The Qlik NPrinting Designer (February 2024 IR to SR2) may fail to start. The error thrown is:

HTTP Call Error Sending Request

Resolution

This is a known defect (QB-30815) and is actively being investigated. A permanent fix is planned for a future patch of the February 2024 release.

Workaround

This workaround is applied to the Qlik NPrinting Server's webengine.config.

1. Stop all Qlik NPrinting services
2. Navigate to: C:\Program Files\NPrintingServer\NPrinting\WebEngine\
3. Open the webengine.config as Administrator
4. Uncomment the include-user-filters key:
   
   From:

   <!-- <add key="include-user-filters" /> -->

   
   To:
   

   <add key="include-user-filters" />

5. Save the file
6. Restart the Qlik NPrinting services

Cause

Too many user filters.

Internal Investigation ID(s)

QB-30815

Environment

• Qlik NPrinting February 2024 IR to SR2

It is recommended to enable HTTPS for Qlik GeoAnalytics Server. This can be done either during the installation or by editing the config.ini after the installation.  

The deployed SSL certificate may need to be updated regularly, which requires a repeat of the initial installation steps. 

Environment: 

Resolution:

Before you begin

• Make sure you have a certificate in PKCS12 (.pfx, p12) format, including the private key! This can be exported out from Windows Certificate Manager, Qlik Sense Management Console (if using self-signed certificates generated by Qlik Sense) or acquired by your certificate authority
• Make sure the certificate matches the hostname where Qlik GeoAnalytics Server is installed, (example: myserver.domain.local ) 
• Place the certificate where it can be accessed by Qlik GeoAnalytics Server

Set / Change certificate during install

The recommended way to enable HTTPS is to run the installation package and set/change the certificate during install. Setting the certificate during install will automatically obfuscate the password stored in config.ini.

1. Launch the Installer
2. On the second step of Server Settings (Basic) enable HTTPS and browse to the desired certificate. See fig 1.
   
   Fig 1
   
   
3. Proceed with the installation. 

Alternative way to enable HTTPS on an already installed Qlik GeoAnalytics Server

1. Edit config.ini found in %ProgramData%\Qlik GeoAnalytics Server and add the following to the [SSL] section, replacing details to match your environment:
   

   [SSL]
   sslEnabled=true
   sslPort=443
   sslKeystore=c:\\path_to_certificate\\certificate_filename.pfx
   sslPassword=certificate_password​

2. While encryption of passwords is required in later versions, it should still be possible to use clear text password in the ini. However, it's recommended to re-run the installation program to set the parameters and then the password will be obfuscated like enc:0B0115327474.
   
   All obfuscated passwords should start with enc:
   
   
3. Open Qlik GeoAnalytics Configure Service console and restart the service
4. Verify HTTPS working properly.
5. Any errors/warnings about the certificate not being valid, such as missing Subject Alternative Name, issues with the certificate chain etc may result in errors when using the server and needs to be investigated and fixed.

Qlik Sense Enterprise Client-Managed offers a range of Monitoring Applications that come pre-installed with the product.

Qlik Cloud offers the Data Capacity Reporting App for customers on a capacity subscription, and additionally customers can opt to leverage the Qlik Cloud Monitoring apps.

This article provides information on available apps for each platform.

Content:

• Qlik Cloud
• Data Capacity Reporting App
• Access Evaluator for Qlik Cloud
• Answers Analyzer for Qlik Cloud
• App Analyzer for Qlik Cloud
• Automation Analyzer for Qlik Cloud
• Entitlement Analyzer for Qlik Cloud
• Reload Analyzer for Qlik Cloud
• Report Analyzer for Qlik Cloud
• How to automate the Qlik Cloud Monitoring Apps
• Other Qlik Cloud Monitoring Apps
• OEM Dashboard for Qlik Cloud
• Monitoring Apps for Qlik Sense Enterprise on Windows
• Operations Monitor and License Monitor
• App Metadata Analyzer
• The Monitoring & Administration Topic Group
• Other Apps

Qlik Cloud

Data Capacity Reporting App

The Data Capacity Reporting App is a fully supported app distributed within the product. For more information, see Qlik Help.

Access Evaluator for Qlik Cloud

For more information, see Qlik Cloud Access Evaluator.

Answers Analyzer for Qlik Cloud

For more information, see Qlik Cloud Answers Analyzer.

App Analyzer for Qlik Cloud

For more information, see Qlik Cloud App Analyzer.

Automation Analyzer for Qlik Cloud

For more information, see Qlik Cloud Automation Analyzer.

Entitlement Analyzer for Qlik Cloud

The Entitlement Analyzer is a Qlik Sense application built for Qlik Cloud, which provides Entitlement usage overview for your Qlik Cloud tenant for user-based subscriptions.

The app provides:

• Which users are accessing which apps
• Consumption of Professional, Analyzer and Analyzer Capacity entitlements
• Whether you have the correct entitlements assigned to each of your users
• Where your Analyzer Capacity entitlements are being consumed, and forecasted usage

For more information, see The Entitlement Analyzer.

Reload Analyzer for Qlik Cloud

For more information, see Qlik Cloud Reload Analyzer.

Report Analyzer for Qlik Cloud

For more information, see Qlik Cloud Report Analyzer.

How to automate the Qlik Cloud Monitoring Apps

Do you want to automate the installation, upgrade, and management of your Qlik Cloud Monitoring apps? With the Qlik Cloud Monitoring Apps Workflow, made possible through Qlik's Application Automation, you can:

1. Install/update the apps with a fully guided, click-through installer using an out-of-the-box Qlik Application Automation template. 
2. Programmatically rotate the API key that is required for the data connection on a schedule using an out-of-the-box Qlik Application Automation template. This ensures that the data connection is always operational. 
3. Get alerted whenever a new version of a monitoring app is available using Qlik Data Alerts. 

For more information and usage instructions, see Qlik Cloud Monitoring Apps Workflow Guide.

Other Qlik Cloud Monitoring Apps

OEM Dashboard for Qlik Cloud

For more information and to download the app and usage instructions, see Qlik Cloud OEM Dashboard & Console Settings Collector.

With the exception of the Data Capacity Reporting App, all Qlik Cloud monitoring applications are provided as-is and are not supported by Qlik. Over time, the APIs and metrics used by the apps may change, so it is advised to monitor each repository for updates and to update the apps promptly when new versions are available.

If you have issues while using these apps, support is provided on a best-efforts basis by contributors to the repositories on GitHub.

Monitoring Apps for Qlik Sense Enterprise on Windows

Operations Monitor and License Monitor

The Operations Monitor loads service logs to populate charts covering performance history of hardware utilization, active users, app sessions, results of reload tasks, and errors and warnings. It also tracks changes made in the QMC that affect the Operations Monitor.

The License Monitor loads service logs to populate charts and tables covering token allocation, usage of login and user passes, and errors and warnings.

For a more detailed description of the sheets and visualizations in both apps, visit the story About the License Monitor or About the Operations Monitor that is available from the app overview page, under Stories.

Basic information can be found here:

The License Monitor 
The Operations Monitor 

Both apps come pre-installed with Qlik Sense. 

If a direct download is required: Sense License Monitor | Sense Operations Monitor. Note that Support can only be provided for Apps pre-installed with your latest version of Qlik Sense Enterprise on Windows. 

App Metadata Analyzer

The App Metadata Analyzer app provides a dashboard to analyze Qlik Sense application metadata across your Qlik Sense Enterprise deployment. It gives you a holistic view of all your Qlik Sense apps, including granular level detail of an app's data model and its resource utilization.

Basic information can be found here: 

App Metadata Analyzer (help.qlik.com)

For more details and best practices, see: 

App Metadata Analyzer (Admin Playbook)

The app comes pre-installed with Qlik Sense.

The Monitoring & Administration Topic Group

Looking to discuss the Monitoring Applications? Here we share key versions of the Sense Monitor Apps and the latest QV Governance Dashboard as well as discuss best practices, post video tutorials, and ask questions.

Monitoring & Administration 

Other Apps

LogAnalysis App: The Qlik Sense app for troubleshooting Qlik Sense Enterprise on Windows logs 
Sessions Monitor, Reloads-Monitor, Log-Monitor 
Connectors Log Analyzer 

All Other Apps are provided as-is and no ongoing support will be provided by Qlik Support.

A talend Job is failing with the following error when you publish it to Cloud

java.io.FileNotFoundException: <File Path Here> (Access is denied) 

Resolution

1. Please check that you have enough permissions to the file and folder path, and for the remote engine as well. This is an example of when using the remote engine as a Windows service  Jobs fail due to a "java.io.FileNotFoundException: \\fileshare\filename (Access is denied)" error
2. Please check for possibilities of the folder or file being accessed from a different process or a different job, which may cause conflict.
3. Please double check your job design, and make sure that the file is created and exists in the directory. A component that you can use for this situation is tFileExist. For guidance on how to use the component, please refer to this documentation Checking for the presence of a file and creating it if it does not exist.

Cause 

1. The user does not have enough permissions to the file or folder path, or for the remote engine.
2. The folder may be accessed from a different process or a different job, which may cause conflict.
3. The folder or file may be missing from the directory at that particular time.
4. If you are using absolute Path to the source file, please ensure there are no spaces or Special characters, escape sequence issues in the file path string.

Environment

Talend Cloud 

The Remote Engine folder belongs to talenduser, but the service cannot start. Running 'systemctl status talend-remote-engine' shows two errors:

"Failed to execute command= permission denied"

"Failed at step EXEC spawning."

Cause

By default, selinux is not configured to run Talend Remote Engine in system configuration.

Resolution

Permanently disable SELinux, please follow the steps below:

1. Configure SELINUX=disabled in the /etc/selinux/config file.
2. Reboot the server 

Environment

• Talend Data Integration 8.0.1

Introduction

If you need to request to reschedule your Talend Certification Exam because you could not clear it on your first attempt, follow the steps outlined below. This guide will help you understand the process and the necessary details you need to provide to get the support you need.

Steps to Request Assistance

1. Gather Necessary Information:

   • User Email ID: Ensure you have the email address of the person who needs to reschedule the exam.

   • Exam Name: Provide the name of the exam that needs to be rescheduled.

   • Reason for Reschedule: Provide a brief description of why you need to reschedule the exam.

   • Preferred Reschedule Date and Time: Mention the preferred date and time for rescheduling the exam, along with the region.

   • Point of Contact (POC): Mention the point of contact for this request.

   • Internal Person's Email ID: Include the internal person's email address who should be informed once the request is completed.

2. Send an Email Request:

   • Email your request to customersupport@qlik.com.

Email Template for Requesting an Exam Reschedule

Use the following template to structure your email request:

Subject: Request to Reschedule Talend Certification Exam

Dear Support Team,

I hope this email finds you well.

I am writing to request a reschedule of my Talend Certification Exam. Below are the details:

• User Email ID: [Insert User Email]

• Exam Name: [Insert Exam Name]

• Reason for Reschedule: [Provide a brief description of the reason for the reschedule]

• Preferred Reschedule Date and Time: [Mention preferred date and time, along with the region]

• Point of Contact (POC): [Insert POC Name and Email]

• Internal Person's Email ID: [Insert Internal Person's Email]

I would greatly appreciate your support in processing this request. Thank you for your assistance and consideration.

Best regards, [Your Name]

Example of a Detailed Request for Different Time Zones

Example for IST (India Standard Time)

Subject: Request to Reschedule Talend Certification Exam

Dear Support Team,

I hope this email finds you well.

I am writing to request a reschedule of my Talend Certification Exam. Below are the details:

• User Email ID: sam@xyz.com

• Exam Name: Talend Data Integration Certified Developer Exam

• Reason for Reschedule: I was unable to clear the exam on my first attempt and would like to reschedule to better prepare for my next attempt.

• Preferred Reschedule Date and Time: April 15th, 2025, at 10:00 AM IST (India Standard Time)

• Point of Contact (POC): Jane Doe (jane@xyz.com)

• Internal Person's Email ID: [Insert Internal Person's Email]

I would greatly appreciate your support in processing this request. Thank you for your assistance and consideration.

Best regards, Sam

Example for EMEA (Europe, Middle East, and Africa)

Subject: Request to Reschedule Talend Certification Exam

Dear Support Team,

I hope this email finds you well.

I am writing to request a reschedule of my Talend Certification Exam. Below are the details:

• User Email ID: alice@xyz.com

• Exam Name: Talend Data Integration Certified Developer Exam

• Reason for Reschedule: I was unable to clear the exam on my first attempt and would like to reschedule to better prepare for my next attempt.

• Preferred Reschedule Date and Time: April 15th, 2025, at 10:00 AM CET (Central European Time)

• Point of Contact (POC): John Smith (john@xyz.com)

• Internal Person's Email ID: [Insert Internal Person's Email]

I would greatly appreciate your support in processing this request. Thank you for your assistance and consideration.

Best regards, Alice

Example for PST (Pacific Standard Time)

Subject: Request to Reschedule Talend Certification Exam

Dear Support Team,

I hope this email finds you well.

I am writing to request a reschedule of my Talend Certification Exam. Below are the details:

• User Email ID: bob@xyz.com

• Exam Name: Talend Data Integration Certified Developer Exam

• Reason for Reschedule: I was unable to clear the exam on my first attempt and would like to reschedule to better prepare for my next attempt.

• Preferred Reschedule Date and Time: April 15th, 2025, at 10:00 AM PST (Pacific Standard Time)

• Point of Contact (POC): Lisa Brown (lisa@xyz.com)

• Internal Person's Email ID: [Insert Internal Person's Email]

I would greatly appreciate your support in processing this request. Thank you for your assistance and consideration.

Best regards, Bob

Example for EST (Eastern Standard Time)

Subject: Request to Reschedule Talend Certification Exam

Dear Support Team,

I hope this email finds you well.

I am writing to request a reschedule of my Talend Certification Exam. Below are the details:

• User Email ID: carol@xyz.com

• Exam Name: Talend Data Integration Certified Developer Exam

• Reason for Reschedule: I was unable to clear the exam on my first attempt and would like to reschedule to better prepare for my next attempt.

• Preferred Reschedule Date and Time: April 15th, 2025, at 10:00 AM EST (Eastern Standard Time)

• Point of Contact (POC): Michael Johnson (michael@xyz.com)

• Internal Person's Email ID: [Insert Internal Person's Email]

I would greatly appreciate your support in processing this request. Thank you for your assistance and consideration.

Best regards, Carol

Important Notes:

• Ensure all details are accurate and complete before sending your request.

• Use the appropriate email address based on your user type.

Following these steps will help you effectively request to reschedule your Talend Certification Exam. If you have any further questions, feel free to reach out to the respective teams.

Note: Once the email is sent to the Qlik Talend support team, a support request will be raised, and a support engineer will assist you further with the next steps. The rescheduling of the exam will depend on the validation of the request and the availability of the new exam date.

The claims can be accessed via an API Endpoint:

For User claims: 

Please log out of the tenant and re-authenticate using the new identity provider connection. Once logged in, change the URL in the address bar to point to https://<tenanthostname>/api/v1/diagnose-claims  This will return the JSON of the claims information of your IDP sent to the tenant. Here is a slightly redacted example:

Explanations of the different sections in the diagnose-claims endpoint:

• internalClaims: Summary of the user in Qlik Cloud. Usually derived from the IDP claims, but also contains information specific to Qlik Cloud access control (like the user’s roles).
• claimsFromIdp: The raw claims received from the IDP. For Azure AD, most likely this comes directly from Azure AD’s ID token, however groups from the ID token are not imported to Qlik Cloud, the Microsoft Graph API is used to retrieve them instead.
• extraClaims: This section only applies to Azure AD at the time of writing this article, since groups are fetched from Microsoft Graph API. If groups were retrieved correctly from Microsoft Graph API , they will be shown here.
• mappedClaims: Applies the extra claims mapping on top of the raw IDP claims to get the final set of claims used for the Qlik Cloud user.

For Group Claims:

Once logged in, change the URL in the address bar to point to https://<tenanthostname>/api/v1/groups  This will return the JSON of the claims information of your Groups sent to the tenant.

Environment

Qlik Cloud 

The information in this article is provided as-is and to be used at your own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

An example scenario:

One has approximately 20 Qlik sense applications which load data from the same source QVD. The QVD file is required to be updated at least once an hour. Should Qlik fail to secure write access on the file, a routine could be used to wait 10 seconds and retry.

Resolution/Script

SUB StoreQVTable (Table, Path) 

SET ErrorMode=0; 
Set ScriptErrorCount = 0; 
Set RC = 0; 

DO WHILE TRUE() 

STORE [$(Table)] INTO [$(Path)] (qvd); 

IF $(ScriptErrorCount) = 0 THEN 

EXIT DO 

ELSE 

Set ScriptErrorCount = 0; 
LET RC=RC+1; 

END IF 


IF ($(RC) = 10) THEN // If not yet successful, exit script 
// CALL consoleLog('ERROR: Failed to save [$(Table)] INTO [$(Path)] after 10 tries.'); 
TRACE 'ERROR: Failed to save [$(Table)] INTO [$(Path)] after 10 tries.'; 
SET ErrorMode=2; 
Load * from ERROR.qvd; 
END IF 

// CALL consoleLog('ERROR: Failed to save [$(Table)] INTO [$(Path)]. Try $(rc) of 10.'); 
TRACE 'ERROR: Failed to save [$(Table)] INTO [$(Path)]. Try $(RC) of 10.'; 
SLEEP 10000; // wait for 10secs. 

LOOP 
SET ErrorMode=2; 

END SUB

Question

Why are there multiple IP addresses showing up when using the nslookup command for Talend Cloud URLs like "api.ap.cloud.talend.com"?

nslookup api.ap.cloud.talend.com

Multiple IP addresses show up because Round-Robin DNS is being used. It ensures high availability and distributes traffic among multiple servers.

Related Content

What is Round-Robin DNS? Optimize Server Load

Environment

Talend Cloud 

Unable to resume Qlik Replicate tasks due to the error below:

00020080: 2023-08-16T13:55:07 [SOURCE_CAPTURE ]I: Start processing new RESETLOGS_ID 'xxxxxxxxx' that does not still have archived Redo logs (oradcdc_thread.c:430)

Resolution

The internal parameter supportResetLog is currently set to true. When a failover happens, the redo log ID will be reset to zero.

• With supportResetLog set to true, Qlik Replicate will search from zero when it cannot find the next redo log.
• With supportResetLog set to false, Qlik Replicate will keep searching for the next redo log until it appears or the task times out. This setting resolved the "Start processing new RESETLOGS_ID 'xxxxxxxxx' that does not still have archived Redo logs" error. 

To set the Internal Parameter:

1. Go to the Oracle Source Endpoint
2. Switch to the Advanced tab
3. Click Internal Parameters
4. Add:
   
   Parameter: supportResetLog
   Value: uncheck the box (set to false) 
   
   
   
   For more information on Internal Parameters, see Qlik Replicate: How to set Internal Parameters and what are they for?
   
   
5. Save and exit. The change will take effect once the tasks using this endpoint are stopped and resumed.

Environment

• Qlik Replicate
• Oracle Database as a Source

Affected versions:

• Qlik Sense Enterprise on Windows all versions, including November 2024

CVE-2024-7348 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in pg_dump, a utility used for backing up PostgreSQL databases. This vulnerability allows an attacker to replace a relation type (such as a table or sequence) with a view or foreign table right when pg_dump is running. Because pg_dump often runs with superuser privileges, this attack could execute arbitrary SQL code, leading to unauthorized actions or data corruption. Source: https://www.postgresql.org/support/security/CVE-2024-7348/

How does this vulnerability impact Qlik Sense Enterprise on Windows?

Qlik can confirm that pg_dump is not actively used in the Qlik Sense Enterprise on Windows code.

How to mitigate the vulnerability 

Both steps are required to fully mitigate the issue.

• Upgrade PostgreSQL. This requires a standalone instance of PostgreSQL. See Upgrading and unbundling the Qlik Sense Repository Database using the Qlik PostgreSQL Installer on how to unbundle PostgreSQL if necessary.

  Always verify compatibility between your Qlik Sense version and PostgreSQL before planning an upgrade.

• Delete the pg_dump.exe located in the default Qlik Sense Enterprise on Windows Postgresql install folder: C:\Program Files\Qlik\Sense\Repository\Postgresql\14\
  

  The file will be recreated after an upgrade. This step will need to be repeated after each Qlik Sense upgrade. Qlik is actively investigating the removal of pg_dump from future installers (SHEND-2041).

  The updated pg_dump.exe in, for example, C:\program files\postgresql\14 does not need to be removed.

Does the Qlik PostgreSQL Installer (QPI) use the pgdump.exe?

QPI does not utilise pgdump.exe.

Internal Investigation ID(s)

• QB-28706
• SHEND-2041

The Qlik Replicate logs may report the following error on Target Apply:

[TARGET_APPLY    ]E:  RetCode: SQL_ERROR  SqlState: 08S01 NativeError: 35 Message: server closed the connection unexpectedly

Resolution

Add the Internal Parameter additionalConnectionProperties (a) to the Postgres Target endpoint and provide the following two ODBC parameters (b😞

KeepaliveTime=60; KeepaliveInterval=1;

See Qlik Replicate: How to set Internal Parameters and what are they for? for detailed instructions on how to add an Internal Parameter.

Cause 

If Qlik is replicating across networks that transit cloud infrastructure or have any type of firewall device, the database connection options must enable a TCP keepalive setting or certain scenarios will cause idle connections to age-out. In one of the scenarios, data pipeline loads create large updates that must be inserted on the target. These inserts take time, long enough for Qlik's sessions to age-out idle across the intermediate network devices. This required setting the mentioned flags for the Postgres ODBC driver. 

Environment

Qlik Replicate 

You may get the errors, "A call to SSPI failed, see inner exception" and "The certificate chain was issued by an authority that is not trusted". While they should have no impact on your end-users, you'd still like to clean them up from the logs.

Qlik Sense otherwise functions without issues.

Example error:

System.Proxy.Qlik.Sense.Communication.Communication.Tcp.StreamFactory 16 c2972806-6ae3-4559-8ebf-c7c2201335f3 xx\xxx Failed to authenticate stream as Server The client and server cannot communicate, because they do not possess a common algorithm↵↓A call to SSPI failed, see inner exception. NO-STACKTRACE↵↓ at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)

These, unfortunately, are not Qlik Sense errors, but rather errors from Windows that Qlik Sense reports.  You should also be able to see them in your Windows Application logs. For more information, please search out Windows Support.

See Security Support Provider Interface Architecture for additional details. 

Possible root causes:

1. A possible root cause for Windows reporting these errors is a missing or wrong certificate thumbprint.
   
   If a third party certificate is being used in the environment, verify that the correct thumbprint is added to the Qlik Sense Proxy.
   
   
2. It may also be related to the load balancer.   
   
   A common behaviour for a load balancer is a quite constant interval between two SSPI failures on Sense,  generally because the basic load balances HTTPS health check doesn't complete the HTTPS handshake.  The error "because they do not possess a common algorithm" is for this reason.  The fast check can be done by changing the frequency of HTTP health check on the load balancer and seeing the corresponding interval change on the Qlik Sense side pay attention if multiple LB nodes are present.

The following steps are only applicable to Qlik Sense deployments originally installed with versions prior to the June 2019 release. For any Qlik Sense deployments installed with later versions, follow standard steps for patching Qlik Sense and do not perform the steps in this article.

In these steps we will occasionally ask you to run Powershell code.

Executing PowerShell code:

1. Copy the code and save it in a ps1 file, in example: certificates_backup.ps1
2. Open elevated command line and navigate to the location where the script was saved.
3. Start PowerShell by executing following command: Powershell
4. Run the script by executing following command: .\<name_of_the_script>.ps1 in example: .\certificates_backup.ps1

Environment

• Qlik Sense Enterprise on Windows, June 2019 thru November 2019

Resolution

1. After upgrading to June 2019 or above, check the Root certificate by running the C2 Validator tool on ALL NODES. If CA and Critical display 'Missing', please follow the instructions below.
2. Stop all services on ALL NODES in the Qlik Sense cluster.
3. Back up all current Qlik Sense certificates from the CENTRAL NODE by executing the following PowerShell code:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

function ExportCertificatesFromStore(
    [string] $name,
    [string] $location)
{
    $success = 1
    $oid = "1.3.6.1.5.5.7.13.3"
    
    $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
    $localStore.Open("MaxAllowed")

    $mypwd = ConvertTo-SecureString -String "MyPassword" -Force -AsPlainText

    try
    {
        $certs = $localStore.Certificates
        foreach ($cert in $certs)
        {
            $extensions = $cert.Extensions
            foreach($extension in $extensions)
            {
                if ($extension.Oid.Value.Equals($oid))
                {
                    Get-ChildItem -Path cert:\$($localStore.Location)\$($localStore.Name) | Where-Object { $_.PrivateKey.CspKeyContainerInfo.Exportable } | Export-PfxCertificate -FilePath "$($localStore.Name)_$($localStore.Location).pfx" -Password $mypwd
                    break;
                }
            }
        }
    }

    catch
    {
        write-host "An error occurred while removing certificates" -ForegroundColor Red
        write-host $_.Exception.GetType().FullName -ForegroundColor Red
        write-host $_.Exception.Message -ForegroundColor Red
        $success = 0
    }

    finally
    {
        $localStore.Close()
    }
    
    if ($success -ne 1)
    {
        exit 20
    }
}

function ExportCertificates()
{
    ExportCertificatesFromStore "Root" "LocalMachine"
    ExportCertificatesFromStore "My" "LocalMachine"
    ExportCertificatesFromStore "My" "CurrentUser"
}

ExportCertificates
write-host "Done."
exit 0

NOTE: For information on how to execute above code please refer to “Executing PowerShell code” section at the top. Modify $mypwd variable to define custom password. Make sure certificates were backed up after running the script:

• Root_LocalMachine.pfx – root CA
• My_LocalMachine.pfx – server
• My_CurrentUser – client

NOTE: If you happen to have more certificates with the same values in Issued To, Issued By and Friendly Name columns and you are unable to identify the correct certificate, please refer to Identifying Qlik Sense root CA and server certificates in certificate store.

1. Remove current Qlik Sense root CA certificate from CENTRAL NODE by executing the following PowerShell code:
   

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   
   function RemoveCertificatesFromStore(
   [string] $name,
   [string] $location)
   {
       $success = 1
       $oid = "1.3.6.1.5.5.7.13.3"
   
       $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
       $localStore.Open("MaxAllowed")
       try
       {
           $certs = $localStore.Certificates
           foreach ($cert in $certs)
           {
               $extensions = $cert.Extensions
               foreach($extension in $extensions)
               {
                   if ($extension.Oid.Value.Equals($oid))
                   {
                       write-host "Deleting certificate from" $localStore.Name $localStore.Location
                       write-host " Subject:"$cert.Subject
                       write-host " Issuer:"$cert.Issuer
                       write-host " Serial:"$cert.SerialNumber
                       $localStore.Remove($cert)
                       break;
                   }
               }
           }
       }
       catch
       {
           write-host "An error occurred while removing certificates" -ForegroundColor Red
           write-host $_.Exception.GetType().FullName -ForegroundColor Red
           write-host $_.Exception.Message -ForegroundColor Red
           $success = 0
       }
       finally
       {
           $localStore.Close()
       }
   
       if ($success -ne 1)
       {
           exit 20
       }
   }
   
   function CleanCertificates()
   {
       RemoveCertificatesFromStore "Root" "LocalMachine"
   }
   
   CleanCertificates
   write-host "Done."
   exit 0​

2. Make sure script completes without any errors. Otherwise remove Qlik Sense root CA certificate manually (please see Recreating Qlik Sense root CA certificate (manual back-up and removal of existing certificates).
3. Remove all current Qlik Sense certificates from NON-CENTRAL NODES by executing the following PowerShell code:
   

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   
   function RemoveCertificatesFromStore(
       [string] $name,
       [string] $location)
   {
       $success = 1
       $oid = "1.3.6.1.5.5.7.13.3"
   
       $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
       $localStore.Open("MaxAllowed")
   
       try
       {
           $certs = $localStore.Certificates
           foreach ($cert in $certs)
           {
               $extensions = $cert.Extensions
               foreach($extension in $extensions)
               {
                   if ($extension.Oid.Value.Equals($oid))
                   {
                       write-host "Deleting certificate from" $localStore.Name $localStore.Location
                       write-host " Subject:"$cert.Subject
                       write-host " Issuer:"$cert.Issuer
                       write-host " Serial:"$cert.SerialNumber
                       $localStore.Remove($cert)
                       break;
                   }
               }
           }
       }
   
       catch
       {
           write-host "An error occurred while removing certificates" -ForegroundColor Red
           write-host $_.Exception.GetType().FullName -ForegroundColor Red
           write-host $_.Exception.Message -ForegroundColor Red
           $success = 0
       }
   
       finally
       {
           $localStore.Close()
       }
   
       if ($success -ne 1)
       {
           exit 20
       }
   }
   
   function CleanCertificates()
   {
       RemoveCertificatesFromStore "Root" "LocalMachine"
       RemoveCertificatesFromStore "My" "LocalMachine"
       RemoveCertificatesFromStore "My" "CurrentUser"
   }
   
   CleanCertificates
   write-host "Done."
   exit 0​

4. Make sure script completes without any errors. Otherwise remove certificates manually (please see Recreating Qlik Sense root CA certificate (manual back-up and removal of existing certificates).
5. Remove all current Qlik Sense certificates from NON-CENTRAL NODES stored locally by deleting all files from following location:
   
   C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates
   
   
6. On ALL NODES navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location) and open Repository.exe.config file.
7. Make sure Certificates.SelfSignedRoot.BasicConstraintsCA key has value set to true, in example:
   
   <add key="Certificates.SelfSignedRoot.BasicConstraintsCA" value="true" />
   
   If the above key is not present, add it within <appSettings> section, in example:
   

   (…)
   <add key="BackgroundWork.CountLimit" value="3" />
   <add key="Certificates.SelfSignedRoot.BasicConstraintsCA" value="true" />
   <add key="DatabaseCommandTimeout" value="00:01:30" />
   (…)​

   
   NOTE: If you are installing a patch on November 2018 track, name of the key is: <add key="CertificatesSelfSignedRootBasicConstraintsCA" value="true" />
   
8. On the CENTRAL NODE, start Qlik Sense Repository Database service.
9. On CENTRAL NODE, from an elevated command line navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location) and run:
   

   repository.exe -bootstrap -iscentral​

10. When bootstrap mode has reached Entering main startup phase.., start Qlik Sense Service Dispatcher service and make sure that the Bootstrap mode has terminated. Press ENTER to exit.. final message is shown

Note: If this message is not shown, open Windows Task Manager, find Qlik Sense Repository Service in the Processes tab and end it by right-clicking on it and selecting End task.

1. To make sure new certificate is in use, run the C2 Validator tool,
2. On CENTRAL NODE restart Qlik Sense Service Dispatcher and start all remaining services.
3. On the NON-CENTRAL NODES, depending on the setup, perform either step a) or b) below:
   • Account running the Qlik Sense services has administrator privileges:
     1. [Applicable ONLY for April 2019 track]: Delete host.cfg file from C:\ProgramData\Qlik\Sense\ 
     2. Start Qlik Sense Repository Service.
     3. Open the Qlik Management Console (QMC) and redistribute the certificates according to Redistributing a certificate
     4. Restart Qlik Sense Repository Service and start all remaining services on the node to make sure they are using the newly distributed certificates.
   • Account running the Qlik Sense service does not have administrator privileges:
     1. [Applicable ONLY for April 2019 track]: Delete host.cfg file from C:\ProgramData\Qlik\Sense\ 
     2. At the command line, navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location), and run:
        repository.exe -bootstrap
     3. When the Waiting for certificates to be installed.. message is displayed, redistribute the certificates according to Redistributing a certificate
4. Once the bootstrap mode has terminated, start the Qlik Sense Service Dispatcher, then start the Qlik Sense Repository Service, and finally the remaining Qlik Sense services.

The process of migrating a Qlik Sense Enterprise for Windows environment after unbundling PostgreSQL is similar to Migrating any other Qlik Sense environment to a different host.

1. Begin with the Verification of all requirements, the Preparation Reading, and Backup as documented in Migrating Qlik Sense Enterprise to a different host 
   
   
2. Then install a supported version of PostgreSQL and prepare databases as documented in Installing and configuring PostgreSQL.

   Select your corresponding Qlik Sense Enterprise for Windows version from the dropdown select box

3. Install the Central Node using the new PostgreSQL instance prepared in step 2.
    
4. Restore the site. For this, we will use Restoring a Qlik Sense site to a machine with a different hostname, as a general guide, but we will follow a set of modified steps: 
   
   
   1. Stop all Qlik Sense Services you have just installed
   2. Drop the following databases:
      
      This step is only necessary if you already have data in the databases. Otherwise, skip this step and move to step d.
      
      
      • QSR
      • SenseServices
      • QSMQ
      • Licenses
        
        Use the command dropdb -h localhost -p 4432 -U postgres <Database>
        
        
   3. Create the same databases you have just dropped:
      
      
      • QSR
      • SenseServices
      • QSMQ
      • Licenses
        
        Use the command createdb -h localhost -p 4432 -U postgres -T template0 <Database> -O qliksenserepository
        
        
   4. Restore the newly created databases:
      
      
      • QSR
      • SenseServices
      • QSMQ
      • Licenses
        
        Use the command pg_restore -h localhost -p 4432 as documented in Restore the repository database 4.c in Restoring a Qlik Sense site to a machine with a different hostname.
        
        
5. Before proceeding with Restoring a Qlik Sense site to a machine with a different hostname steps 5 to 7:
   
   
   1. Evaluate and prepare your file share. If the share needs to be changed, follow the instructions in How to change the share path in Qlik Sense (Service Cluster)
   2. If you have a multi node with rim or worker nodes which will change names (FQDN), follow the instructions in What about my rim nodes? 
      Note that the LocalConfigs table is removed in the most recent Qlik Sense versions. Do not be alarmed if it is missing.
   3. If your Active Directory Domain changes, proceed with Qlik Sense Entrprise moved to a new domain from point 3 onwards, replacing the old domain name with the new domain, especially for RootAdmin users and new Service User Accounts. 
      
      
6. Continue with Restoring a Qlik Sense Site steps 5 to 7.
   
   
7. At this point, the Central node will be up and running and report its worker or rim nodes as down or not contacted. Continue with the Worker Nodes:
   
   
   1. If the Worker nodes are new, simply install Qlik Sense and add them to the central node
   2. If the Worker nodes have already existed, it may be necessary to regenerate and redistribute new certificates: 
      
      
      1. Open the MMC as the Service user account on the Worker Node and add the Certificate for the Local Server and Current User
      2. Back up the current SelfSigned Qlik Sense Certificate issued by the Old Central Node, then delete it.
      3. Back up and then remove files.pem in “C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates”
      4. Verify connection strings to the new database of the new Central node using the QlikSenseUtil and the scripts described in QlikSenseUtil and the ConfigureScript.ps1 for Qlik Sense Dispatcher subservices
      5. Start the services and after a short delay verify in the QMC if you need to repeat the Redistribution of Certificates.
         
         
   3. Repeat accordingly for remaining Worker Nodes      

Environment

• Qlik Sense Enterprise on Windows

Unable to access both Qlik Sense Enterprise on Windows QMC and hub. Web browser access fails with the error This site can't be reached.

Running Bootstrap on the Central node only shows Waiting for initial configuration to be run by node.

Resolution

Check if the file host.cfg exists in C:\Programdata\Qlik\Sense\

If the file is present, check if the file content decrypts to the correct Qlik Sense machine name by using, for example, https://www.base64encode.org/.

If no file exists, please create one named host.cfg and generate the Base64 content for the Rim node name via the site https://www.base64encode.org/.

Once the file is in place:

1. Stop all Qlik services 
2. Start the Qlik Sense Service Dispatcher Service 
   This service needs to run for the next steps to be successful. 
3. Open a Commandline prompt (Run > cmd) with administrative permissions (Right-Click > Run As Administrator)
4. Change to cd C:\Program Files\Qlik\Sense\Repository
5. Type and run Repository.exe" -bootstrap -iscentral -restorehostname 
6. Wait for the line Bootstrap mode has terminated. Press ENTER to exit..
7. Press ENTER and open the Windows services snap-in (Start > Run > services.msc)
8. Start up all services and check if you are able to access Qlik Sense HUB and QMC

Related Content

Rim node offline in QMC, bootstrap shows "Waiting for initial configuration to be run by node"
How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub 

Environment

• Qlik Sense Enterprise on Windows

On Talend Management Console execution screen, the following error is shown.

Failed to deploy task - received expired event. Datetime not in sync between Talend Management Console and Remote Engine. Check and sync datetime of Remote Engine.

Resolution

As Local Time on both the Remote Engine Server & Talend Management Center profile needs to be the same, you can edit your personal information and set up your language and region preferences from any of the Talend Cloud applications from the user menu (Profile Preferences).

To see whether the time is synchronized or not, please check the clock set in the remote engine server and then compare it with the time displayed at :
https://time.is/en/ (For example, if it is IST the link should be https://time.is/fr/IST 

The setup and configuration of NTP are beyond Talend support scope.

Cause

Remote Engine Server Time is not correct and it is probably caused by Product Configuration

Related Content

Please refer to below documentation to set up your user profile.

setting-up-your-user-profile

Environment

Talend Cloud 

If a TCP connection is possible with Qlik's licensing server endpoint, testing the connection to license.qlikcloud.com will return the message default backend - 404 or 404 Not Found (nginx).

When testing whether or not your Sense installation can successfully connect to the license backend, always test the connection with all nodes.

1. Open any web browser
2. Navigate to  https://license.qlikcloud.com
3. The response should be default backend - 404 or 404 Not Found (nginx).
   
   Other results, such as Can't reach this page or This site can't be reached with the error code ERR_CONNECTION_TIMED_OUT, indicate the Qlik Sense server cannot establish the needed TCP connection to the license server on the internet.

The 404 HTTP error code indicates the server was reached but could not find any content to be displayed in the URL address specified.

To avoid a 404 message, rather than accessing license.qlikcloud.com, open license.qlikcloud.com/sld.

Another test would be to use telnet and confirm a connection to port 443 is possible:

1. Open cmd as an Administrator
2. Type telnet license.qlikcloud.com 443, and hit Enter.
3. Confirm a blinking cursor is returned, which indicates a TCP-level connection has been established

If different results are returned:

• verify that the connection to license.qlikcloud.com:443 is allowed in your environment, such as by verifying firewall settings or other network security deployments
• if a web proxy is required for internet access, see Configuring a proxy for Qlik License Service communication in Qlik Sense Enterprise on Windows 
  
  

Environment

• Qlik Sense Enterprise on Windows, all versions licensed with a Signed License Key (SLK)

Related Content:

There was an error when getting license information from the license server