After renaming a group used in the Identity Provider (IdP) set up with Qlik Cloud Analytics, the old group name continues to be listed in Qlik Cloud.

Users can log in without issues using the updated information.

Resolution

Use Qlik-CLI to remove the old group name.

Example command: 

qlik group rm <groupId>

See Delete group by ID for details.

Cause

Qlik Cloud retrieves all its information on groups from the IdP (Identity Provider), but does not delete old groups. Old groups can be removed using the API.

Renaming a group will be perceived by Qlik Cloud as a new group having been created. 

Environment

• Qlik Cloud Analytics

Can Qlik Cloud Analytics Community Sheets be unpublished using a Qlik Automate block or the Qlik REST API?

There is no unpublish sheet block in Qlik Automate, and a simple unpublish option cannot be done with the Qlik REST API.

To note:

• Duplciating a published sheet will create a private copy for the user who has unpublished it. It will only be visible to them.
• The sheet will need to be unpublished first, and ownership then needs to be transferred back to the original user. (Example: Set owner on an app object. The user must be the owner of the object)
• The published sheet behaviour in Qlik Sense is such that when published, it cannot be modified. You first need to unpublish the sheet before deleting.
• If the status or ownership of the sheet has not changed as expected: a new session will be created when the existing session is closed, either through inactivity or by the browser tab being explicitly closed (after around 120 seconds).

Environment

• Qlik Cloud Analytics

A task being run from the Qlik Sense Management Console fails with the error:

App already updating

The issue is typically only seen for specific apps and cannot be observed with new apps. 

Resolution

Restart all Qlik Sense services on the Central node. See Manual Start and Stop order of Qlik Sense services for details.

Cause

The task or app is queued within the manager schedule but has not completed successfully. 

Environment

• Qlik Sense Enterprise on Windows

Qlik Sense Enterprise Client-Managed offers a range of Monitoring Applications that come pre-installed with the product.

Qlik Cloud offers the Data Capacity Reporting App for customers on a capacity subscription, and additionally customers can opt to leverage the Qlik Cloud Monitoring apps.

This article provides information on available apps for each platform.

Content:

• Qlik Cloud
• Data Capacity Reporting App
• Access Evaluator for Qlik Cloud
• Answers Analyzer for Qlik Cloud
• App Analyzer for Qlik Cloud
• Automation Analyzer for Qlik Cloud
• Entitlement Analyzer for Qlik Cloud
• Reload Analyzer for Qlik Cloud
• Report Analyzer for Qlik Cloud
• How to automate the Qlik Cloud Monitoring Apps
• Other Qlik Cloud Monitoring Apps
• OEM Dashboard for Qlik Cloud
• Monitoring Apps for Qlik Sense Enterprise on Windows
• Operations Monitor and License Monitor
• App Metadata Analyzer
• The Monitoring & Administration Topic Group
• Other Apps

Qlik Cloud

Data Capacity Reporting App

The Data Capacity Reporting App is a fully supported app distributed within the product. For more information, see Qlik Help.

Access Evaluator for Qlik Cloud

For more information, see Qlik Cloud Access Evaluator.

Answers Analyzer for Qlik Cloud

For more information, see Qlik Cloud Answers Analyzer.

App Analyzer for Qlik Cloud

For more information, see Qlik Cloud App Analyzer.

Automation Analyzer for Qlik Cloud

For more information, see Qlik Cloud Automation Analyzer.

Entitlement Analyzer for Qlik Cloud

The Entitlement Analyzer is a Qlik Sense application built for Qlik Cloud, which provides Entitlement usage overview for your Qlik Cloud tenant for user-based subscriptions.

The app provides:

• Which users are accessing which apps
• Consumption of Professional, Analyzer and Analyzer Capacity entitlements
• Whether you have the correct entitlements assigned to each of your users
• Where your Analyzer Capacity entitlements are being consumed, and forecasted usage

For more information, see The Entitlement Analyzer.

Reload Analyzer for Qlik Cloud

For more information, see Qlik Cloud Reload Analyzer.

Report Analyzer for Qlik Cloud

For more information, see Qlik Cloud Report Analyzer.

How to automate the Qlik Cloud Monitoring Apps

Do you want to automate the installation, upgrade, and management of your Qlik Cloud Monitoring apps? With the Qlik Cloud Monitoring Apps Workflow, made possible through Qlik's Application Automation, you can:

1. Install/update the apps with a fully guided, click-through installer using an out-of-the-box Qlik Application Automation template. 
2. Programmatically rotate the API key that is required for the data connection on a schedule using an out-of-the-box Qlik Application Automation template. This ensures that the data connection is always operational. 
3. Get alerted whenever a new version of a monitoring app is available using Qlik Data Alerts. 

For more information and usage instructions, see Qlik Cloud Monitoring Apps Workflow Guide.

Other Qlik Cloud Monitoring Apps

OEM Dashboard for Qlik Cloud

For more information and to download the app and usage instructions, see Qlik Cloud OEM Dashboard & Console Settings Collector.

With the exception of the Data Capacity Reporting App, all Qlik Cloud monitoring applications are provided as-is and are not supported by Qlik. Over time, the APIs and metrics used by the apps may change, so it is advised to monitor each repository for updates and to update the apps promptly when new versions are available.

If you have issues while using these apps, support is provided on a best-efforts basis by contributors to the repositories on GitHub.

Monitoring Apps for Qlik Sense Enterprise on Windows

Operations Monitor and License Monitor

The Operations Monitor loads service logs to populate charts covering performance history of hardware utilization, active users, app sessions, results of reload tasks, and errors and warnings. It also tracks changes made in the QMC that affect the Operations Monitor.

The License Monitor loads service logs to populate charts and tables covering token allocation, usage of login and user passes, and errors and warnings.

For a more detailed description of the sheets and visualizations in both apps, visit the story About the License Monitor or About the Operations Monitor that is available from the app overview page, under Stories.

Basic information can be found here:

The License Monitor 
The Operations Monitor 

Both apps come pre-installed with Qlik Sense. 

If a direct download is required: Sense License Monitor | Sense Operations Monitor. Note that Support can only be provided for Apps pre-installed with your latest version of Qlik Sense Enterprise on Windows. 

App Metadata Analyzer

The App Metadata Analyzer app provides a dashboard to analyze Qlik Sense application metadata across your Qlik Sense Enterprise deployment. It gives you a holistic view of all your Qlik Sense apps, including granular level detail of an app's data model and its resource utilization.

Basic information can be found here: 

App Metadata Analyzer (help.qlik.com)

For more details and best practices, see: 

App Metadata Analyzer (Admin Playbook)

The app comes pre-installed with Qlik Sense.

The Monitoring & Administration Topic Group

Looking to discuss the Monitoring Applications? Here we share key versions of the Sense Monitor Apps and the latest QV Governance Dashboard as well as discuss best practices, post video tutorials, and ask questions.

Monitoring & Administration 

Other Apps

LogAnalysis App: The Qlik Sense app for troubleshooting Qlik Sense Enterprise on Windows logs 
Sessions Monitor, Reloads-Monitor, Log-Monitor 
Connectors Log Analyzer 

All Other Apps are provided as-is and no ongoing support will be provided by Qlik Support.

Content

• Chapters
• Environment overview
• Zabbix Server set-up
• Clone the Zabbix docker repository
• Setting up environment variables
• Re-link compose.yaml to our preferred compose file
• Logging in for the first time
• Zabbix Agent installation on Windows Server
• Zabbix Server Configuration
• Adding the first Server
• Importing Qlik Sense Enterprise for Windows templates
• Linking templates to hosts
• Engine Healthcheck Monitoring with HTTP Agent example
• Steps to configure a new HTTP Agent for QSE Health monitoring
• Defining the Virtual Proxy prefix for Zabbix HTTP Agent
• Resources & Links

Chapters

• 01:33 - Why use Zabbix
• 02:35 - Architecture for demo
• 03:41 - Downloading the installer
• 04:36 - Installing Zabbix Server
• 08:37 - Installing the Zabbix agent
• 12:17 - Applying Qlik specific templates
• 14:28 - Reviewing Qlik-specific Dashboards
• 16:49 - Configuration details
• 18:42 - How to create a dashboard
• 20:30 - Q&A: Can Zabbix run on Windows?
• 21:16 - Q&A: Is Zabbix supported by Qlik?
• 21:36 - Q&A: Can this monitor data capacity?
• 22:45 - Q&A: Can the Zabbix agents affect performance?
• 23:20 - Q&A: Can it monitor bookmark size?
• 24:02 - Q&A: Can this monitor amount of data being used?
• 24:19 - Q&A: Can this monitor sheets, and objects in apps?
• 24:49 - Q&A: Is there a similar tool for Cloud?
• 25:36 - Q&A: Would this work with QlikView?
• 26:11 - Q&A: Does this read the app data?
• 26:26 - Q&A: Can this help measure how long to open an app?

The information in this article and video is provided as is. If you need assistance with Zabbix, please engage with Zabbix directly.

Environment overview

The environment being demonstrated in this article consists of one Central Node and Two Worker Nodes. Worker 1 is a Consumption node where both Development and Production apps are allowed. Worker 2 is a dedicated Scheduler Worker node where all reloads will be directed. Central Node is acting as a Scheduler Manager.

Zabbix Server set-up

The Zabbix Monitoring appliance can be downloaded and configured in a number of ways, including direct install on a Linux server, OVF templates and self-hosting via Docker or Kubernetes. In this example we will be using Docker. We assume you have a working docker engine running on a server or your local machine. Docker Desktop is a great way to experiment with these images and evaluate whether Zabbix fits in your organisation.

Clone the Zabbix docker repository

This will include all necessary files to get started, including docker compose stack definitions supporting different base images, features and databases, such as MySQL or PostgreSQL. In our example, we will invoke one of the existing Docker compose files which will use PostgreSQL as our database engine.

Source: https://www.zabbix.com/documentation/current/en/manual/installation/containers#docker-compose

git clone https://github.com/zabbix/zabbix-docker.git

Setting up environment variables

Here you can modify environment variables as needed, to change things like the Stack / Composition name, default ports and many other settings supported by Zabbix.

cd ./zabbix-docker/env_vars
ls -la #to list all hidden files (.dotfiles)
nano .env_web

In this file, we will change the value for ZBX_SERVER_NAME to something else, like "Qlik STT - Monitoring". Save the changes and we are ready to start up Zabbix Server.

Re-link compose.yaml to our preferred compose file

./zabbix-docker folder contains many different docker compose templates, either using public images or locally built (latest and local tags).

You can run your chosen base image and database version with:

docker compose -f compose-file.yaml up -d && docker compose logs -f --since 1m

Or unlink and re-create the symbolic link to compose.yaml, which enables managing the stack without specifying a compose file. Run the following commands inside the zabbix-docker folder to use the latest Ubuntu-based image with PostgreSQL database:

1. unlink compose.yaml
2. ln -s ./docker-compose_v3_ubuntu_pgsql_latest.yaml compose.yaml
3. Start the Zabbix stack in detached mode with docker compose up -d

If you skip the -d flag, the Docker stack will start and your command line will be connected to the log output for all containers. The stack will stop if you exit this mode with CTRL+C or by closing the terminal session. Detached mode will run the stack in background. You can still connect to the live log output, pull logs from history, manage the stack state or tear it down using docker compose down.

Pro tip: you will be using docker compose commands often when working with Docker. You can create an alias in most shells to a short-hand, such as "dc = docker compose". This will still accept all following verbs, such as start|stop|restart|up|down|logs and all following flags. docker compose up -d && docker compose logs -f --since 1m would become dc up -d && dc logs -f --since 1m.

Logging in for the first time

• By default, the Zabbix Web GUI will be exposed on ports 80/443
• Using tools like Portainer makes Docker stack management easier

Use the IP address of your Docker host: http://IPADDRESS or https://IPADDRESS.

The Zabbix server stack can be hosted behind a Reverse Proxy.

The default username is Admin and the default password is zabbix. They are case sensitive.

Zabbix Agent installation on Windows Server

Download link: https://www.zabbix.com/download_agents, in this case download the Windows installer MSI.

1. Run the installer .msi
2. Leave components unchanged
3. Hostname = your machine hostname, we will have to use the same hostname when adding a Host in Zabbix Server.
4. Zabbix server IP/DNS: IP address or DNS name of your Zabbix Server
5. Agent listening port, the same port will be used when when adding a Host in Zabbix Server.
6. Enable "Add agent location to the PATH" for convenience in the command line
7. Finish installation

Zabbix Server Configuration

Adding the first Server

After Agent is installed, in Zabbix go to Data Collection > Hosts and click on Create host in the top right-hand corner. Provide details like hostname and port to connect to the Agent, a display name and adjust any other parameters. You can join clusters with Host groups. This makes navigating Zabbix easier.

Fig 1: Adding a Host

 

Note: Remember to change how Zabbix Server will connect to the Agent on this node, either with IP address or DNS. Note that the default IP address points to the Zabbix Server.

Importing Qlik Sense Enterprise for Windows templates

In the Zabbix Web GUI, navigate to Data Collection > Templates and click on the Import button in the top right-hand corner. You can find the templates file at the following download link:

LINK to zabbix templates

Linking templates to hosts

Once you have added all your hosts to the Data Collection section, we can link all Qlik Sense servers in a cluster using the same templates. Zabbix will automatically populate metrics where these performance counters are found. From Data Collection > Hosts, select all your Qlik Sense servers and click on "Mass update". In the dialog that comes up, select the "Link templates" checkbox. Here you can link/replace/unlink templates across many servers in bulk.

Select "Link" and click on the "Select" button. This new panel will let us search for Template groups and make linking a bit easier. The Template Group we provided contains 4 individual templates.

Fig 2: Mass update panel

Fig 3: Search for Template Group

Once you Select and Update on the main panel, all selected Hosts will receive all items contained in the templates, and populate all graphs and Dashboards automatically.

To review your data, navigate to Monitoring > Hosts and click on the "Dashboards" or "Graphs" link for any node, here is the default view when all Qlik Sense templates are linked to a node:

Fig 4: Host Dashboards

 

Fig 5: Repository Service metrics - Example

Engine Healthcheck Monitoring with HTTP Agent example

We will query the Engine Healthcheck end-point on QlikServer3 (our consumer node) and extract usage metrics from by parsing the JSON output.

Steps to configure a new HTTP Agent for QSE Health monitoring

We will be using a new Anonymous Access Virtual Proxy set up on each node. This Virtual Proxy will only Balance on the node it represents, to ensure we extract meaningful metrics from the Engine and we won't be load-balanced by the Proxy service across multiple nodes. There won't be a way to determine which node is responding, without looking at DevTools in your browser. You can also use Header or Certificate authentication in the HTTP Agent configuration.

Once the Virtual Proxy is configured with Anonymous Only access, we can use this new prefix to configure our HTTP Agent in Zabbix.

Defining the Virtual Proxy prefix for Zabbix HTTP Agent

In the Zabbix web GUI, go to Data collection > Hosts. Click on any of your hosts. On tabs at the top of the pop-up, click on Macros and click on the "Inherited and host macros" button. Once the list has loaded, search for the following Macro: {$VP_PREFIX}. This is set by default to "anon". Click on "Change" and set Macro value to your custom Virtual Proxy Prefix for Engine diagnostics, and click Update. The Virtual Proxy prefix will have to be changed on each node for the "Engine Performance via HTTP Agent" item to work. Alterantively, you can modify the MACRO value for the Template, this will replicate the changes across all nodes associated to this Template.

To make this change at the Template level, go to Data collection > Templates. Search for the "Engine Performance via HTTP Agent" and click on the Template. Navigate to the Macros tab in the pop-up and add your Virtual Proxy Prefix here to make this the new default for your environment. No further changes to Node configuration are required at this point.

The Zabbix templates provided in this article contain the following Engine metric JSONParsers:

• Memory: Allocated, Committed, Free, Total Physical
• Calls, Selections
• Saturation status (true/false)
• Sessions: Active/Total
• Users: Active/Total

These are the same performance counters that you can see in the Engine Health section in QMC.

Stay tuned to new releases of the Monitoring Templates. Feel free to customise these to your needs and share with the Community.

Resources & Links

• Zabbix home page
• Zabbix Installation from containers documentation
• Zabbix Docker repository on GitHub
• Install Docker Engine on Ubuntu

Environment

• Qlik Sense Enterprise on Windows

Opening the QlikView Management Console (QMC) shows an orange banner across the top:

Lef expires DD/MM/YYYY

• QlikView any version

Expired Maintenance

Your maintenance support period has or is going to soon expire. Note that this can apply for both a QlikView Server license as well as a QlikView Publisher license. 

Review your LEF information for the following tag:

Perpetual License: 

• PRODUCTLEVEL;10;;2019-01-31
• PRODUCTLEVEL;30;;2019-01-31

Subscription License:

• TIMELIMIT;VALUE;2021-06-30;2022-06-30

To solve:

If you have not renewed your maintenance contract, this is expected and working as designed. Although the banner reads, the system remains working, but cannot be upgraded or supported by Qlik.

If your contract has been renewed, do the following:

1. Go to the QlikView Management Console
2. Navigate to System > Licenses
3. Choose your QVS@node/QMS@node  (check both)  and open the QlikView Server Licenses tab (Note: Be sure to check the Publisher license key as well.)
4. On the bottom, click: Update License from Server
   
   
   
   
5. Restart the QlikView services.

NOTE: 

• Be sure to check the Publisher license key as well.  If the Publisher LEF has expired it will also display the orange banner. You will need to update the License as well. 
• If the license has been extended with a time limit, example - TIMELIMIT;VALUE;;2022-05-21 the product will work until the mentioned time limit date  how ever the banner will still show the expired message in the management console, this is work as design.

Signed License Key applied

Another root cause may be a known issue with Signed key License on QlikView 12.40, or improper permissions assigned to Qlik Service Dispatcher. Product Defect ID(s): QV-17628

To solve:

If you are using version 12.40, note that there is a new service called Qlik Service Dispatcher. An admin account needs to be applied to resolve the issue. Qlik Management Service (QMS) may also need to be restarted as a workaround.

This issue is resolved in 12.50.

Erlang/Open Telecom Platform (OTP) has disclosed a critical security vulnerability: CVE-2025-32433.

Is Qlik NPrinting affected by CVE-2025-32433?

Resolution

Qlik NPrinting installs Erlang OTP as part of the RabbitMQ installation, which is essential to the correct functioning of the Qlik NPrinting services.

RabbitMQ does not use SSH, meaning the workaround documented in Unauthenticated Remote Code Execution in Erlang/OTP SSH is already applied. Consequently, Qlik NPrinting remains unaffected by CVE-2025-32433.

All future Qlik NPrinting versions from the 20th of May 2025 and onwards will include patched versions of OTP and fully address this vulnerability.

Environment

• Qlik NPrinting

The Qlik Sense Mobile app allows you to securely connect to your Qlik Sense Enterprise deployment from your supported mobile device. This is the process of configuring Qlik Sense to function with the mobile app on iPad  / iPhone.

This article applies to the Qlik Sense Mobile app used with Qlik Sense Enterprise on Windows. For information regarding the Qlik Cloud Mobile app, see Setting up Qlik Sense Mobile SaaS. 

Content:

• Pre-requirements (Client-side)
• Configuration (Server-side)
• Update the Host White List in the proxy
• Configuration (Client side)

Pre-requirements (Client-side)

See the requirements for your mobile app version on the official Qlik Online Help > Planning your Qlik Sense Enterprise deployment > System requirements for Qlik Sense Enterprise > Qlik Sense Mobile app

Configuration (Server-side)

Acquire a signed and trusted Certificate.

Out of the box, Qlik Sense is installed with HTTPS enabled on the hub and HTTP disabled. Due to iOS specific certificate requirements, a signed and trusted certificate is required when connecting from an iOS device. If using HTTPS, make sure to use a certificate issued by an Apple-approved Certification Authority.
Also check Qlik Sense Mobile on iOS: cannot open apps on the HUB  for issues related to Qlik Sense Mobile on iOS and certificates.

For testing purposes, it is possible to enable port 80.

(Optional) Enable HTTP (port 80).

1. Open the Qlik Sense Management Console and navigate to Proxies.
2. Select the Proxy you wish to use and click Edit Proxy.  
3. Check Allow HTTP 

Update the Host White List in the proxy 

If not already done, add an address to the White List:

1. In Qlik Management Console, go to CONFIGURE SYSTEM -> Virtual Proxies
2. Select the proxy and click Edit
3. Select Advanced in Properties list on the right pane
   
   

    

4. Scroll to Advanced section in the middle pane
5. Locate "Allow list"
   
   

    

6. Click "Add new value" and add the addresses being used when connecting to the Qlik Sense Hub from a client. See How to configure the WebSocket origin allow list and best practices for details. 
   
   

Generate the authentication link:

An authentication link is required for the Qlik Sense Mobile App.

1. Navigate to Virtual Proxies in the Qlik Sense Management Console and edit the proxy used for mobile App access
2. Enable the Client authentication link menu in the far right menu.
3. Generate the link.

NOTE: In the client authentication link host URI, you may need to remove the "/" from the end of the URL, such as http://10.76.193.52/ would be http://10.76.193.52 

Associate User access pass

Users connecting to Qlik Sense Enterprise need a valid license available. See the Qlik Sense Online Help for more information on how to assign available access types.
Qlik Sense Enterprise on Windows > Administer Qlik Sense Enterprise on Windows > Managing a Qlik Sense Enterprise on Windows site > Managing QMC resource > Managing licenses

• Managing professional access
• Managing analyzer access
• Managing user access
• Creating login access rules

Configuration (Client side)

1. Install Qlik Sense mobile app from AppStore.
2. Provide authentication link generated in QMC
   • Open the link from your device (this can be also done by going to the Hub, clicking on the menu icon at the top right and selecting "Client Authentication"), the installed application will be triggered automatically, and the configuration parameters will be applied.
   •  Enter user credentials for QS server

When using SAML or ticket authentication in Qlik Sense, some users belonging to a big number of groups see the error 431 Request header fields too large on the hub and cannot proceed further.

Resolution

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

The default setting will still be a header size of 8192 bytes. The fix adds support for a configurable MaxHttpHeaderSize.

Steps:

1. To configure add it at the top section of the file under [globals] (C:\Program Files\Qlik\Sense\ServiceDispatcher\service.conf)

   [globals]
   LogPath="${ALLUSERSPROFILE}\Qlik\Sense\Log"
   (...)
   MaxHttpHeaderSize=16384

2. Once the change is done, save the file and restart the Qlik Service Dispatcher service.

Note: The above value (16384) is an example. You may need to put more depending on the total number of characters of all the AD groups to which the user belongs. The max value is 65534.

Environment:

Qlik Sense Enterprise on Windows 

This article offers an example on how to set up a security rule matching to a role which is restricted to seeing only "License Management" in the Qlik Sense Management Console.

! The example is provided for demonstration purposes to explain a specific scenario. No support or maintenance is implied or provided. Further customization is expected to be necessary and it is the responsibility of the end administrator to test and implement an appropriate rule for their specific use case. For access to more tips and tricks, best practices, and ever-evolving creative solutions, we recommend joining us in our active Qlik Community.

Setup:

• Open the Qlik Sense Management Console and open the Security Rules menu
• Click Create new button

ServiceCluster_*,ServerNodeConfiguration_*,Engine*,Proxy*,VirtualProxy*,Repository*,Printing*,Scheduler*,User*,CustomProperty*,Tag_*,License*,TermsAcceptance_*,ReloadTask_*,UserSyncTask_*,SchemaEvent_*,CompositeEvent_*,QmcSection_License*,SystemRule_*

• Press Apply 

Expected outcome:

The user who is assigned to the LicenseAdmin role only has the privilege "License and tokens".

Related Content

• Qlik Sense Management Console sections grayed out and cannot be accessed 
• Security Rules: Control Access to sections in QlikSense Management Console 

While attempting to run a Job in TAC, an error occurred as follows:

ERROR ExecutionTaskHandler - Port value out of range: 75543
java.lang.IllegalArgumentException: Port value out of range: 75543

These port values will vary in each entry of the technical logs.

Cause

This error will be caused due to a change in the default TCP port range in the TAC configuration table. The TAC configurations table contains a configurable value named "scheduler.conf.statisticsRangePorts". A valid TCP port falls within the range of 1 to 65535, typically between 1024 and 65535. The default value for this parameter is 10000-11000. If this value is exceeded, you will encounter this error in TAC.

Resolution

To address this issue, please follow these steps:

1. Stop TAC.
2. Change the value to the default range of 10000-11000 for the parameter “scheduler.conf.statisticsRangePorts” in the configuration table located in the TAC database.
3. Start TAC.

Environment

• Talend Administration Center 8.0.1

How are sessions counted in Qlik Sense? 

The following are examples of how sessions are counted within Qlik Sense.  

• One user opens Qlik Sense Hub with One browser on One machine = 1 session
• One user opens Qllik Sense Hub with One browser but Multiple tabs on One machine= 1 session
• One user opens Qlik Sense Hub with Two different browsers on One machine= 2 sessions
• One user opens Qlik Sense Hub with One browser, then closes the browser and reopens it = 2 sessions
• One user opens Qlik Sense Hub with One browser on Two different machines = 2 sessions
• One user opens Qlik Sense Hub and two Apps in one browser, two different tabs and on a mobile device = 2 sessions
• One user opens Qlik Sense Hub from Two virtual proxy with One browser on One machine= 2 sessions
• One user opens Qlik Sense Management Console (QMC) with One browser on One machine = 1 session
• One user opens a Qlik Sense Mashup using Two Apps hosted from the same proxy = 1 session

Sessions will be terminated after the currently configured Session timeout in the Qlik Sense Proxy.
If the Qlik Sense engine or Proxy are terminated or crash, Sessions are ended right away.

Once the maximum number of parallel user connections (5) is reached, this will be documented in the AuditSecurity_Repository log. To identify if this is the issue, review the relevant log and review how the user is interacting with the system. 

The log is stored in:
C:\Programdata\Qlik\Sense\Log\Repository\Audit\AuditSecurity_Repository.txt

The related message reads: 
Access was denied for User: 'Domain\USER', with AccessID '264ff070-6306-4f1b-85db-21a8468939b5', SessionID: 'e3cd957b-a501-4bec-a3f8-d35170a73efa', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'

Related content:

Troubleshoot too many sessions active in parallel
Qlik Sense April 2018 and later- Service account getting "You cannot access Qlik Sense because you have no access pass"
 

A scheduled Qlik Replicate task does not show up in the Executed Jobs list.

This is working as intended. The Executed Jobs tab will only show executed jobs that were scheduled to run once only. In other words, jobs scheduled to run periodically (e.g. Daily, Weekly, Monthly) will not be shown.

See Scheduling jobs.

Environment

Qlik Replicate 

There may be several different symptoms associated with a need to regenerate and redistribute certificates;

• After installing, renewing, or changing a third-party certificate for use with Qlik Sense the Qlik Management Console (QMC) and Hub may become inaccessible leading to Page Cannot Be Displayed error.
  
  

  This article does not cover the use of a 3rd party certificate for end user Hub access, but the certificates used for communication between the Sense services. For recommendation on how to use a 3rd party certificate for end user access, see How to: Change the certificate used by the Qlik Sense Proxy to a custom third party certificate

• In the Qlik Sense Proxy trace logs, the last line may be indicating waiting for certificates to be installed or similar. In addition, even though Proxy service remains running, port 443 (by default) will fail to bind and start listening for requests.
  
  
• Qlik Sense may sometimes fail to create the correct certificates during installation if there are old/unused certificates left from a previous installation.  Also, certs can become corrupted, or newly installed certificates configured to be used may not be compatible. See Qlik Sense: Compatibility information for third-party SSL certificates and Requirements for configuring Qlik Sense with SSL.

Do not perform the below steps in a production environment, without first doing a backup of the existing certificates. Certificates are being used to encrypt information in the QRS database, such as connection strings. By recreating certificates, you may lose information in your current setup.
By removing the old/bad certificates, and restarting the Qlik Sense Repository Service (QRS), the correct certificates can be recreated by the service. If trying to remove certs, only the removal steps need to be followed.

The instructions are to be carried out on the Qlik Sense Central Node. In the case of a multi-node deployment, verify which node is the central node before continuing.

1. Open Qlik Sense Management Console (QMC)
2. Navigate to Nodes section
3. Add the column Central Node column through Column selector

If the current central node role is held by the failover, you need to fail the role back to the original central node by shutting down all the nodes (this implies downtime). Then start the original central node, reissue the certificates on it with this article, and when the central node is working apply the article Rim node not communicating with central node - certificates not installed correctly on each Rim node.

Step by Step instructions:

Test all data connections after the certificates are regenerated.  It is likely that data connections with passwords will fail.  This is because passwords are saved in the repository database with encryption.  That encryption is based on a hash from the certificates.  When the Qlik Sense signed certificates are regenerated, this hash is no longer valid, and the saved data connection passwords can not be decrypted.  The customer must re-enter the passwords in each data connection and save.  See article: Repository System Log Shows Error "Not possible to decrypt encrypted string in database"

1. Log on to the Central node using the Qlik Service Account and navigate to the 'Services' and to the Qlik Services.
   
   
2. Stop the QRS (this will also stop the other services; however, make sure the postgresql-64-12 or Qlik Sense Repository Database is still running).
   
   
    
3. Open Microsoft Management Console (MMC). 
   
   Important: Execute the MMC as the account configured to run the services (using Run as a different user [Ctrl-Shift & Right click on the exe to see option]... )
   
   
4. Add the following snap-ins for Certificates:
   
   
   • My user account
   • Local Computer account
     
     
5. In Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates, delete the Self-Signed certificates created by Qlik Sense, issued by HOSTNAME.domain-CA*
   
   *Where HOSTNAME is the machine name of the server in question and domain is the domain of the server.
   So for example, QlikServer1 is the computer hostname and the domain is domain.local, the certificate will be issued by QlikServer1.domain.local-CA
    
6. In Certificates (Local Computer) > Personal > Certificates, delete the Self-Signed certificate issued by HOSTNAME.domain-CA
   
   
7. In Certificates > Current User > Personal > Certificates, delete the Self-Signed certificate named QlikClient
    
8. Go to the folder C:\ProgramData\Qlik\Sense\Repository, delete the folder 'Exported Certificates'
   
   
9. Run this command from an elevated (admin) command prompt to create new certificates:
   
   "C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname 
   
   Note: If the script doesn't get to "Bootstrap mode has terminated. Press ENTER to exit.." and gets stuck at "[INFO] Entering main startup phase.." start the "Qlik Sense dispatcher service" and it will get to the end)
   
   
10. Verify the new certificates have been created by REFRESHING the screen for each certificate location, and then start the rest of the Qlik Sense services. In addition, verify that duplicate or multiple certificates were not created (rarely occurs). If so, the article will need to be followed again by starting with the deletion of the certificates.
    

There is no need to perform a full reinstall to propagate new certificates. Certificates are created by the QRS automatically if not found during the service startup process.

For Qlik Sense multi-cloud deployment (September 2020 or later):

The steps in this section must be performed after recreating certificates as described above.

1. Start Qlik Sense Repository Database service on CENTRAL NODE, or PostgreSQL Server service if running a dedicated instance of PostgreSQL database server.
   
   
2. Using pgAdmin tool or any other database client, connect to SenseServices database. (IMPORTANT: the below query needs to be executed on the SenseServices DB)
   
   

3. Execute following query against SenseServices database:

   DROP TABLE IF EXISTS hybrid_deployment_service.mt_doc_asymmetrickeysencrypt CASCADE;

    

4. Navigate to Deployments page of Multi-cloud Setup Console (MSC).

5. Delete and re-add any existing deployments by following the steps mentioned in Distributing apps from Qlik Sense Enterprise on Windows to Qlik Sense Enterprise SaaS  and Distributing apps to Qlik Sense Enterprise on Kubernetes.

Node.js certificates

After the certificates have been recreated and then redistributed to all of the rim nodes, the node.js certificates stored locally on the central and all rim nodes also need to be recreated. Follow the below steps to perform this action:

1. Stop all Qlik Sense services
   
   
2. In Windows File Explorer, navigate to %ProgramData%\Qlik\Sense\Repository\Exported_certificates
   
   
3. Back up the Local certificates directory and then delete it
   
   
4. Restart the Qlik Sense services

Test all data connections after the certificates are rebuilt.  It is likely that data connections with passwords will fail.  This is because passwords are saved in the repository database with encryption.  That encryption is based on a hash from the certs.  When the Qlik Sense self-signed cert is rebuilt, this hash is no longer valid, and so the saved data connection passwords will fail.  The customer must re-enter the passwords in each data connection and save.  See article: Repository System Log Shows Error "Not possible to decrypt encrypted string in database"

Self Signed Certificates:

Notice if using an official Signed Server Certificate from a trusted Certificate Authority

The certificate information will also be in the QMC, under Proxies, with the Certificate thumbprint listed. If trying to merely remove all aspects of certs, this will need to be removed as well.

1. Go to Proxies 
   
   
2. Select your Proxy and click Edit
   
   
3. In the right pane, select Security
   
   
4. Scroll down and locate "SSL browser certificate thumbprint" in the Security section to locate the thumprint info.

If the Central Node repository service hanging in the logs:

1. Open C:\ProgramData\Qlik\Sense\Log\Repository\Trace
   
   
2. Look for this Example "API service initialized with 1501 available methods".  This is Central Node. 
   
   
3. If you see this Example "API service initialized with 2 available methods". This is a Rim node. 
   
   
4. For Central Node you should see as an example ""API service initialized with 1501 available methods". 
   
   
5. Running this command "C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname will resolved this issue.
   
   

If the above does not work, see Qlik Sense Enterprise Hub and Qlik Management Console (QMC) down - bootstrap fails with "Newly created client certificate not valid; root certificate can't sign new certificates"

This Techspert Talks session addresses:

• Understanding Back-end Infrastructure
• Measure 
• Monitor
• Troubleshoot

Tip: Download the LogAnalyzer app here: LogAnalysis App: The Qlik Sense app for troubleshooting Qlik Sense Enterprise on Windows logs.

The Qlik Sense log files can be easily collected using the Log Collector. 

The Log Collector is embedded in the Qlik Sense Management Console. It is the last item listed in the Configure Systems section.

For instructions on how to use the Log Collector, see Log collector (help.qlik.com).

Content

• Requirements
• Using the Log Collector
• What does the Qlik Sense Log Collector access?
• Manually collecting log files
• Older Qlik Sense Versions (3.1 and earlier)

Requirements

The user must be a root admin and have administrative permissions.

Using the Log Collector

The best way to gather these logs is to use the Qlik Sense Log Collector. If the tool is not included in your install, it can be downloaded from this article. 

1. Login to Windows Server on Qlik Sense node
2. Open Windows File Explorer
3. Navigate to Log Collector folder at C:\Program Files\Qlik\Sense\Tools\QlikSenseLogCollector
4. Press Shift key and right click on QlikSenseLogCollector.exe 
5. Select Run as different user
6. Enter Qlik Sense service account credentials.
7. Configure log collection
   • Date range to collect logs from (minimum of 5 days if possible)
   • Support case number to include in ZIP file name
   • Select options 
   • Include Archive logs
8. Click Collect
9. If Qlik Sense is not automatically accessible on the node, further options are presented.  
   • Qlik Sense is running and on this host
     this option to get more options on automatic log collection
   • Qlik Sense is not running or accessible
     this option allows to define the path to local Qlik Sense log folder
   • Qlik Sense is located elsewhere
     this option allows to enter FQDN of remote Qlik Sense server
10. Wait until collection is finished
11. Click Close
12. Open generated ZIP file in C:\Program Files\Qlik\Sense\Tools\QlikSenseLogCollector
    Note, no need to unzip the file, simple double click on the ZIP file to browse its content
    • Confirm it contains JSON and TXT files, if system info options were enabled in Step 6
    • Confirm there is one folder per node in the deployment, named in same way as the node
    • Confirm there is a Log folder representing Archived Logs from persistent storage
13. If ZIP content is incomplete, repeat steps above or contact support for further guidance
14. If ZIP content is accurate, attach ZIP file to support case for further analysis by Qlik

What does the Qlik Sense Log Collector access?

This list provides an overview of what system information the Qlik Sense Log collector accesses and collects.

• WhoAmI (information)

  C:\Windows\System32\whoami.exe

• Port status (information)

  C:\Windows\System32\netstat.exe -anob

• Process Info (information)

  C:\Windows\System32\tasklist.exe /v

• Firewall Info (information)

  C:\Windows\System32\netsh.exe advfirewall show allprofiles

• Network Info (information)

   C:\Windows\System32\ipconfig.exe /all

• IIS Status (iisreset /STATUS Display the status of all Internet services.)

   C:\Windows\System32\iisreset.exe /status

• Proxy Activated (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "ProxyEnable"

• Proxy Server (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "proxyserver" 

• Proxy AutoConfig (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "AutoConfigURL" 

• Proxy Override (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "ProxyOverride" 

• Internet Connection (information)

   C:\Windows\System32\ping.exe google.com

• Drive Mappings (information)

   C:\Windows\System32\net.exe use

• Drive Info (information)

   C:\Windows\System32\wbem\wmic.exe /OUTPUT:STDOUT logicaldisk get size

• Localgroup Administrators (information)

   C:\Windows\System32\net.exe localgroup "Administrators"

• Localgroup Sense Service Users (information)

   C:\Windows\System32\net.exe localgroup "Qlik Sense Service Users"

• Localgroup Performance Monitor Users (information)

   C:\Windows\System32\net.exe localgroup "Performance Monitor users"

• Localgroup Qv Administrators (information)

   C:\Windows\System32\net.exe localgroup "QlikView Administrators"

• Localgroup Qv Api (information)

   C:\Windows\System32\net.exe localgroup "QlikView Management API"

• System Information (information)

   C:\Windows\System32\systeminfo.exe

• Program List (information)

   C:\Windows\System32\wbem\wmic.exe /OUTPUT:STDOUT product get name

• Service List (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "gwmi win32_service | select Started

• Group Policy (information)

  C:\Windows\System32\gpresult.exe /z

• Local Policies - User Rights Assignment (information)

   C:\Windows\System32\secedit.exe /export /areas USER_RIGHTS /cfg

• Local Policies - Security Options (information)

   C:\Windows\System32\secedit.exe /export /areas

• Certificate - Current User(Personal) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\currentuser\my | Format-list"

• Certificate - Current User(Trusted Root) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\currentuser\Root | Format-list"

• Certificate - Local Computer(Personal) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\localmachine\my | Format-list"

• Certificate - Local Computer(Trusted Root) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\localmachine\Root | Format-list"

• HotFixes (information)

  $FormatEnumerationLimit=-1;$Session = New-Object -ComObject Microsoft.Update.Session;$Searcher = $Session.CreateUpdateSearcher();$historyCount = $Searcher.GetTotalHistoryCount();$Searcher.QueryHistory(0, $historyCount) | Select-Object Title, Description, Date, @{name="Operation"; expression={switch($_.operation){1 {"Installation"}; 2 {"Uninstallation"}; 3 {"Other"}}}} | out-string -Width 1024

• UrlAclList (information)

   C:\Windows\System32\netsh.exe http show urlacl

• PortCertList (information)

   C:\Windows\System32\netsh.exe http show sslcert

Manually collecting log files

Any versions of Qlik Sense Enterprise on Windows prior to May 2021, do not include the Log Collector.

If the Qlik Sense Log collector does not work then you can manually gather the logs.

• Default storage (before archiving): C:\ProgramData\Qlik\Sense\Log
• Default archive storage: C:\ProgramData\Qlik\Sense\Repository\Archived Logs
• Manual retrieval of Reload logs: How to find the Script (Reload) logs in Qlik Sense Enterprise

For information on when logs are archived, see How logging works in Qlik Sense Enterprise on Windows.

Older Qlik Sense Versions (3.1 and earlier)

Persistence Mechanism Current Logs(Active Logs) Archived Logs

Note: Depending on how long the system has been running, this folder can be very large so you will want to include only logs from the time frame relevant to your particular issue; preferably a day before the issue began occurring.

Related Content

How logging works in Qlik Sense Enterprise on Windows 

Content

• Rationale
• Understanding interactive IdPs in Qlik Cloud
• Why Qlik Cloud only supports one interactive IdP
• Why Federate Identity In-House?
• Solution: Federate IdPs with an enterprise-grade IdP
• How to Implement a Federated IdP
• Conclusion

Qlik Cloud is designed to support a single interactive Identity Provider (IdP) per tenant.

This approach enhances security, governance, and operational control while simplifying authentication management. Organizations that require multiple identity sources can achieve this by using a federated IdP (such as Azure Entra, Auth0, Keycloak, or Okta) to consolidate authentication and seamlessly connect it to Qlik Cloud, as described by @Leigh_Kennedy in Using Multiple concurrent Identity Providers with Qlik Cloud.

Rationale

Understanding interactive IdPs in Qlik Cloud

Qlik Cloud allows organizations to configure an interactive IdP to manage user authentication. Options include:

• Qlik Account (default for new, non-government tenants).
• A standards-compliant OIDC or SAML provider, such as Azure Entra, Okta, Auth0, or Keycloak.

Any unauthenticated user attempting to access the tenant is redirected to the configured interactive IdP for authentication, ensuring a streamlined and secure login experience.

Why Qlik Cloud only supports one interactive IdP

Using a single interactive IdP is a best practice for identity management and ensures consistency, security, and simplified administration.

Key reasons include:

• User Identity Consistency: Qlik Cloud relies on a user's subject and email as unique identifiers. Managing a single interactive IdP helps prevent duplicate identities and ensures seamless user access, reducing risk of users gaining unauthorized access to sensitive data or permissions.

• Streamlined Identity & Access Management: Since Qlik Cloud does not transform incoming claims beyond remapping keys, keeping authentication centralized prevents unintended variances in usernames, email formats, or group names. This improves security and reduces maintenance of licenses and entitlements.

• Optimized Group Management: A single interactive IdP provides a consistent structure for groups, ensuring they align with an organization’s access policies. By managing group filtering in one place, organizations can maintain clear and structured permissions. Managing groups across multiple IdPs can quickly become unmanageable, leading to inconsistencies in user access.

• Simplified Access Control: Groups in Qlik Cloud are referenced by name, making it more efficient to manage access through a single federated IdP rather than multiple sources.

• Efficient Token Management: A unified IdP helps maintain consistency in authentication tokens, reducing administrative overhead and ensuring a smooth user experience.

• Enhanced Security & Auditability: By centralizing authentication through a single IdP, organizations can apply security controls, enforce device policies, and monitor user access through audit logs.

A federated IdP ensures that organizations retain full control over authentication policies, while providing a seamless experience for users accessing Qlik Cloud.

Why Federate Identity In-House?

Many organizations choose to use a federated identity provider to streamline identity management, enhance security, and improve user experience across multiple applications. Benefits include:

• Centralized User Lifecycle Management: Users from different sources can be managed in a single system, reducing duplication and inconsistencies.

• Improved Security Policies: Organizations can enforce multi-factor authentication (MFA), conditional access policies, and device trust settings at the IdP level.

• Single Sign-On (SSO) Across Applications: Users authenticate once and gain seamless access to multiple platforms, including Qlik Cloud.

• Comprehensive Logging & Compliance: A federated IdP provides consolidated audit trails and governance controls for user authentication.

By implementing a federated identity provider, organizations can maintain flexibility in their authentication strategy while ensuring compatibility with Qlik Cloud.

Solution: Federate IdPs with an enterprise-grade IdP

The recommended approach for organizations that need to authenticate users across multiple identity sources is to configure a federated IdP that consolidates authentication. Solutions like Azure Entra ID or Okta can be used to unify identity management and connect to Qlik Cloud via OIDC or SAML.

How to Implement a Federated IdP

1. Set Up a Federated IdP (Azure Entra ID, Okta, or another identity management solution).

2. Sync Identity Sources within the federated IdP to ensure unique identities across different user groups.

3. Configure OIDC/SAML Authentication in Qlik Cloud with the federated IdP.

This approach ensures a secure, efficient, and scalable authentication strategy that aligns with best practices for enterprise identity management.

Conclusion

Qlik Cloud is designed to integrate seamlessly with a single interactive IdP, providing a robust and secure authentication framework. Organizations that need to consolidate multiple identity sources can achieve this through a federated IdP, ensuring centralized management, improved security, and a streamlined user experience. By leveraging enterprise-grade IdPs like Azure Entra ID or Okta, organizations can enhance their identity management strategy while maintaining full control over authentication policies and governance.

Environment

• Qlik Cloud

Can deleted Qlik Cloud apps or sheets be recovered? Can apps, sheets, or automations owned by a deleted user be recovered?

Once an app or sheet has been deleted it cannot be recovered.

The following cannot be recovered:

• A deleted app
• A deleted sheet

The following can be recovered

Specific conditions are required.

• Orphaned apps (created when the user has been deleted)
• Orphaned personal Objects belonging to a deleted user
• Orphaned Automations belonging to a deleted user

Orphaned Apps

Orphaned apps can be reassigned. See Qlik Cloud Analytics: Can the owner of orphaned Apps be changed after the owner is deleted? for instructions.

For more information about what to consider before deleting a user, see Deleting users.

Orphaned Objects

As long as authentication is done using an OAuth client, and the admin.apps scopes are enabled, Orphaned Objects can be reassigned. This can be achieved using the APIs or qlik-cli.

For additional reading, see:

• OAuth Scopes
• APIs: Sets owner on an app object. The user must be the owner of the object.
• QLIK-CLI: app object change-owner

Example using qlik-cli:

1. Create an OAuth client (Create a M2M OAuth2 client)
2. Verify the admin.apps scopes are enabled
3. Authenticate using the OAuth client (Connecting to Qlik Cloud with OAuth)
4. List all objects within an app by running:

   qlik app object ls -a APPID

   We currently don't show the current owner of each object. You will need to find a way to identify the correct object.

5. Reassign the object by running:

   qlik app object change-owner --appId APPID --objectId OBJECTID --ownerId NEWOWNERID

Best Practices

Qlik suggests the following techniques to ensure no work is lost:

• Duplicate the app to the same or different 'Shared' or 'Personal' space
• Setup a test or 'recycle bin' space where duplicated apps are kept until it has been verified that the app can be fully deleted
• If space is a concern, export the app without data and re-import it to the 'recycle bin' space. This will allow you to keep an empty master copy of the app

Qlik has received feedback in the past to implement a recovery feature: Recycle bin for SaaS editions of Qlik Sense (#279017) (Log in to Qlik Ideation to leave comments and vote.)

Some script logs are not transferred to Archive log Folder.

Storage Locations:

Qlik Sense log folder:

C:\ProgramData\Qlik\Sense\Log\Script
Log names consist out of the AppID and a year, date, and timestamp.

Archived log Folder:

 \\SERVICECLUSTER-SHARE\ArchivedLogs\NodeName\Script
Log names consist out of the AppID and a year, date, and timestamp.

Environment:

• Qlik Sense Enterprise on Windows, all versions

Resolution:

By design, not all script logs are transferred to the Archived logs folder. Reloads executed from the hub are not transferred. 

1. When reloading data in app via hub, Script log will be left in Script log folder C:\ProgramData\Qlik\Sense\Log\Script

2. When reloading data via QMC/task, Script log will be transferred to Archived logs folder \\SERVICECLUSTER-SHARE\ArchivedLogs\NodeName\Script

Related Content:

• How to find the Script (Reload) logs in Qlik Sense Enterprise