The following steps are only applicable to Qlik Sense deployments originally installed with versions prior to the June 2019 release. For any Qlik Sense deployments installed with later versions, follow standard steps for patching Qlik Sense and do not perform the steps in this article.

In these steps we will occasionally ask you to run Powershell code.

Executing PowerShell code:

1. Copy the code and save it in a ps1 file, in example: certificates_backup.ps1
2. Open elevated command line and navigate to the location where the script was saved.
3. Start PowerShell by executing following command: Powershell
4. Run the script by executing following command: .\<name_of_the_script>.ps1 in example: .\certificates_backup.ps1

Environment

• Qlik Sense Enterprise on Windows, June 2019 thru November 2019

Resolution

1. After upgrading to June 2019 or above, check the Root certificate by running the C2 Validator tool on ALL NODES. If CA and Critical display 'Missing', please follow the instructions below.
2. Stop all services on ALL NODES in the Qlik Sense cluster.
3. Back up all current Qlik Sense certificates from the CENTRAL NODE by executing the following PowerShell code:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

function ExportCertificatesFromStore(
    [string] $name,
    [string] $location)
{
    $success = 1
    $oid = "1.3.6.1.5.5.7.13.3"
    
    $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
    $localStore.Open("MaxAllowed")

    $mypwd = ConvertTo-SecureString -String "MyPassword" -Force -AsPlainText

    try
    {
        $certs = $localStore.Certificates
        foreach ($cert in $certs)
        {
            $extensions = $cert.Extensions
            foreach($extension in $extensions)
            {
                if ($extension.Oid.Value.Equals($oid))
                {
                    Get-ChildItem -Path cert:\$($localStore.Location)\$($localStore.Name) | Where-Object { $_.PrivateKey.CspKeyContainerInfo.Exportable } | Export-PfxCertificate -FilePath "$($localStore.Name)_$($localStore.Location).pfx" -Password $mypwd
                    break;
                }
            }
        }
    }

    catch
    {
        write-host "An error occurred while removing certificates" -ForegroundColor Red
        write-host $_.Exception.GetType().FullName -ForegroundColor Red
        write-host $_.Exception.Message -ForegroundColor Red
        $success = 0
    }

    finally
    {
        $localStore.Close()
    }
    
    if ($success -ne 1)
    {
        exit 20
    }
}

function ExportCertificates()
{
    ExportCertificatesFromStore "Root" "LocalMachine"
    ExportCertificatesFromStore "My" "LocalMachine"
    ExportCertificatesFromStore "My" "CurrentUser"
}

ExportCertificates
write-host "Done."
exit 0

NOTE: For information on how to execute above code please refer to “Executing PowerShell code” section at the top. Modify $mypwd variable to define custom password. Make sure certificates were backed up after running the script:

• Root_LocalMachine.pfx – root CA
• My_LocalMachine.pfx – server
• My_CurrentUser – client

NOTE: If you happen to have more certificates with the same values in Issued To, Issued By and Friendly Name columns and you are unable to identify the correct certificate, please refer to Identifying Qlik Sense root CA and server certificates in certificate store.

1. Remove current Qlik Sense root CA certificate from CENTRAL NODE by executing the following PowerShell code:
   

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   
   function RemoveCertificatesFromStore(
   [string] $name,
   [string] $location)
   {
       $success = 1
       $oid = "1.3.6.1.5.5.7.13.3"
   
       $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
       $localStore.Open("MaxAllowed")
       try
       {
           $certs = $localStore.Certificates
           foreach ($cert in $certs)
           {
               $extensions = $cert.Extensions
               foreach($extension in $extensions)
               {
                   if ($extension.Oid.Value.Equals($oid))
                   {
                       write-host "Deleting certificate from" $localStore.Name $localStore.Location
                       write-host " Subject:"$cert.Subject
                       write-host " Issuer:"$cert.Issuer
                       write-host " Serial:"$cert.SerialNumber
                       $localStore.Remove($cert)
                       break;
                   }
               }
           }
       }
       catch
       {
           write-host "An error occurred while removing certificates" -ForegroundColor Red
           write-host $_.Exception.GetType().FullName -ForegroundColor Red
           write-host $_.Exception.Message -ForegroundColor Red
           $success = 0
       }
       finally
       {
           $localStore.Close()
       }
   
       if ($success -ne 1)
       {
           exit 20
       }
   }
   
   function CleanCertificates()
   {
       RemoveCertificatesFromStore "Root" "LocalMachine"
   }
   
   CleanCertificates
   write-host "Done."
   exit 0​

2. Make sure script completes without any errors. Otherwise remove Qlik Sense root CA certificate manually (please see Recreating Qlik Sense root CA certificate (manual back-up and removal of existing certificates).
3. Remove all current Qlik Sense certificates from NON-CENTRAL NODES by executing the following PowerShell code:
   

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   
   function RemoveCertificatesFromStore(
       [string] $name,
       [string] $location)
   {
       $success = 1
       $oid = "1.3.6.1.5.5.7.13.3"
   
       $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
       $localStore.Open("MaxAllowed")
   
       try
       {
           $certs = $localStore.Certificates
           foreach ($cert in $certs)
           {
               $extensions = $cert.Extensions
               foreach($extension in $extensions)
               {
                   if ($extension.Oid.Value.Equals($oid))
                   {
                       write-host "Deleting certificate from" $localStore.Name $localStore.Location
                       write-host " Subject:"$cert.Subject
                       write-host " Issuer:"$cert.Issuer
                       write-host " Serial:"$cert.SerialNumber
                       $localStore.Remove($cert)
                       break;
                   }
               }
           }
       }
   
       catch
       {
           write-host "An error occurred while removing certificates" -ForegroundColor Red
           write-host $_.Exception.GetType().FullName -ForegroundColor Red
           write-host $_.Exception.Message -ForegroundColor Red
           $success = 0
       }
   
       finally
       {
           $localStore.Close()
       }
   
       if ($success -ne 1)
       {
           exit 20
       }
   }
   
   function CleanCertificates()
   {
       RemoveCertificatesFromStore "Root" "LocalMachine"
       RemoveCertificatesFromStore "My" "LocalMachine"
       RemoveCertificatesFromStore "My" "CurrentUser"
   }
   
   CleanCertificates
   write-host "Done."
   exit 0​

4. Make sure script completes without any errors. Otherwise remove certificates manually (please see Recreating Qlik Sense root CA certificate (manual back-up and removal of existing certificates).
5. Remove all current Qlik Sense certificates from NON-CENTRAL NODES stored locally by deleting all files from following location:
   
   C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates
   
   
6. On ALL NODES navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location) and open Repository.exe.config file.
7. Make sure Certificates.SelfSignedRoot.BasicConstraintsCA key has value set to true, in example:
   
   <add key="Certificates.SelfSignedRoot.BasicConstraintsCA" value="true" />
   
   If the above key is not present, add it within <appSettings> section, in example:
   

   (…)
   <add key="BackgroundWork.CountLimit" value="3" />
   <add key="Certificates.SelfSignedRoot.BasicConstraintsCA" value="true" />
   <add key="DatabaseCommandTimeout" value="00:01:30" />
   (…)​

   
   NOTE: If you are installing a patch on November 2018 track, name of the key is: <add key="CertificatesSelfSignedRootBasicConstraintsCA" value="true" />
   
8. On the CENTRAL NODE, start Qlik Sense Repository Database service.
9. On CENTRAL NODE, from an elevated command line navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location) and run:
   

   repository.exe -bootstrap -iscentral​

10. When bootstrap mode has reached Entering main startup phase.., start Qlik Sense Service Dispatcher service and make sure that the Bootstrap mode has terminated. Press ENTER to exit.. final message is shown

Note: If this message is not shown, open Windows Task Manager, find Qlik Sense Repository Service in the Processes tab and end it by right-clicking on it and selecting End task.

1. To make sure new certificate is in use, run the C2 Validator tool,
2. On CENTRAL NODE restart Qlik Sense Service Dispatcher and start all remaining services.
3. On the NON-CENTRAL NODES, depending on the setup, perform either step a) or b) below:
   • Account running the Qlik Sense services has administrator privileges:
     1. [Applicable ONLY for April 2019 track]: Delete host.cfg file from C:\ProgramData\Qlik\Sense\ 
     2. Start Qlik Sense Repository Service.
     3. Open the Qlik Management Console (QMC) and redistribute the certificates according to Redistributing a certificate
     4. Restart Qlik Sense Repository Service and start all remaining services on the node to make sure they are using the newly distributed certificates.
   • Account running the Qlik Sense service does not have administrator privileges:
     1. [Applicable ONLY for April 2019 track]: Delete host.cfg file from C:\ProgramData\Qlik\Sense\ 
     2. At the command line, navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location), and run:
        repository.exe -bootstrap
     3. When the Waiting for certificates to be installed.. message is displayed, redistribute the certificates according to Redistributing a certificate
4. Once the bootstrap mode has terminated, start the Qlik Sense Service Dispatcher, then start the Qlik Sense Repository Service, and finally the remaining Qlik Sense services.

The process of migrating a Qlik Sense Enterprise for Windows environment after unbundling PostgreSQL is similar to Migrating any other Qlik Sense environment to a different host.

1. Begin with the Verification of all requirements, the Preparation Reading, and Backup as documented in Migrating Qlik Sense Enterprise to a different host 
   
   
2. Then install a supported version of PostgreSQL and prepare databases as documented in Installing and configuring PostgreSQL.

   Select your corresponding Qlik Sense Enterprise for Windows version from the dropdown select box

3. Install the Central Node using the new PostgreSQL instance prepared in step 2.
    
4. Restore the site. For this, we will use Restoring a Qlik Sense site to a machine with a different hostname, as a general guide, but we will follow a set of modified steps: 
   
   
   1. Stop all Qlik Sense Services you have just installed
   2. Drop the following databases:
      
      This step is only necessary if you already have data in the databases. Otherwise, skip this step and move to step d.
      
      
      • QSR
      • SenseServices
      • QSMQ
      • Licenses
        
        Use the command dropdb -h localhost -p 4432 -U postgres <Database>
        
        
   3. Create the same databases you have just dropped:
      
      
      • QSR
      • SenseServices
      • QSMQ
      • Licenses
        
        Use the command createdb -h localhost -p 4432 -U postgres -T template0 <Database> -O qliksenserepository
        
        
   4. Restore the newly created databases:
      
      
      • QSR
      • SenseServices
      • QSMQ
      • Licenses
        
        Use the command pg_restore -h localhost -p 4432 as documented in Restore the repository database 4.c in Restoring a Qlik Sense site to a machine with a different hostname.
        
        
5. Before proceeding with Restoring a Qlik Sense site to a machine with a different hostname steps 5 to 7:
   
   
   1. Evaluate and prepare your file share. If the share needs to be changed, follow the instructions in How to change the share path in Qlik Sense (Service Cluster)
   2. If you have a multi node with rim or worker nodes which will change names (FQDN), follow the instructions in What about my rim nodes? 
      Note that the LocalConfigs table is removed in the most recent Qlik Sense versions. Do not be alarmed if it is missing.
   3. If your Active Directory Domain changes, proceed with Qlik Sense Entrprise moved to a new domain from point 3 onwards, replacing the old domain name with the new domain, especially for RootAdmin users and new Service User Accounts. 
      
      
6. Continue with Restoring a Qlik Sense Site steps 5 to 7.
   
   
7. At this point, the Central node will be up and running and report its worker or rim nodes as down or not contacted. Continue with the Worker Nodes:
   
   
   1. If the Worker nodes are new, simply install Qlik Sense and add them to the central node
   2. If the Worker nodes have already existed, it may be necessary to regenerate and redistribute new certificates: 
      
      
      1. Open the MMC as the Service user account on the Worker Node and add the Certificate for the Local Server and Current User
      2. Back up the current SelfSigned Qlik Sense Certificate issued by the Old Central Node, then delete it.
      3. Back up and then remove files.pem in “C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates”
      4. Verify connection strings to the new database of the new Central node using the QlikSenseUtil and the scripts described in QlikSenseUtil and the ConfigureScript.ps1 for Qlik Sense Dispatcher subservices
      5. Start the services and after a short delay verify in the QMC if you need to repeat the Redistribution of Certificates.
         
         
   3. Repeat accordingly for remaining Worker Nodes      

Environment

• Qlik Sense Enterprise on Windows

Unable to access both Qlik Sense Enterprise on Windows QMC and hub. Web browser access fails with the error This site can't be reached.

Running Bootstrap on the Central node only shows Waiting for initial configuration to be run by node.

Resolution

Check if the file host.cfg exists in C:\Programdata\Qlik\Sense\

If the file is present, check if the file content decrypts to the correct Qlik Sense machine name by using, for example, https://www.base64encode.org/.

If no file exists, please create one named host.cfg and generate the Base64 content for the Rim node name via the site https://www.base64encode.org/.

Once the file is in place:

1. Stop all Qlik services 
2. Start the Qlik Sense Service Dispatcher Service 
   This service needs to run for the next steps to be successful. 
3. Open a Commandline prompt (Run > cmd) with administrative permissions (Right-Click > Run As Administrator)
4. Change to cd C:\Program Files\Qlik\Sense\Repository
5. Type and run Repository.exe" -bootstrap -iscentral -restorehostname 
6. Wait for the line Bootstrap mode has terminated. Press ENTER to exit..
7. Press ENTER and open the Windows services snap-in (Start > Run > services.msc)
8. Start up all services and check if you are able to access Qlik Sense HUB and QMC

Related Content

Rim node offline in QMC, bootstrap shows "Waiting for initial configuration to be run by node"
How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub 

Environment

• Qlik Sense Enterprise on Windows

On Talend Management Console execution screen, the following error is shown.

Failed to deploy task - received expired event. Datetime not in sync between Talend Management Console and Remote Engine. Check and sync datetime of Remote Engine.

Resolution

As Local Time on both the Remote Engine Server & Talend Management Center profile needs to be the same, you can edit your personal information and set up your language and region preferences from any of the Talend Cloud applications from the user menu (Profile Preferences).

To see whether the time is synchronized or not, please check the clock set in the remote engine server and then compare it with the time displayed at :
https://time.is/en/ (For example, if it is IST the link should be https://time.is/fr/IST 

The setup and configuration of NTP are beyond Talend support scope.

Cause

Remote Engine Server Time is not correct and it is probably caused by Product Configuration

Related Content

Please refer to below documentation to set up your user profile.

setting-up-your-user-profile

Environment

Talend Cloud 

Ok, here's another batch of tips when building visualizations in Qlik Sense. It's a mix of recipes for new charts and tips for app development. Content as follows, full descriptions and demos in the app below.

Charts

• Radial bar chart / Activity gauge
• Violin plot
• Circle timeline
• Fish Eye chart
• Stacked Venn chart
• Radial bar chart revisited
• Stacked butterfly chart
• KPI with org chart
• Kanban chart with org chart
• Kanban chart with table
• Gantt - map chart version
• Pie chart with center text
• Switch
• KPI with text &  image object

Tips

• Custom data labels
• Color by rank
• Legend sort order
• Text & image export
• Donut map layer
• Compare with last year
• Compare with last period
• Document chaining
• URL encoding
• Land or population
• Avoid formulas in selection bar
• Custom pivot totals
• Pick and match
• Line break in button
• Pivot with multi lines
• Autoscale
• Charts for animation

I want to emphasize that many of the tips are invented by others than me, I tried to credit the original author at all places when possible, the app below can be viewed as my current top picks.

If you liked it, here's more in the same style:

• 24 days of visualization Season II, Season I
• Top 10 Tips Part VIII, VII, VI, V, IV, III, II , I 
• Let's make new charts with Qlik Sense
• FT Visual Vocabulary Qlik Sense version
• Similar but for Qlik GeoAnalytics : Part III,  II, I

Thanks,

Patric

If a TCP connection is possible with Qlik's licensing server endpoint, testing the connection to license.qlikcloud.com will return the message default backend - 404 or 404 Not Found (nginx).

When testing whether or not your Sense installation can successfully connect to the license backend, always test the connection with all nodes.

1. Open any web browser
2. Navigate to  https://license.qlikcloud.com
3. The response should be default backend - 404 or 404 Not Found (nginx).
   
   Other results, such as Can't reach this page or This site can't be reached with the error code ERR_CONNECTION_TIMED_OUT, indicate the Qlik Sense server cannot establish the needed TCP connection to the license server on the internet.

The 404 HTTP error code indicates the server was reached but could not find any content to be displayed in the URL address specified.

To avoid a 404 message, rather than accessing license.qlikcloud.com, open license.qlikcloud.com/sld.

Another test would be to use telnet and confirm a connection to port 443 is possible:

1. Open cmd as an Administrator
2. Type telnet license.qlikcloud.com 443, and hit Enter.
3. Confirm a blinking cursor is returned, which indicates a TCP-level connection has been established

If different results are returned:

• verify that the connection to license.qlikcloud.com:443 is allowed in your environment, such as by verifying firewall settings or other network security deployments
• if a web proxy is required for internet access, see Configuring a proxy for Qlik License Service communication in Qlik Sense Enterprise on Windows 
  
  

Environment

• Qlik Sense Enterprise on Windows, all versions licensed with a Signed License Key (SLK)

Related Content:

There was an error when getting license information from the license server  

This article describes how Qlik Application Automation can be used to perform and review app evaluations and take action accordingly.

Environment

• Qlik Application Automation
• Qlik Cloud Services

Example

In this example, we'll create an automation that evaluates an app before publishing it to a managed space.

Before you continue, create a new automation.

1. Search for the Qlik Cloud Services connector in the Block Library and add the Do Evaluation block to the automation. Configure an app ID by using the do lookup function. The Do Evaluation block will analyze the app and return metrics regarding the app's performance.
   
   

2. Add a Variable block to create a new variable of type list with the name vCacheOverrun. We will use this variable to store all objects from the evaluated app that take too long to cache.
   
   

3. The Do Evaluation block will analyze the app and return metrics regarding the app's performance. One metric we want to look at is the "ObjSlowCached" metric which contains slow objects.
   
   
4. We want to filter all objects in the ObjSlowCached list and add each item that takes too long to load to the list variable vCacheOverrun. To do this, add a Filter List block to the automation and use another variable block inside the loop from the Filter List block to add these items to the list variable. Configure the Filter List block to return all objects with a responseTimeSeconds greater than 0.3.
   
   
5. In the Variable block, add the object's id and responseTimeSeconds as a formatted string to the list.
   
   

6. Add a Condition block that verifies whether the vCacheOverrun variable is empty. If it's empty, it means there are no (too) slow cached objects and the app can be published. Add a Publish App To Managed Space block to the Yes outcome of the Condition block and add a Send Mail block from the Outlook connector to notify your team about the published app.

   

7. If the vCacheOverrun variable is not empty, the app should not be published. Add another Variable block vStringCache of type string to the No outcome of the Condition block. Set the value of this variable to the output from the vCacheOverrun variable and add the implode formula to transform the list variable into a string.

   
8. Add a Send Mail block from the Outlook connector to notify your team that the app wasn't published. Make sure to include the vStringCache variable in the body of the email.

Bonus

• Feel free to replace the Send Mail blocks in this automation with blocks from other messaging connectors like Microsoft Teams or Slack.

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Access Denied

Or

You will not see any files/folders

Resolution

• Make sure the path you are accessing has proper Read rights and permissions are granted. Please read here to check effective permissions, Effective Permission.
• If it is a multi-node environment, ensure that the path is accessible from all the Qlik Sense Windows machines (RIM nodes).
• Make sure to use UNC paths. Please read more about UNC Paths here, File Path Formats 
• Qlik Sense Service account must have access to the path you are connecting to. Please read more about Service Account here,
  • Qlik Sense Service Account requirements 
  • What is the Service Account for Qlik Sense Enterprise on Windows? 
• The Network Shared folder must be on the same domain as the Qlik Sense Windows machine.
• If it is a network path, ensure that the users' credentials of those who do not have access to Qlik Sense are not saved. If the users' credentials are saved, accessing the network path may result in the following warning:

The username or password is incorrect

Cause

• Qlik Sense Service Account does not have proper rights and permissions to access the path.
• The Network Shared path is not accessible from the other Qlik Sense Windows machines (RIM nodes) in a multi-node environment.
• The Path provided is a Mapped drive. Please read here as the mapped drives are not supported, Cannot use mapped network drives for Qlik Sense folder connections
• Network share is Password protected and not accessible to the Qlik Sense Service account.
  
  

When the network share is password-protected, even if the service account has access to it, you must first enter the network share from the Qlik Sense Windows machine/s with credentials to access it.

Note that for every reboot, the password-protected folder will prompt for credentials, causing the Folder Data Connection to fail since Folder Data Connection does not have an option to save user credentials.

Environment

• Qlik Sense Enterprise on Windows 

There may be situations where the  QlikSense repository PostgreSQL database stops responding due to a large number of connections. It may start facing timeout or performance issues.

At this stage, it may become necessary to look into the database logs in addition to the QlikSense logs. Same would apply to the  NPrinting PostgreSQL database.

1. Open the Windows Services Console
2. Stop the Qlik Sense Repository Database Service
   
   

    

3. In a File Explorer, navigate to C:\ProgramData\Qlik\Sense\Repository\PostgreSQL\9.6\
4. Open postgresql.conf in a text editor of your choice.
   
   

    

5. In this configuration file, locate the section ERROR REPORTING AND LOGGING and modify it as follows:
   
   Remove the # in front of the logging configuration settings to enable them. 
   Switch logging_collector = off to logging_collector = on
   
   An example of the changed file can be seen below. Note we do not change any default values in our example. 
   
   As we are not making any changes, the logs will be located in:
   
   C:\ProgramData\Qlik\Sense\Repository\PostgreSQL\9.6\pg_log
   
   

   #---------------------------------------------
   # ERROR REPORTING AND LOGGING
   #---------------------------------------------
   
   # - Where to Log -
   
   log_destination = 'stderr'   # Valid values are combinations of
                                # stderr, csvlog, syslog, and eventlog,
                                # depending on platform.  csvlog
                                # requires logging_collector to be on.
   
   
   # This is used when logging to stderr:
   logging_collector = on       # Enable capturing of stderr and csvlog
                                # into log files. Required to be on for
                                # csvlogs.
                                # (change requires restart)
   
   
   # These are only used if logging_collector is on:
   log_directory = 'pg_log'     # directory where log files are written,
                                # can be absolute or relative to PGDATA
   
   
   log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log' # log file name pattern,
                                           # can include strftime() escapes
   
   log_file_mode = 0600            # creation mode for log files,
                                   # begin with 0 to use octal notation
   
   log_truncate_on_rotation = off  # If on, an existing log file with the
                       # same name as the new log file will be
                       # truncated rather than appended to.
                       # But such truncation only occurs on
                       # time-driven rotation, not on restarts
                       # or size-driven rotation.  Default is
                       # off, meaning append to existing files
                       # in all cases.
   
   log_rotation_age = 1d  # Automatic rotation of logfiles will
                       # happen after that time.  0 disables.
   
   log_rotation_size = 10MB  # Automatic rotation of logfiles will
                       # happen after that much log output.
                       # 0 disables.

   
   
6. Start the Qlik Sense Repository Database Service
   
   

    

7. Once the service has started, verify that logging has been correctly turned on by navigating to C:\ProgramData\Qlik\Sense\Repository\PostgreSQL\9.6\pg_log.
   
   

Notes: 

Will there be a performance impact by enabling PostgreSQL logging?

R&D did some testing with the following settings:

in the postgresql.conf file:
log_destination = 'csvlog'
logging_collector = on
log_connections = on
log_disconnections = on
log_hostname = on
log_statement = 'all'
log_line_prefix = '%a%%%u%%%s'

 
R&D's statement from their testing:

Customer policy adopted injection via the reverse proxy of the Content Security Policy header for security reasons. 

The policy adopted is basic: default-src 'self'

Opening the QlikView AccessPoint or Qlik Sense Hub may fail or the AccessPoint may only render partially. 

The Browser Debug tools will provide more insight:


 

Environment:

QlikView 
Qlik Sense Enterprise on Windows 

The Header Content Security Option contains a string of rules that informs the browser which resource/code is trusted to be loaded, executed rendered. 

More details on the argument could be found here: 
 https://www.w3.org/TR/CSP3/ ,
 

Resolution:

For QlikView Accesspoint a first example is to use Content-Security-Policy: "default-src 'self'  'unsafe-inline' data: ;" ; (note that using 'unsafe-inline'  option could be unsafe in a the proxy injection scenario when the client will brose a different site , you could/evaluate to use instead the  sha256-hashcode version )  
Further option could be necessary if for example you have QlikView Extension Object ( Server and Document Extensions) that are using external resources downloaded from CDN locations;
In this case the troubleshoot is the same use F12/Development Tools to check the resource that violates the policy and ad an exclusion. 

Related Content:

QlikView Access Point Shows "Loading Content" Indefinitely,
What is CSP (Content-Security-Policy) and How does it Relate to Qlik?


 

In Qlik Sense, an administrator may want to add additional HTTP headers to the Qlik Sense Proxy. This article will outline how to add those additional HTTP headers.

An example is the commonly deployed X-Frame-Options to prevent Clickjacking, or headers meant to prevent cross-site-scripting.

How to add additional headers

1. Inspect the Response Headers in the Hub for a specific Virtual Proxy to see what values are already present:
   
   In this example, we are using Chrome's Developer Tools. All browsers include Developer Tools but Chrome's tends to be the most robust. You can access the browser's Developer's Tools by pressing F12. You may need to refresh the page to see a capture. Refer to online documentation for the browser of choice for insight into how to use its Developer Tools.
   
   
   
   
2. Add the additional response headers in the Qlik Sense Management Console:
   
   
   1. Open Virtual Proxies 
   2. Click Edit on your Proxy
   3. Open the Advanced options (right hand side)
   4. Locate Additional Response Headers
      
      Note that the expected format is Header: option1;option2
      
      If there are multiple headers which need to be added, then each header needs to be on a new line in the expected format:
      
      

Additional considerations

• Be sure to research additional headers and understand the consequences of adding them to Qlik Sense. Some headers may have a large impact to a deployment; example: https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
• These headers are applied on a per virtual proxy basis. So be sure to apply any needed changes to all relevant virtual proxies.

Question

Could you share any information regarding the policy for Talend Cloud?
When an incident occurs, an investigation is conducted by our development team, and if the issue is assessed and determined to have a severity level that necessitates direct notifications to customers, it will be posted on Talend Cloud Status.

For definitions on the severity level, please check the Product Terms, and the support policy Qlik-Support-Policy-and-SLAs.

Regarding notifications, we will notify the customer within 24 hours after the incident has been solved through Talend Cloud Status.

For issues that are assessed and not determined to  have a severity level that necessitates direct notifications to customers, information may be available in the next release of the Talend Release Notes.

Please also refer to the Talend Patch Notes, for patches made to Talend Products.

Environment

Talend Cloud 

Qlik AutoML is a tool within Qlik Cloud where you can quickly train and deploy models, and the make predictions against said models. In this article, we address best practices for preparing training datasets for ML experiments and/or apply datasets for generating predictions.

Guidelines

1. For column names, use camelCase or column names without spaces or punctuation.
2. No special characters in column names.
3. When working with Excel data, remove all formatting such as bold/italics, borders, currency, or color formats.
4. Make sure data types are consistent between training and prediction datasets. It may be worth checking in Qlik Catalog to see if datasets are profiling the data type you are expecting.
5. Qlik AutoML only works with structured, tabular data. Any flat file which can be uploaded and profiled in Qlik Cloud can be used by AutoML. Based on experience, we have best results with CSV, QVD, XLSX formats.
6. AutoML does not support sentiment analysis. This would require a third-party service (such as Amazon Comprehend) to generate structured data points for AutoML to use.  You can use Comprehend in Qlik Sense directly using our connector and then use that output as a feature in AutoML.
7. For multi-table files such as Excel, only the first sheet will be used for a table.
8. Date columns are currently treated as categorical feature type. Feature engineering of date columns to numeric type should be done prior to using the dataset in an ML experiment.
9. Be aware of dataset size limits based on your tenant type.
10. For null data, if a column contains more than 50% null values it will be dropped.
    
    If greater than 50%:
    For numeric type: it uses the mean.
    For categorical type: uses value 'other'

We will continue to update this list as we encounter other issues related to data used in Qlik AutoML.

Environment

Qlik AutoML 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Related Content

How To Get Started with Qlik AutoML

Introduction

"This prediction failed to run successfully due to schema errors"  can occur during the prediction phase if there is a mismatch in the table schema between training and prediction datasets.

In this example, we will show how a column in the prediction dataset was profiled as a categorical rather than numeric because it contained dashes '-' for empty values.

Steps

1. Upload test_dash_training.csv and test_dash_prediction.csv to Qlik Cloud. See attachments on the article if you would like to download.

Training dataset:

Prediction sample:

2. Create a new ML experiment and choose test_dash_training.csv, and click 'Run Experiment'

3. Deploy the top model

5. Create a new prediction and select test_dash_prediction.csv as the apply dataset

You will encounter a warning message, "Feature type does not match the required model schema."

If you continue, you will encounter another message after clicking 'Save and predict now'.

6. If you click 'Save configuration', the prediction will attempt to run but will not produce prediction dataset and will display an error.

Resolution

Clean up dashes from 'chats' column in test_dash_prediction.csv. Either remove them from the prediction dataset or transform to a numeric value such as zero.

Environment

• Qlik AutoML 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

There are multiple ways to go about finding out the exact process of locking a file and preventing QlikView or Qlik Sense from carrying out a specific operation. This article covers one possible option on a Windows Server Operating Systems, Process Monitor.

For other options and third-party implementations, please contact your Windows administrator. 

Common causes for locks are: 

• A QVB (Reload Engine) that did not terminate correctly
• Qlik Sense Engine service holding file in error
• The QVS.exe (QlikView Server Service) holding the file in error
• AntiVirus Software during the scanning process
• Backup Software locking the file during the backup process
• Scheduled maintenance tools (Windows or Third Party)

Using the Process Monitor

1. Download Windows Process Monitor and unzip it to your server (Desktop is fine, the location doesn't matter). Link: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
   
   
2. Pause capture by clicking the Capture icon 
   
   
   
3. Navigate to File > Backing Files...
   
4. Select Use file named: and choose the storage path for the .pml file which will be created by the capture
   
   
5. Click OK
   
   
   
6. Click Filter
   
   
7. Add the File Path to the files you need to monitor 
   
   Example:
   
   Path is C:\FileShare then include
   
   
8. Click Add
   
   
   
   If you need to exclude files, use the same method, pointing the filter at specific files or folders and choosing Exclude.
   
9. Click OK to close the Process Monitor Filter dialogue
   
10. Resume the Capture
    
    
11. Verify that your filter is correct, then click Filter > Drop Filtered Events to avoid creating a too-large file
    
12. Reproduce the issue you are looking to troubleshoot
    
    If the issue cannot be replicated on demand, and Procmon needs to run until issue occurs, "Backing files" and "History Depth" may need to be configured to store the capture in multiple files with limited size.
    
    
13. Stop Capture once you have captured the issue
    
    Note: Do not close Procmon as means to stop the capture as this may inadvertently remove the .pml files.
    
    
14. You can now open the saved .pml file and review it to identify the processes accessing the files you are monitoring. 

The following error is showing for tasks that were hanging in queue:

No engines were available to process this task. You can try to run the task manually now. Run this task during a time when your processors are available.

Resolution

If you are running too many tasks in parallel, experiencing time out and tasks failed, please consider the following.

1. Set max.deployed.flows to a higher value.
   This value should be considered upon how much memory you can use for task executions.
   This is the amount of executed tasks you have in parallel.
   For more information on how to set this value, please check here: Running tasks in parallel on Remote Engine.
   
   
2. If the time does not matter on how long it takes for all tasks to complete,
   then consider having few job executions in parallel.
   For example: If you have 80 plans running at the same time, consider creating 3 plans
   running at the same time with all the jobs included.
   
   
3. Consider using remote engines in a cluster, so you have more 
   remote engines that can be used to execute the tasks.
   For more information on clusters, please check here: Creating Remote Engine clusters.
   
   
4. Increase the amount of memory you have in the environment where the remote engine is placed,
   so you can allocate more memory to the remote engine.
   
   
5. Adjust the time when tasks execute, so timeout does not occur.
   This may be the only solution if you have very limited amount of memory to be used.

Cause

Too many tasks are running at the same time, and since the tasks that were in queue timed out, it failed to execute.

Related Content

On a different note, please also review the steps to clean up the task logs on the Remote Engine

automatic-task-log-cleanup

Environment

Talend Cloud 

App can be duplicated successfully by a user that does not have full access but the script is empty in the script editor.  
The App can be used as expected, but not reloaded.

Environment:

• Qlik Sense all versions

Resolution:

A user that has read access to an app and to the related sections in the Qlik Sense Management Console (QMC) will be able to duplicate an app. If the user does not have full access to it, then only the front end of the app will be duplicated, and the script will not be copied. 

The user will be able to use the app, but unable to access the original script. 

This is working as design:

"Another user is not supposed to be able to duplicate the script, but the rest of the App should be able to be duplicated.
This is due to the fact that you can otherwise load data that you should not have access to removing the section access inside the script."

The reason why no error is printed, and the app can be duplicated successfully, is because the user should still be able to duplicate the rest of the App, without the script.
If full rights to the App and its App objects are given to the user, he will be able to duplicate the whole App including the script.

This behavior is documented on Qlik Sense help site.

A work-around solution is to duplicate the app with a user having RootAdmin or ContentAdmin role. (or) Create another rule to provide App objects access to the respective user or group.
 

Resource Filter: App.Object_*
Action: Read
Context: QMC and HUB
Conditions: user.name="User1"

Executing tasks or modifying tasks (changing owner, renaming an app) in the Qlik Sense Management Console and refreshing the page does not update the correct task status. Issue affects Content Admin and Deployment Admin roles.

The behaviour began after an upgrade of Qlik Sense Enterprise on Windows. 

Fix version:

This issue can be mitigated beginning with August 2021 by enabling the QMCCachingSupport Security Rule.

Solution for August 2023 and above:

Enable QmcTaskTableCacheDisabled.

To do so:

1. Navigate to C:\Program Files\Qlik\Sense\CapabilityService\
2. Locate and open the capabilities.json
3. Modify or add the QmcTaskTableCacheDisabled flag for these values to true
   
   {"contentHash":"CONTENTHASHHERE","originalClassName":"FeatureToggle","flag":"QmcTaskTableCacheDisabled","enabled":true}
   
   Where CONTENTHASHHERE matches the number in all other features listed in the capabilities.json.
   
   Example:
   
   
   
   This will disable the caching on the tasks table only, leaving the overall QMC Cache intact to gain performance. If you had previously set QmcCacheEnabled, QmcDirtyChecking, QmcExtendedCaching to false, please set it to true again.
   
   
4. Restart the Qlik Sense services

Workaround for earlier versions:

Upgrade to the latest Service Release and disable the caching functionality: 

To do so:

1. Navigate to C:\Program Files\Qlik\Sense\CapabilityService\
2. Locate and open the capabilities.json
3. Modify the flag for these values to false
   • QmcCacheEnabled
   • QmcDirtyChecking
   • QmcExtendedCaching
4. Restart the Qlik Sense services
   
   

NOTE: Make sure to use lower case when setting values to true or false as capabilities.json file is case sensitive.

Should the issue persist after applying the workaround/fix, contact Qlik Support.

Internal Investigation ID(s): 

QB-2096
QB-5168
QB-7655
QB-17238

Environment

Qlik Sense Enterprise on Windows 

After following the Qlik article Configure Qlik Sense to use a dedicated PostgreSQL server and update the connection string to point to the new host, Qlik Sense appears to work fine at first. However, access by the Qlik Sense Service account to the old host is registered or errors are found in the logs similar to what is found in the example below:

In the AppDistributionService trace logs:

307308 20210104T170444.859+01:00 INFO QLIKSERVER 70 DOMAIN\serviceaccountname Retry attempt: 10/10. Previous result: "No such host is known". 304796
307309 20210104T170451.812+01:00 ERROR QLIKSERVER 70 DOMAIN\serviceaccountname Error processing message queue notifications. System.Net.Sockets.SocketException (11001): No such host is known
at System.Net.Dns.HostResolutionEndHelper(IAsyncResult asyncResult)

Resolution

There are a few new services starting on the September 2019 release of Qlik Sense which did not exist in June 2018. Some of them were also removed/replaced on the new release.

Option 1 (recommended): Updating the files using PowerShell:

1. Stop all the Qlik Sense services
2. Open a PowerShell command prompt in administrator mode and then, either run the following:
   
   

   # Set the Installation Directory for Qlik Sense
   $installDir = 'C:\Program Files\Qlik\Sense\'
   #change that to the new database server
   $newdatabasehostname='new database server'
   # Specify the new password for the qliksenserepository account
   $password = 'MyNewPassword'
   # Find all Configure-Service.ps1 scripts in the installation directory and execute them
   $files = Get-ChildItem -Path $installDir -Include Configure-Service.ps1 -Recurse
   foreach ($file in $files) {
       $ScriptToRun=$($file.FullName)
       &$ScriptToRun $newdatabasehostname 4432 qliksenserepository $password -postgresHome 'D:\Qlik\Sense\Repository\PostgreSQL\12.5'
   }​

   
   In case of having a custom path Qlik Sense installation, change the last line to:

&$ScriptToRun $newdatabasehostname 4432 qliksenserepository $password -postgresHome 'D:\Qlik\Sense\Repository\PostgreSQL\12.5'
}

Where "D:\Qlik\Sense" is Qlik Sense installed folder and where "12.5" is the Postgres version installed.

Option 2: Manually update each file

Change to the following directories with the commands below before running the Configure-Service.ps1 command listed further below.

Repeat the step for every subfolder mentioned below.

Note: If you previously upgraded you may find folders in your system which are not listed here. Ignore them. No steps need to be taken.

Qlik Sense February 2021 and later.

Locate Configure-Service.ps1 in C:\program files\Qlik\Sense\.

It lists all services that need to be changed.

Qlik Sense June 2018:

Qlik Sense September 2019:

Example:

For AppDistributionService...

PS C:\> cd 'C:\Program Files\Qlik\Sense\AppDistributionService'
PS C:\Program Files\Qlik\Sense\AppDistributionService> .\Configure-Service.ps1 DatabaseHost Databaseport DatabaseUser DatabasePassword

e.g. .\Configure-Service.ps1 newdatabasehostname 4432 qliksenserepository Password123!

The answer will look similar to this:

AppDistributionService configuration started.
WARNING: Skiping the database initialization. No superuser or password specified.
Reading the settings file.
Saving the modified settings.
Exporting the copy of the invocation parameters.
AppDistributionService configuration successful.

Related Content:

• Configure Qlik Sense to use a dedicated PostgreSQL server