows, using for example https://www.ssllabs.com/ssltest/analyze.html may indicate:

• The site being vulnerable for POODLE attacks and Insecure renegotiation
• Certificates using SHA1 instead of SHA256 cipher
• Potential CVE-2019-1559 vulnerability

Environment:

Qlik Sense Enterprise on Windows 

Protecting the platform

Please review Qlik Sense Enterprise on Windows securityfor information on how to protect the Qlik Sense platform. 

The security in Qlik Sense Enterprise does not depend only on the Qlik software. It also relies on the security and hardening of the environment that Qlik Sense operates in. This means that the security of, for example, the operating system and the cryptographic ciphers available have to be set up and configured to provide the security needed for Qlik Sense.

See Qlik Sense: TLS Support on what protocols and ciphers are supported in which version. 

Mitigate POODLE attack

To mitigate POODLE attacks, one step is to completely disable SSLv3.0 on the server. 
See Microsoft Security Advisory 3009008 for more instructions on how to accomplish this and the impact of doing so.
See Qlik Sense: TLS Support on what protocols and ciphers are supported in which version. 

Mitigate Zombie POODLE / GOLDENDOODLE attack

To mitigate POODLE attacks, one step is to completely disable all cipher suites with the string CBC. This needs to be carried out in the Windows OS.

Insecure renegotiation

Insecure renegotiation may be mitigated by disabling renegotiation. This can be done at the OS level by adding the following Windows registry key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
"DisableRenegoOnServer"=dword:00000001

However, it is recommended to review all Schannel settings ( Secure Channel ) and that a Windows Administrator should configure it to meet their requirements.

See Qlik Sense: TLS Support on what protocols are supported in which version. 


Note: Any changes at the OS level must be thoroughly tested as they may cause other software to no longer function as expected, or clients may be unable to communicate with the server. If any side effects are experienced, the changes should be reverted back to the original settings.

There are environments where the cryptographic protocols available to the Windows Operating System need to be restricted for security or compliance reasons. This article will outline where various TLS versions are supported. This article will not have full coverage of the impact of TLS changes to other software installed on the Qlik Sense server. For examples of potential impacts:

• SQL connection not working with TLS 1.2
• OLEDB Connection not working with TLS 1.2

Resolution

• Full compatibility with TLS 1.2 in all current and supported versions of Qlik Sense Enterprise on Windows
• TLS 1.3 is not yet fully compatible [Internal Reference ID: SHEND-1269]

Implementation

To enable strong TLS implementation make sure to have all your servers updated to a version of both the operating system and the Qlik software, which explicitly details they support the required version of TLS.

If you have a clustered environment with multiple nodes spread across different machines, please make sure to enable the same subset of protocols on all Sense machines, otherwise the services will not be able to successfully communicate.

Using a third-party toolset

Third-party tools such as IIS Crypto can be used to enable and disable SSL or TLS. Consult your Windows administrator or network security team for what tools are usually used in your organization. 

Manual

The correct protocols and ciphers can then be applied using the PowerShell (PS) scripts and making changes to the Windows Registry. Consult Microsoft or your Windows administrator for details. 

Related Content

IIS Crypto is an example 3rd party tool that can be used to achieve this. IIS Crypto is not supported by Qlik, but by its respective vendor, NARTAC Software. To obtain IIS Crypto, visit https://www.nartac.com/Products/IISCrypto. 

This article will outline how to successfully change the service account running Qlik Sense. 

Contents:

• Account Requirements: What the account needs access to.
• Prep work
• Changing Qlik Sense dependencies
• Change the service account
• External Dependencies
• Video Demonstration
• Related Content

Account Requirements: What the account needs access to.

1. Certificates
   • Access to the certificate(s) for the site
2. Files and file shares
   • Access to the installation path for Qlik Sense
   • Access to %ProgramData%
   • Access to C:\Program Files\Qlik
   • Access to the Service Cluster share
3. Access to external systems as data sources, e.g.
   • Databases
   • UNC shares to QVDs, CSVs, etc

Note: Many of the file level permissions would ordinarily be inherited from membership to the Local Administrators group. For information on non-Administrative accounts running Qlik Sense Services see Changing the user account type to run the Qlik Sense services on an existing site.

Prep work

Record the Share Path. Navigate in the Qlik Management Console (QMC) to Service Cluster and record the Root Folder.

 

 

 

Changing Qlik Sense dependencies

1. Stop all Qlik Sense services
2. Ensure permissions on the Program Files path (this should be provided by Local Administrator rights):
   1. Navigate to the installation path (default: C:\Program Files\Qlik)
   2. Select the Sense folder > Right Click > Properties > Security > Edit > Add
      1. Lookup the new service account
      2. Ensure that the account has Full control over this folder
3. Ensure permissions on the %ProgramData% path (this should be provided by Local Administrator rights):
   1. Navigate to the installation path (default: C:\ProgramData\Qlik)
   2. Select the Sense folder > Right Click > Properties > Security > Edit > Add
      1. Lookup the new service account
      2. Ensure that the account has Full control over this folder
4. Ensure access to the certificates used by Qlik Sense
   1. Start > MMC > File > Add/Remove Snap-In > Certificates > Computer Account > Finish
      1. Go into Certificates (Local Computer) > Personal > Certificates
      2. For the Qlik CA server certificate (under Certificates (Local Computer) > Personal > Certificates)
         • Right Click on the Server Certificate > All Tasks > Manage Private Keys > Ensure that the new service account has control
      3. If using a third party certificate, do the same
5. Ensure access to the Service Cluster path used by Qlik Sense
   1. Start > Computer Management > Shared Folders > Shares > Select the Share path
   2. Right click on the Share Path > Properties > Share Permissions > Add the new service account to have full control
   3. Open Windows File Explorer and navigate to the folder (e.g. C:\Share) > Right click on the folder > Security > Edit > Add the new service account to have full control
6. Ensure membership in the Local Groups that Qlik Sense requires:
   1. Start > Computer Management
   2. Navigate to Local Users and Groups > Local Groups
   3. Add the new service account as a member of:
      • Administrators (if using this configuration option)
      • Performance Monitor Users
      • Qlik Sense Service Users

Change the service account

1. Swap the account for all Qlik Services except the Qlik Sense Repository Database Service.
   1. Open the Windows Services Console
   2. Locate the services
   3. One by one open the Properties of the Service and change the accountover by using the Windows services control panel
2. Start all Qlik Sense Services
3. Access the QMC to validate functionality, preferably as a previously configured RootAdmin
4. Access the Data Connections section of the QMC
5. Toggle the User ID field and change the data connections used by the License and Operations Monitor apps to use the new user ID and password:
   
   
   
   
6. Add the RootAdmin role to the new service account*
   1. QMC > Users
   2. Filter on the new UserID > Edit
   3. Add RootAdmin role
      
      *If this account is not existing yet in Qlik Sense, you would need to try to connect to the Hub/QMC with this new account first, in order to be able to see it in QMC>Users.
      
      
7. Execute the License Monitor reload task
8. Inspect the configured User Directory Connectors and change the User ID and password combination if previously configured.

External Dependencies

1. Go into the QMC > Data Connections section and inspect all Folder data connections to determine all network shares that the service account needs access to. Either change them yourself or alert the necessary teams to provide both Share and NT level access to these shares.
2. Inspect all Data Connections and ensure that none use the old Service account and password. Follow up with necessary teams to provide access to data sources that used the old credentials.

Video Demonstration

Related Content

How to change the share path in Qlik Sense (Service Cluster) 

Testing endpoint connections on Qlik Replicate version 2023.11.0.-810 fails with the following error message:

SYS-E-HTTPFAIL, no rest handler for url . SYS,GENERAL_EXCEPTION,no rest handler for URL </attunityreplicate/rest/servers/rn000042208/expressions?action=describe>

The Qlik Enterprise Manager runs version 2023.11.0-480. 

Resolution

Qlik Replicate and Qlik Enterprise manager must be on the same SP. When upgrading, always verify the other is upgraded as well.

In this instance, Qlik Replicate runs a Pre-SP05 build, while the Qlik Enterprise Manager does not. At the time of writing this article, SP05 has not yet had a general release.

Download and install the Qlik Enterprise Manager (QEM) Pre-SP05 build (2023.11 Build 597) here:  https://files.qlik.com/url/wcwqqttxqpx5ezvw

Cause

When installing new versions of Qlik Replicate, the QEM version and build should be in sync.

Internal Investigation ID(s)

QB-29729

Environment

• Qlik Replicate

After an otherwise successful installation of Qlik Replicate 2024.5 on Linux, the Qlik Replicate console cannot be brought online. The following error can be seen from the curl command when connecting to the console: 

* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ip-10-133-76-113.ec2.internal:3552
* Closing connection
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ip-10-133-76-113.ec2.internal:3552

Resolution

The SSL certificate files delivered with Qlik Replicate have been corrupted. To regenerate the SSL certificates:

• Navigate to /opt/attunity/replicate/data/
• Remove the ssl directory
• Restart the Qlik Replicate Server

After the restart, the certificates are rebuilt. 

Cause

The Qlik Replicate certificates installed in /opt/attunity/replicate/data/ssl/data have been corrupted.

The certificate files are: 

• agent-ca.pem
• agent-certificate.pem
• agent-private-key.pem
• agent-private-key-passphrase.dat

Internal Investigation ID(s)

QB-29669

Environment

• Qlik Replicate

• Overview
• Frequently Asked Questions
• When was Talend 7.3.1 released?
• Why should I upgrade from Talend 7.3.1 to Talend 8?
• What are the options for Talend 7.3.1 for me?
• What is included with the Talend 7.3.1 Extended Support offering?
• Who do I contact about the Talend 7.3.1 Extended Support services offering?
• Will I be able to get Support on 7.3.1 after November 30, 2024?
• Can I use Talend 7.3.1 with Qlik Talend Cloud?
• How do I upgrade Talend 7.3.1 to Talend 8?
• Must I purchase Talend 8 licenses to upgrade?
• Are resources available to help transition Talend 7.3.1 to Talend 8?
• What products are affected?

Overview

Talend version 7.3.1, released in February 2020 has reached the end-of-support on November 30, 2024, as detailed in the Talend Product Documentation. After this date, Talend version 8.0 will be the only regularly supported version. While Qlik will no longer provide support for Talend 7.3.1, a Limited Extended Support option will be available for purchase.  

This document provides answers to frequently asked questions for customers about the End-of-Support for Talend 7.3.1. 

Frequently Asked Questions

When was Talend 7.3.1 released? 

February 2020 

Why should I upgrade from Talend 7.3.1 to Talend 8? 

Talend 8 brings many functional enhancements compared to 7.3.1 and notably: 

• The ability for each user to install only the Studio modules they need so it is smaller to download and update and faster to start  

• Monthly updates directly from within Studio, that additionally can be controlled by an administrator in the Management Console 

• A migration tool that helps branching projects for testing purposes upon Studio updates while also automatically handling some eventual breaking changes 

Refer to the Talend 8 General Availability release notes for detailed information and subsequent monthly release notes in the same documentation. 

It’s also worth noting that Talend 8 is compatible with the new Qlik Talend Cloud platform. As a result, any customer looking to ensure that their existing Talend infrastructure can interoperate with Qlik Talend Cloud should migrate to Talend 8.  

Finally, upgrading to a supported version helps ensure that your software stays relevant, secure, and usable for years to come. 

What are the options for Talend 7.3.1 for me? 

There are currently two available options: 

• Transition to fully supported Talend 8 and purchase Talend 7.3.1 Limited Extended Support: We realize that you might need more time to migrate to Talend 8, so this option includes a limited Talend 7.3.1 support offering, which extends support through December 31, 2025 for your most critical issues. Upon renewal of your subscription, you will only receive a license key for the most current version of Talend. Note, you will need to request a Talend 7.3.1 license key. 
  
  
• Transition to fully supported Talend 8 only: Talend 8 includes many new features and improvements that enhance your productivity and efficiency, not to mention that upgrading to a supported version helps ensure that your software stays relevant, secure, and usable for years to come. You can continue operating Talend 7.3.1, but it will not be supported by Qlik. If you choose to do so, you will need to request a Talend 7.3.1 license key upon renewal of your subscription. 

We do not recommend you stay on unsupported Talend 7.3.1 deployments! Every active Talend subscription is entitled to a current Talend version 8 license. If you do not already have a Talend 8 license, please contact Qlik Customer Support via the customer portal to request one. Active subscriptions with renewal dates before December 30, 2025, can also purchase the Talend 7.3.1 Limited Extended Support offer. 

What is included with the Talend 7.3.1 Extended Support offering? 

Limited Extended Support extends the support for 7.3.1 and includes the ability to log support cases when a severity 1 error happens, and a product issue blocks the customer production environment. The support is limited in that issues which require a fix in a third-party component that is no longer supported will not be eligible to receive product fixes. Extended Support customers that also have Signature Success or Signature CSE will also be entitled to an architecture migration assessment.

Who do I contact about the Talend 7.3.1 Extended Support services offering? 

Please reach out to your Qlik Account Manager, Partner or Customer Success Manager to discuss options. 

Will I be able to get Support on 7.3.1 after November 30, 2024? 

If you have not purchased the Talend 7.3.1 Extended Support, then your 7.3.1 deployment will no longer be entitled to receive technical support. 

Can I use Talend 7.3.1 with Qlik Talend Cloud? 

No. Qlik Talend Cloud is only compatible with Talend 8. There is no Qlik Talend Cloud license on Talend 7.3.1. 

How do I upgrade Talend 7.3.1 to Talend 8? 

To upgrade Talend 7.3.1 to Talend 8 follow the upgrade guide here: Start | Talend Migration and Upgrade Guide Help (qlik.com). 

Must I purchase Talend 8 licenses to upgrade? 

No. Every active Talend subscription is entitled to the current Talend 8 license. If you do not already have a Talend 8 license, please contact Qlik Customer Support via the customer support portal to request one. Active subscriptions with renewal dates before December 30, 2025, can also buy the Talend 7.3.1 Limited Extended Support offer if needed.

Are resources available to help transition Talend 7.3.1 to Talend 8? 

If you require additional consulting resources to transition to Talend 8, please enquire with your Qlik or partner representative, who can provide additional information on a range of Professional Service offerings.  

What products are affected? 

End-of-support for Talend 7.3.1 applies to all Talend modules (both on premises and Cloud) except Talend Change Data Capture, Talend Data Catalog, and Talend Remote Engine. 

Apache Airflow is a platform to programmatically author, schedule, and monitor workflows. Airflow uses Directed Acyclic Graph (DAG) to create workflows or tasks. For more information, see the Apache Airflow Documentation page.

This article shows you how to leverage Apache Airflow to orchestrate, schedule, and execute Talend Data Integration (DI) Jobs.

Environment

• Apache Airflow 1.10.2
• Nexus 3.9
• WinSCP 5.15
• PuTTY

Prerequisites

1. Apache Airflow installed on a server (follow the Installing Apache Airflow on Ubuntu/AWS installation instructions).
2. Python 2.7 installed on the Airflow server.
3. Java 1.8 installed on the Airflow server.
4. Access to the Nexus server from the Airflow server (in this example, both Nexus and Airflow are installed on the same server).
5. Talend 7.x Jobs published to the Nexus repository. (For more information on how to set up a CI/CD pipeline to publish Talend Jobs to Nexus, see Configuring Jenkins to build and deploy project items in the Talend Help Center.)
6. Access to the setup_files.zip file (attached to this article).

Process flow

1. Develop Talend DI Jobs using Talend Studio.
2. Publish the DI Jobs to the Nexus repository using Talend CI/CD module.
3. Execute the Directed Acyclic Graph (DAG) in Apache Airflow:
   • The first step in DAG is to download the Job executable from Nexus using the customized script.
   • The second step is to execute the downloaded Job.

   

Configuration and execution

1. Login to the Airflow server through SSH using WinSCP or PuTTY.

2. Create two folders named jobs and scripts under the AIRFLOW_HOME folder.

   

3. Extract the setup_files.zip, then copy the shell scripts (download_job.sh and delete_job.sh) to the scripts folder.

   

4. Copy the talend_job_dag_template.py file from the setup_files.zip to your local machine and update the following:

   • nexus_host
   • nexus_port
   • airflow_home
   • nexus_repo
   • job_group_id
   • job_name
   • job_version

   Also, update the default_args dictionary based on your requirements.

   

   For more information, see the Apache Airflow documentation: Default Arguments.

5. The DAG template provided is programmed to trigger the task externally. If you plan to schedule the task, update the schedule_interval parameter under the DAG for airflow task with values based on your scheduling requirements.

   

   For more information on values, see the Apache Airflow documentation: DAG Runs.

6. Rename the updated template file and place it in the dags folder under the AIRFLOW_HOME folder.

7. After the Airflow scheduler picks up the DAG file, a compiled file with the same name and with a .pyc extension is created.

   

8. Refresh the Airflow UI screen to see the DAG.

   Note: If the DAG is not visible on the User Interface under the DAGs tab, restart the Airflow webserver and the Airflow scheduler.

   

9. To schedule the task, toggle the button to On. You can also run the task manually.
10. Monitor the run status on the Airflow UI.

Conclusion

In this article, you learned how to author, schedule, and monitor workflows from the Airflow UI, and how to download and trigger Talend Jobs for execution.

It is not possible to set up a Microsoft Office 365 email provider with OAuth 2.0 authentication.
The HAR file shows this message in Network:

{connectionFailed: true, message: "Error during email request", success: false}
connectionFailed: true
message: "Error during email request"
success: false

Resolution

Configure the Mail.Send permission as it is described in Configuring a Microsoft 365 email provider using OAuth2.

Cause

This problem occurs when the Mail.Send permission has not been configured in the app registration.

Related Content

More information about the  Mail.Send permission can be found in Application permission to Microsoft Graph (learn.microsoft.com).

Environment

• Qlik Tabular reporting
• Qlik Cloud

This article describes the setup of an automation to run every time an app reload fails.

This can be done using the new Reload status filter on the App Reload Finished webhook event.

The automation can trigger an alert to Microsoft Teams, Slack, or another messaging tool. It can also be used to create a ticket in Jira or ServiceNow to make sure someone in your team will follow up on the failed reload.

Configuring the automation

Start by creating a new automation from your Qlik Cloud tenant. You can do this through the Add new button in the upper-right corner of the Qlik hub. Choose to start with a blank template, give the automation a name, and follow the below steps to configure the webhook.

1. Select the Start block in the automation canvas and configure the below settings in the Block Configuration menu on the right side of the canvas:
   
   
   1. Run Mode: Webhook
   2. Connector: Qlik Cloud Services
   3. Event: App Reload Finished
   4. Filter: Configure values for the App IDs and Space IDs parameters to narrow the webhook to specific apps or spaces. Then set the Reload status to "Failed (error)".
      
      In the below example, the webhook is configured to listen to failed reloads in the "Finance" space.
      

      
      

2. Add a block to take action on the failed reload.
   
   In this example, we'll send a message to a Teams channel in order to alert our team. For this, we'll use the Send Message block from the Microsoft Teams connector. You can find this connector and the block in the Block Library menu on the left side of the canvas. Click the connector to show all blocks and drag the Send Message block below the Start block.
   
   
   
   
   
   
3. Select the Send Message block to open the Block Configuration menu.
   
   Go to the Connection tab to create a connection to your Microsoft Teams account.
   
   

   

4. Go to the Inputs tab to further configure the Send Message block.
   
   
   1. Use the do lookup functionality to configure the Team ID and Channel ID parameters.
   2. Type a message in the Content parameter input field. To add information from the Reload Finished event, click the input box and click Output from App Reload Finished. This shows the output from previous runs or an example output.
   3. Click the parameters which you want to include in the message. Things like App Name, App ID, and Description from the Errors list could be interesting here. When the automation is run, these values will be concatenated into a single string.
      
      
      

       

5. Below is an example image of the result in Microsoft Teams. Feel free to replace the block with a Create Ticket block from the Jira or ServiceNow connector or use a different messaging tool like Slack, SendGrid or Email.
   
   
   

    

Related Content:

Qlik Sense Reload and Task Best Practices 
How to get started with Microsoft Teams in Qlik Application Automation 
How to send chat messages using the Microsoft Teams connector  
How to get started with SendGrid in Qlik Application Automation 
How to send a message to a channel in Slack in Qlik Application Automation 

Environment

Qlik Cloud 
Qlik Application Automation 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.