Backups are crucial, not only in the case of planned upgrades, migrations, or large-scale infrastructure changes but just as much to have a restore point to fall back to in case of an unplanned failure.

For extensive Backup and Restore instructions applicable to your Qlik Sense Enterprise on Windows version, see: Backup and restore Qlik Sense Enterprise on Windows 

The instructions are broken out into:

• Backing up certificates 
• Restoring certificates 
• Backing up a Qlik Sense site 
• Restoring a Qlik Sense site 

TIP! Do you have a large database? 

If not enough disk space is available, you can shrink the backup by adding  -T _deletedentitylog to your backup command.

Example:

pg_dump.exe -h localhost -p 4432 -U postgres -v -b -F t -T _deletedentitylog -f "E:\backup\QSR_Backup.tar" QSR ​

Video Walkthrough

For a video walkthrough see:

Content:

• About
• What is the current certificate used for?
• Certificate options, or: What type of certificate is right for me?
• Requirements, or: What to look out for when getting your cert.
• Where to get a certificate and how to do a CSR?
• Importing the Certificate
• The 5 Install Steps
• Step 1: Getting Started
• Step 2: Import the certificate
• Longer Step 2 (manual import):
• Step 3:Getting the Thumbprint
• Step 4:Configuring the Qlik Sense Proxy
• Step 5:Verification, or: How to prove the certificate was accepted.
• Related Content:

If you’ve just installed Qlik Sense Enterprise, then this image probably looks familiar. Alternatively, Chrome might display The site's security certificate is not trusted, while Firefox may report This Connection is Untrusted.

By default, Qlik Sense uses a self-signed certificate to enable HTTPS access across both the Hub (https:// YourSenseServer/hub) and the Management Console (https://YourSenseServer/qmc). But self-signed certificates cannot be validated or trusted by web browsers and tend to prompt a warning message.

To establish a secure HTTPS connection, the browser must trust the SSL/TLS certificate installed on the server. In the case of self-signed certificates, the signing Certificate Authority is not trusted, hence no certificates generated by the CA are trusted.

To install a trusted certificate for use with the Qlik Sense Enterprise on Windows Hub and Management Console, we need:

1. An additional (signed) certificate.
2. A brief (5 minute) downtime of the Qlik Sense Proxy.

These instructions are for replacing the certificate used for accessing the Qlik Sense Hub and Management Console. The certificate used for service communication cannot be replaced.

About

What is the current certificate used for?

During the initial install, the Qlik Sense Repository Service creates a set of certificates. Their purpose is to secure Service Communication and Service Authentication.

Qlik Sense uses certificates to authenticate its service across all nodes. See the Qlik Sense Online Help for details. In addition, other products (such as Qlik NPrinting) require these certificates to be establish a connection.

This self signed certificate is then also used to secure hub and Management Console access through HTTPS.

We will not modify, replace, or remove the originally created certificates. Doing so will break service communication. 

What we’ll do instead is to add an additional one.

Certificate options, or: What type of certificate is right for me?

There are three possible types of certificates for us to use.

• A certificate purchased from and signed by a trusted CA (Certificate Authority) such as VeriSign, Thawte, Geotrust, etc.
• A certificate provided and signed by your own Enterprise CA (Certificate Authority).
• And, of course, a self-signed one. Those can be created by any number of applications, such as Microsoft IIS, but is generally only recommended for test environments. More so, it has the potential side effect of teaching users to ignore browser warnings, which we do not want.
  
  

Requirements, or: What to look out for when getting your cert.

• The certificate must follow these requirements: Qlik Sense Enterprise on Windows: Compatibility information for third-party SSL certificates to use with HUB/QMC 
• The certificate itself must contain a private key
• Has an up to date valid from / valid to date range
• Is signed by a valid and OS or browser configured Certificate Authority

When support gets questions, they are most often related to a certificate missing the private key. Always verify the certificate comes bundled with one when you install it.

It’ll look like this:

Where to get a certificate and how to do a CSR?

The Certificate Authority you chose will have instructions for this, and if you are looking to get a self-signed one or one from your corporation's CA, then a local administrator can provide the certificate to you.

Either way, you are going to need to generate a Certificate Signing Request (CSR) to pass on to your CA. There are tools out there to get that done with, such as certreq from Microsoft (found here), and SSLhopper has a great article on that, which I often send to customers when they ask us about CSRs and how to do them.

Once you obtain the certificate, we'll move on to installing it and activating it in Qlik Sense. This will be done in three quick steps:

• Import
• Get the Thumbprint
• Provide Thumbprint to the Proxy
  
  

Importing the Certificate

As mentioned before, we are not replacing certificates. The already existing ones will not be deleted. Doing so would break service authentication between the individual Qlik Sense services and render the system… broken.

The 5 Install Steps

Step 1: Getting Started

On the Qlik Sense node running the Qlik Sense Proxy, log on with the user running the Sense services. This is important since the certificate needs to be accessible for this account.

Step 2: Import the certificate

If the certificate was saved in the .pfx format, then all you need to do is double click the file. Follow the prompt to import the certificate into the Personal store.

Longer Step 2 (manual import):

If you want to import it manually or verify if it was correctly installed:

1. Launch the Microsoft Management Console (mmc.exe) on the Proxy node
2. In the MMC, go to File > Add / Remove Snap-in...
3. Select Certificates and click Add
4. Select Computer account, click Next, select Local computer and click Finish
   
   
   
   
5. In the MMC, go to Certificates (Local Computer)/Personal
6. In the MMC, go to Actions > All Tasks > Import...
7. Browse to the certificate file provided to you from your CA
8. Follow the instructions on the screen to import the certificate, including the private key
9. Verify the new certificate has been imported into Certificates (Local Computer) > Personal > Certificates and that it contains a private key
10. Double-click the Certificate > Certification Path and confirm it shows "This certificate is OK"
    
    

Step 3: Getting the Thumbprint

Well, since we are already in the MMC, let's open the freshly installed certificate again.

1. Switch to the Details tab and scroll down until you find Thumbprint
2. Mark the entire thing and copy it into, for example, Notepad.

Step 4: Configuring the Qlik Sense Proxy

Almost done!

1. Open the Qlik Sense Management Console (QMC)
2. Go to Proxies
3. Double click the Proxy you want to use (or select and choose Edit)
4. Enable the Security options in the Properties panel on the right
5. Paste the certificate Thumbprint into the SSL browser certificate thumbprint text box.

Click Apply.

The Sense Proxy will now restart. During the restart, it will be using Windows API calls to correctly bind the new certificate to its SSL ports.

Step 5: Verification, or: How to prove the certificate was accepted.

In the web browser:

When opening the Qlik Sense Hub or QMC, the certificate will now be displayed in the browser. This may look different depending on the web browser, but in Google Chrome you can click the padlock to the left of the URL to verify what certificate is used.

The information displayed needs to match the properties of the certificate you installed.

In the log files:

If you’d rather see what the Qlik Sense Proxy service is doing, then you can directly check up on that, too.

On the Proxy node, go to C:\ProgramData\Qlik\Sense\Log\Proxy\Trace and open the Security log file from just after the last start.

It will now print a slightly different message than before:

Security.Proxy.Qlik.Sense.Common.Security.Cryptography.LoggingDigester    DOMAIN\_service    Setting crypto key for log file secure signing: success

Security.Proxy.Qlik.Sense.Common.Security.Cryptography.SecretsKey    DOMAIN\_service    retrieving symmetric key from cert: success   

Security.Proxy.Qlik.Sense.Common.Security.Cryptography.CryptoKey    DOMAIN\_service    setting crypto key: success   

Security.Proxy.Qlik.Sense.Communication.Security.CertSetup    'CN=localhost' (08C871933A58E072FED7AD65E2DB6D5AD3EAF9FA) as SSL certificate presented to browser, which is a 3rd party SSL certificate  

And that's it!

There isn't much more to it in a standard Qlik Sense Enterprise installation, but if you have more questions, then maybe a few of these articles can help:

Receiving Bad Request 400?

Make sure the URL/FQDN you are using to access the Hub and QMC is correctly added to the WebSocket Allow List: How to configure the WebSocket origin allow list and best practices  

I applied my certificate and it seems to be using it correctly, but browsers are still saying the Common Name is Invalid?

ERR_CERT_COMMON_NAME_INVALID when using 3rd party certificate 

Qlik Sense keeps reverting to the default and complains it can't find a valid ssl certificate with the thumbprint.

Qlik Sense: Couldn't find a valid ssl certificate with thumbprint in Proxy logs, the third party certificate is not used correctly 

The certificate may not have a Private key or the service account does not have access to it.

How to: Manage Certificate Private Key 

The Qlik Sense Service account doesn't have admin privileges and the certificate is not accepted.

How to: Change the Qlik Sense Proxy certificate if the service account does not have local administrative permissions 

Related Content:

• Qlik Sense Hub and QMC with custom SSL certificate 
• A certificate error or warning is displayed in the browser when accessing the Qlik Sense Hub or Management Console 
• Qlik Sense - Changing to a signed server proxy certificate 
• Qlik Sense - Changing a proxy certificate 
• ERR_CERT_COMMON_NAME_INVALID when using 3rd party certificate
• Qlik Sense: Compatibility information for third-party SSL certificates to use with HUB/QMC
• Requirements for configuring Qlik Sense with SSL
• Couldn't find a valid ssl certificate with thumbprint and the incorrect certificate used on hub 
• How to: Change the Qlik Sense Proxy certificate if the service account does not have local administrative permissions
• NET::ERR_CERT_AUTHORITY_INVALID 

Professional User is a FULL user license, which provides access to all features of Qlik Sense.

The Analyzer User is a LIMITED user license and allows users to access and explore Qlik Sense applications.

For more information, see Assigning user entitlements.

The QlikView Distribution Service fails to start. Windows displays the following error:

Error 1067: Process terminated unexpectedly 

See Figure 1.

Fig 1

This can be caused by a range of issues. We will break down the most common ones. 

To begin identifying the root cause, the following logs files are crucial:

• Windows System Event log
• Windows Application Event log
• Distribution Service service log (default location: C:\ProgramData\QlikTech\Distribution Service\Log)

Application Data Folder Permissions 

The Windows System Event logs record: 

The service must have sufficient permissions in Publisher Application Data Folder

To solve

• Verify that the QlikView Service account has full read and write and modify permissions on C:\ProgramData\QlikTech\DistributionService
• If a Distribution Service Cluster is deployed, verify that the Application Data folder location is correctly configured. Each node in a cluster requires its own Application Data Folder and Notifications file location. 
• Individual files in the Application Data folder may be corrupted. 
  • The folder C:\ProgramData\QlikTech\DistributionService can be recreated
  • Stop the Distribution Service 
  • Rename the \DistributionService folder 
  • Start the Distribution Service

QVB and DCOM 

• missing registry keys
• missing GUID
• incorrect COM control permissions.

The Windows System Event logs record: 

The service must have sufficient permissions in Publisher Application Data Folder: "C:\ProgramData\QlikTech\DistributionService". Exception=System.Exception: Could not start: CouldNotStartQVB at QDSMain.MainClass.Run()

or

The service must have sufficient permissions in Publisher Application Data Folder: "C:\ProgramData\QlikTech\DistributionService".
Exception=System.NullReferenceExceptions: Object referenced not set to an instance of an object

To solve

Register the QVB.exe (QlikView Batch engine):

1. Open windows file explorer
2. Locate qvb.exe, default location C:\Program Files\QlikView\Distribution Service\
3. Double click on qvb.exe to create the necessary Windows registry keys and GUID.
4. Restart the Windows host

Manually configure the DCOM permissions:

1. Start Run with Windows key + R
2. Run DCOMCNFG.EXE
3. Expand the Console Root  > Component Services > Computers > My Computer > DCOM Config
4. Locate QlikViewBatch 7.0 Application
5. Right-click. Choose properties
6. Select the Security tab
7. On Launch and Activation Permissions choose Customize and press Edit
8. Add the QlikView Service account 
9. Check the options
   • Local Launch
   • Remote Launch
   • Local Activation
   • Remote Activation
10. Save and try starting the QlikView Distribution Service
11. If it still fails, repeat steps 7-10 for the "Access Permissions" and "Configuration Permissions" sections on the "Security" tab

If the above fail, run a Repair on the Distribution Service Node 

Broken Performance Counters

Windows Performance Counters may need to be repaired.

The Distribution Service Application log or Windows Application log read:

Exception=System.InvalidOperationException: Category does not exist.
 at System.Diagnostics.PerformanceCounterLib.CounterExists(String machine, String category, String counter)
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter..ctor(String categoryName, String counterName, String instanceName, Boolean readOnly)
   at System.Diagnostics.PerformanceCounter..ctor(String categoryName, String counterName, String instanceName)
   at QDSMain.Diagnostics.QDSDiagnostic.get_Instance()

To solve

Verify that the correct .NET Framework version is installed

Review the System Requirements for your respective QlikView version. 

Performance counters missing or installed incorrectly

In an elevated (administrator permissions) command prompt execute one of the following: 

lodctr /R

or

C:\Windows\SysWOW64>lodctr /R

Source: Event ID 3012 — Performance Counter Loading  (Microsoft .com)

Performance Counter Disabled in Registry for OS

The Performance Counters might have been disabled on the Operating System Level.
Verify the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfOS\Performance
Disable Performance Counters should be set to 0

Performance Counter Permissions

See Access to the registry key 'Global' is denied. The account doesn't have the proper rights to the registry. 

QVPR (QlikView Publisher Repository) invalid

A damaged QVPR can cause issues with the Distribution Service, as it may send faulty information to the service. Note that the QVPR is used to store tasks and system-wide configuration and should never be deleted in an active system. Backups are taken automatically daily at 00:00.

To solve

For instructions on how to restore a backup, see:  How To: Restore the QVPR From Backup or Recreate the QVPR

FIPS enabled

FIPS may be enabled.

The Windows Application log reads:

Exception when creating CryptoServiceProvider: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. Local Security Policy -> Security Options -> System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing - should be disabled 

And a .Net Runtime error:

Exception Info: System.InvalidOperationsException
at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()
at QDSMain.Clustering.DefaultClusterNotification.Work.Thread()

To solve

FIPS is not supported with QlikView. See Distribution Service will not Start Error 1067 or Event ID 1026 in Server Logs for details. 

Data loaded is structured in a flat table. This table has rows and fields, and all fields have the same number of rows. All the value are stored as dual values by the Qlik Indexing (QIX) engine. 



The distinct values of each loaded field are collected into symbol tables. There is one symbol table per field, and each symbol table has a pointer value assigned for each distinct value. The pointers are unique within each symbol table, but not among all symbol tables. QlikView has a limit of maximum of 2 billion (2^31) symbols per symbol table.

NOTE: The distinctness of values are based on the dual value's underlying numerical value. This means that dual values with a different text value, but identical numerical values will be represented by the same symbol. 

The pointer values are bit-stuffed, which means that they only have as many bits that it takes to represent the number of rows in the symbol table. For example, a field with four distinct values needs a pointer with only two bits length, because that is the number of bits it takes to represent four (2^2) values. In the pictures below the pointers are represented as binary values.

A symbol table can be visualized by presenting the field in a list box since it shows the distinct values in a field. 



The in-memory data table will not store the actual loaded values. In the data table the values are replaced by the pointer values. This allows for significant data compression since the pointers are many times shorter than the actual data value. Data can many times be processed quickly through the pointer values, since they have fewer bits to process compared to the real data value. 




Community blog post on QlikView symbol tables and optimization considerations: http://community.qlik.com/blogs/qlikviewdesignblog/2012/11/20/symbol-tables-and-bit-stuffed-pointers

Issue reported:

• License Monitor Task fails with message Error: HTTP protocol error 403 (Forbidden)

Diagnosis:

• Open "Tasks" in the QMC and view the 'information' icon within the 'status' column for the failed task
• Download the Script log file
• The downloaded Script Log file for the License Monitor ends with:
  
        2019-12-10 21:11:49      Error: HTTP protocol error 403 (Forbidden):
        2019-12-10 21:11:49      
        2019-12-10 21:11:49      The server refused to fulfill the request.
        2019-12-10 21:11:49      Execution Failed
        2019-12-10 21:11:49      Execution finished.
  
   

Cause(s):

The License Monitor acquires license data from the Qlik Sense Repository Service (QRS) through QRS API calls. The requests to these end-points are by default made by the user running the Qlik Sense services, but the related data connections may have been configured to run with a custom user. 

The user executing the API calls must fulfill two requirements;

• User is not blocked in Qlik Sense
• User is assigned RootAdmin role

Resolution:

Assign RootAdmin role to the user running Qlik Sense services

This is most often the only required action, since the license monitor app by default relies on user running Qlik Sense services.

1. In the QMC, navigate to 'Users' 
2. In the 'Users' under the User ID column find the row with the service account 
3. Edit that service account row
4. Select 'Add role' button
5. Hover over the new field and select 'RootAdmin' in the list
6. Reload License Monitor app

Run monitor app connections with customer RootAdmin account.

NOTE: This set is only required if a custom data connection user is required to comply with local security policies. 

Use a custom RootAdmin account for the Data Connections that start with monitor_apps_REST_*

1. In the QMC, in the left panel under Manage Content, select Data Connections
2. Under the 'Name' column are the connections starting with monitor_apps_REST_*
3. Edit each of these data connections you will see a User ID and Password  field
   • Enter a user into the User ID field (domain\username format)
   • Enter a password in the Password field
4. The user must have a 'Root Admin' role assignment;
   
   • In the QMC, navigate to 'Users' 
   • In the 'Users' under the User ID column find the row with the  desired user account 
   • Edit that service account row
   • Select 'Add role' button
   • Hover over the new field and select 'RootAdmin' in the list
5. Reload License Monitor app
   
   

Confirm that UDC filter include account used for data connections

• Confirm that user used for data connections is not marked as Blocked in QMC Users section
• If user is blocked, adjust UDC filter to include the user account used for the Data Connections
• Sync UDC and reload License Monitor app

In the QlikView Server Session log, the Client Address is coming through as the webserver's IP for AJAX sessions.

The webserver is the server requesting the ticket, but is not the client. 

The IP address written in the sessions log's "Client Address" tab is the IP address of the "client" machine connecting to the server on port 4747.

In the case of AJAX, the "Client Address" will be the IP address of the webserver machine.

If IE Plugin or Desktop is used then the IP address will be of the client machine hosting the desktop or IE (end-point). 

For information on how to accurately locate the client IP address, see How to find the IP address of a QlikView client accessing documents .

Environment:

QlikView 

Known issues experienced when performing an upgrade of QlikView 11.20 to any of the later versions.

Applies for an upgrade to:
QlikView 12.20 / November 2017 What's New in QlikView November 2017
QlikView 12.30 / November 2018 What's New in QlikView November 2018
QlikView 12.40 / April 2019 What's New in QlikView April 2019
QlikView 12.50 / April 2020 What's New in QlikView April 2020
QlikView 12.60 / May 2021 What's New in QlikView May 2021

The linked information is not exclusive to problems, but also includes changes in behavior. 
 

Preparation for an Upgrade

Review the Upgrade Instructions as documented on our official Online Help.

Watch our Upgrading from QlikView 11.20 recording, which covers the end of support for QlikView 11.20 including:

• What to consider before upgrading 
• What to expect after upgrading to QlikView 12.10 or QlikView November 2017 or beyond
• Major architectural differences introduced in 12.10 and November 2017 or beyond
• How they will change the behavior of your QlikView deployment for the better 
• New features available after upgrading

Intended Changes

User / Administrator impact behavior change

Issues encountered

User / Administrator impact  

When purchased, our Qlik products are delivered with a 16-digit license key (LEF) and/or the Signed License key (SLK). What key is applied may differ depending on your requirements or the version of the product.

You’ll have two activation options:

• The Signed License key (SLK), available for most Qlik products
• (legacy) And a combination of the 16-digit key, a control number, and the License Enabler File (LEF)

These license activation methods cannot be mixed. A license activated with an SLK cannot also be activated using the key + control number method.

In this blog post, we will cover the differences between the two activation methods, as well as what benefits the Signed License key brings to the table. Details on how to activate them will follow in the second post to this short series.

What is a Signed License Key (SLK)?

• The SLK is an encrypted JSON web token used to activate Qlik Sense Enterprise or ABDI. It contains product information, available access types for users, and any applicable product add-ons or limitations.
• The SLK is to be used for activating Qlik Sense Enterprise on Windows licenses using the Professional/Analyzer user model. Qlik Sense Core Based and Token based licenses should use the legacy LEF activation method.
• You cannot change from an SLK activated system to a LEF activated system.
• The SLK requires online connectivity to our licensing server for both activation and continued operation.
• For information on how to apply an SLK, see How to Apply a Signed License Key
• The time (Subscription date, Analyzer capacity reset) is on UTC

The SLK is mandatory for:

• The use of Qlik Sense Analyzer Capacity licenses
• Any deployments using Qlik Sense Enterprise on Kubernetes or Qlik Sense Enterprise on Cloud Services, as well as Multi-Cloud (a combination of Qlik Sense Enterprise on Windows and Cloud offerings)
• Unified Licenses, which combine Qlik Sense and QlikView
• See Qlik product licenses for more information.

What is a License Enabler File (LEF)?

• Every license has a LEF. Each 16-digit license number that you get can be translated into a LEF, regardless of the method used to activate the license. The LEF itself contains all the instructions for the Qlik Product, such as license level, numbers of users, access types available for assignment, as well as all the limitations or add-on.
• When applying your license using the license number and control number, the LEF will be downloaded to the product during activation­. It will be updated with each refresh request.
• The first line of the LEF is always your 16-digit license number and it ends with a checksum so that an unauthorized alteration of the content is impossible.
• It requires a control number for activation
• You can change from a LEF activated system to an SLK activated system (but not the other way around). Always use LEF activation if your license has tokens.
• The LEF can be activated offline and used offline, see How to license a QlikView or Qlik Sense server without Internet access for details.
• The time (Subscription date) is on UTC

The LEF activation method is currently required for:

• Qlik Sense
  • Core-based licenses
  • Token-based licenses
  • See Qlik product licenses for more information.
• QlikView
  • CAL-based licenses
  • See Licensing QlikView for more information. 

How do I get an SLK?

• Your signed license key will be sent to you in the license delivery email.
• If you did not receive your SLK via email, please contact Customer Support. Please make sure to provide the corresponding 16-digit license key and the Support team will be able to get the SLK for you.
• There is no way to get the SLK from the Support Portal at this time.

Benefits of using an SLK

Using the Signed License Key makes more product and deployment options available to you.

Examples of these are:

• Multi-site deployments, such as connecting a Qlik Sense Enterprise site with a QlikView Server deployment using Qlik Sense Enterprise license options. This is enabled by accepting a Dual-Use offer for each QlikView deployment that should be enabled for a Unified License scenario.
• Multi-geo deployments, such as having Qlik Sense Enterprise sites in different locations using the same list of users.
• Qlik Sense Enterprise for Kubernetes and Qlik Cloud Services. Either stand-alone or in a multi-cloud setup.
• Consumption-based licenses, such as Qlik Sense Enterprise Analyzer Capacity. This additional user license is possible to use in a single or multi-cloud scenario.

All the above is enabled by the use of the Signed License Key. This is made possible by the local deployment syncing all entitlement data (assigned users access, etc.) with all available deployments sharing the same SLK. The synchronization is done using the Qlik Licensing Services and our license backend hosted in Qlik Cloud.

If you are curious about more information around the Qlik Licensing Service, see the Qlik Licensing Service Reference Guide.

How do I get a LEF?

• You can get the LEF and control number from the Support Portal by following the steps outlined in How to request a control number and LEF

And this is it for an overview of our available license types and activation methods. We’ll follow this up with part two soon, detailing the move from a LEF activated license to an SLK. Until then, give this post a like if you found it helpful! And please let us know if you have any questions or feedback in the comments.

It may be necessary to export Data Connections to either move Data Connections between environments or to import Data Connections into the Qlik Analytics Platform (which doesn't have a front-end interface to easily recreate these connections). 

To achieve this, keep in mind: 

• Data Connections can only be created inside the Data Load Editor.
• Data Connections cannot be created directly in the Management Console.
• Exporting a QVF from Qlik Sense Enterprise strips the Data connections from the application for security purposes.
• Apps created using Qlik Sense Desktop store the Data connections locally within the file
• Apps containing Data Connections that are imported to the QMC will retain the Data Connections and add them to the environment. 

Resolution:

With these considerations in mind, Qlik Sense Desktop can be utilized to maintain a 'blank' QVF (No loaded data) that contains all the data connections needed for moving to a higher environment or bringing connections into QAP. 

Follow this process:
 

1. Open Qlik Sense Desktop
2. Create/Open a QVF dedication for the Data Connections you wish to transfer and maintain
3. Create the Data Connections in the QVF
4. Test to verify that the connections work as expected.
5. Save this QVF and store it (this will be your go-to file to import these connections whenever you need to)
6. Import QVF into QMC of Qlik Sense Server or QAP to add the data connections

3rd Party solutions:

The information here is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

• Gitoqlok: How to migrate Data Connections to QAP, Qlik Sense Enterprise 

Related Content:

Data Connection migration 

Preface:

Qlik Log Reader is Qlik's proprietary high speed redo log parser for parsing the Oracle redo logs, it also provides greatly improved performance and reduces the load on the Oracle server when compared with other methods such as Oracle LogMiner.

When the Oracle redo logs are stored in ASM, Replicate enables several techniques to improve the read performance. This includes the Copy redo logs to a temporary folder, which allows Replicate to Copy the redo logs and read it from a faster storage.

The problem originates in the 32KB packet size limitation when reading directly from ASM. Other methods like reading using the 'binary file' allows readings MBs of data, and this is why the Copy to folder does help improve performance.

Replicate now supports a new method for reading from ASM. This is accomplished by reading ASM via parallel threads. Starting from Replicate v6.2 this is the default read method for ASM. This allows Replicate to read the redo log in several threads thus improving the performance.

The Parallel Method:

Starting from Replicate v6.2 the default ASM read mode is 4 parallel threads, the parameter that configures this is called parallelASMReadThreads, the maximum value for this parameter is 8 threads. Finding the right value for a specific environment may require few testing cycles.

Using the parallel method may add some overhead as follows:

• Some CPU overhead to the Replicate and Oracle machines.

• More network traffic as we will be reading in 4 threads.

That being said, this overhead is understandable and may not be noticeable. Also note that the Copy method also introduces overhead:

• Storage for the temporary location.

• More permissions and managing the deletion of the copied logs.

• Copying the redo logs and reading from the temporary location.

Further Optimizations with Parallel:

The parallel method does not solve the 32KB ASM read limitation, however, it does help by reading in several threads. We have added another mechanizm that can be enabled by setting the asmUsePLSQLArray internal parameter.

When enabled, Replicate will buffer 50 reads at the ASM server (where the PL/SQL is processed) and send back this larger buffer. This will cause less round trips but it will still read in 32KB buffers.
The user can enable asmUsePLSQLArray even when reading using a single thread, however, the benefit will be seen when working with parallel ASM threads. The benefit will vary from system to another, we have observed up to 10-20% improvement in throughput in some cases.

Limitation:

The 50 buffers setting is fixed. This feature can only be used on platforms where the redo log block size = 512 bytes: Linux, Windows, this excludes HPUX.

Advanced Tweak:

The parallel mode can be further optimized using the readAheadBlocks parameter.

Currently, each thread will read:

• (readAheadBlocks / parallelASMReadThreads)

The default value of the readAheadBlocks is 100,000 (in blocks), and the maximum value is 2,000,000.

Important Note

Our testing and experience so far has shown that a value of 100,000 (50MBs) is optimal for most platforms.

Summary

Support for the parallel ASM read is available starting from these versions:

• Qlik Replicate 6.1 or higher.

The maximum number of parallel user connections for a single user in Qlik Sense is five (5). This can be exceeded by users by accident or by unexpected behavior.

The related log file for this issue is: 
C:\Programdata\Qlik\Sense\Log\Repository\Audit\AuditSecurity_Repository.txt

The related message reads: 
Access was denied for User: 'Domain\USER', with AccessID '264ff070-6306-4f1b-85db-21a8468939b5', SessionID: 'e3cd957b-a501-4bec-a3f8-d35170a73efa', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'

Environment:

• Qlik Sense Enterprise on Windows 

Resolution:

See How to count sessions in Qlik Sense on possible scenarios on when multiple sessions are created.

When the user is consuming too many sessions, they will need to wait until the first one has correctly timed out. This is dependent on the Qlik Sense configuration.

If none of those apply, and a user is not actively connecting more than 5 times, then the below should be investigated: 
 

Service Account has a licence assigned and QMC interaction consumes sessions

See Qlik Sense April 2018 and later- Service account getting "You cannot access Qlik Sense because you have no access pass" .

The end-user does not have a license/token assigned

In some instances, the error message may wrongfully be shown when no license/token was assigned to a user. Note that this should not be the case with the service account, as mentioned above. 

iFrame access using an iOS device with Safari

iOS does not allow cookies from websites in iFrames without having first visited the embedded site directly. 

To resolve this, access the site hosting the iFrame once. After that, cookies can be accepted.

The session is being resumed after the client device disconnected for an extended period of time

In the following scenarios, the client device is disconnected from Qlik Sense during an active session:

• Entering sleep mode
• Lost VPN connection
• Flight mode activated
• Lost network connection 

When the session is resumed, all request sent to server contain the previous session cookie, which has expired during the disconnection. The requests with invalid session cookie leads to re-authentication for multiple requests, which leads to session count being rapidly exhausted.

This issue has been addressed and resolved in below releases, where Release Notes on "Handle 'invalid cookie' bursts in the Qlik Sense proxy Service" for additional configuration details.  

• Qlik Sense Enterprise on Windows November 2019
• Qlik Sense Enterprise on Windows September 2019 Patch 1
• Qlik Sense Enterprise on Windows June 2019 Patch 6
• Qlik Sense Enterprise on Windows April 2019 Patch 5
• Qlik Sense Enterprise on Windows February 2019 Patch 6

Database maintenance of closed sessions not working correctly

Verify if any of the following tables in the Qlik Sense Repository Database (QSR) includes 5 or more records for the user that are older than 5 minutes:

• LicenseProfessionalAccessUsages
• LicenceUserAccessUsages
• LicenseAnalyzerAccessUsage

If that is the case, the maintenance/cleanup of old sessions might not be working properly.

This issue has been addressed and resolved in the below releases. 

• Qlik Sense Enterprise on Windows February 2020
• Qlik Sense Enterprise on Windows November 2019 Patch 1
• Qlik Sense Enterprise on Windows September 2019 Patch 2
• Qlik Sense Enterprise on Windows June 2019 Patch 6

A QlikView application (QVW) file can not be opened in the QlikView desktop client or there is a need to bypass the loading of data into memory.

Possible reasons or symptoms for this can be; 

• Application requires more memory than currently available
• Calculations triggered on opening requires more memory than currently available
• Moving application to memory and preforming initial calculations takes longer time than anticipated, appearing as if QlikView desktop client has hung

NOTE: If the file can not be opened without data, it may be corrupt and you should revert to a backup version of the file.

Log files are a crucial component when troubleshooting QlikView issues ranging from app performance issues, crashes, as well as task failures and general stability problems. This article highlights which log files are needed when and where to find them.

For information about other services, see QlikView Services and Log Guide.

Content:

• System About information:
• The QlikView installation logs:
• Service and related log files:
• Service:QVS (QlikView Server)
• Service:QMS (Management Service)
• Service:QDS (Distribution Service)
• Service: DSC (Directory Service Connector)
• Service:QVWS (WebServer)
• Service:Service Dispatcher/License Service
• Using the Log Collector (QlikView Server May 2022 and later)

It is useful when Qlik Support requires log files to assist in investigating an issue. With a complete set of logs, Qlik Support can make more accurate analysis and provide most efficient assistance on support cases. In this case, supplying the general environment information is advisable as well.  

System About information:

1. Open the QlikView Management Console
2. Navigate to System > About 
3. Click More 
4. Copy the contents and save them as a .txt file to transfer them to Qlik Support

The QlikView installation logs:

See Install logs in QlikView
 

Note: All logs must be collected for the range of dates when the issue is reported or seen. Always specific a date and time range to Qlik Support.

Service and related log files:

Service: QVS (QlikView Server)

Default Location: 

Default Location: C:\ProgramData\QlikTech\QlikViewServer 

See Qlik Help for more information. 

Customized locations: 

The location might have been changed. Identify the correct path from the QlikView Management Console > System > Setup > QVS@node > Logging > Log Folder. Alternatively, review the settings.ini stored in C:\ProgramData\QlikTech\QlikViewServer\settings.ini for the value configured in  ServerLogFolder= 

Commonly used for:

• Qlikview Server problems
• Performance data
• End user session problems
• CAL information

Service: QMS (Management Service)

Default Location:  

C:\ProgramData\QlikTech\ManagementService\Log

See Qlik Help for more information. 

Commonly used for:

• Errors in the Management Console
• Task setup issues
• Failures to commit settings

Service: QDS (Distribution Service)

Default Location: 

C:\ProgramData\QlikTech\DistributionService\ 
Each QDS node has its own subfolder numbered 1, 2, 3, etc.. 

See Qlik Help for more information. 

Customized Location: 

The location might have been changed. Identify the correct path from the QlikView Management Console > System > Setup > QDS@node > General > Application Data Folder

Necessary logs to collect:

%Application Data Folder%\#\Log\Date(YYYYMMDD)    Log folder
%Application Data Folder%\#\Log\YYYYMMDD.txt    
%Application Data Folder%\#\Log\LoadBalancer_YYYYMMDD.txt
%Application Data Folder%\#\Log\Root_YYYYMMDD.txt
%Application Data Folder%\#\Log\WebService_YYYYMMDD.txt    
%Application Data Folder%\#\Log\Workorder_YYYYMMDD.txt

Commonly used for:

• Distribution Service crashes
• Task failures

Detailed logs: Task log

Location: 

C:\ProgramData\QlikTech\DistributionService\1\Log\

< Date > \ < Sub Folder for each distribution or reload >

Commonly used for: 

• Task failures
• Distribution errors

Detailed logs: Document* (Script) Reload log

Location: 

C:\ProgramData\QlikTech\DistributionService\1\Log\

< Date > \ < Sub Folder for each distribution or reload >

Commonly used for: 

• Details about Task failures and reload execution, such as execution timelines and the amount of data loaded. 

* The document log is a copy of the script log which needs to be enabled per document so that it will be produced by the reload task. Refer to How To Enable QlikView Document Reload Log

Service: DSC (Directory Service Connector)

Default Location: 

C:\ProgramData\QlikTech\DirectoryServiceConnector\Log

See Qlik Help for more information. 

Commonly used for: 

• Failing to add users or groups to documents
• Authentication issues when using DMS mode
• Custom Directory problems
• Active Directory and LDAP issues

Service: QVWS (WebServer)

Default Location: 

C:\ProgramData\QlikTech\WebServer\Log

See Qlik Help for more information. 

Commonly used for: 

• Front end web traffic diagnosis
• Ticket requests
• Load balancing determination
• Document lists
• Works in unison with IIS **

** If using IIS as Webserver, please also attach IIS log (C:\inetpub\logs\LogFiles\W3SVC1)

Service: Service Dispatcher/License Service

Default Location: 

C:\ProgramData\QlikTech\LicenseService\Log

Using the Log Collector (QlikView Server May 2022 and later)

With the release of QlikView Server May 2022, log collection functionality was built into the product. The log collector will collate all of the QlikView Service logs, as well as the QlikView Server About information and Windows Events logs, if specified, for the start and end dates chosen into a .zip file and output to %ProgramData%\QlikTech\LogCollector. 

Related Content:

Event Log Verbosity in Qlik View 
Best setup setting for QlikView Server logging 
Troubleshooting QlikView Server resource problems and crashes  
Recommended Log files to analyze QlikView problem 
QlikView Services and Log Guide 

Several questions were raised up about the use of Qlik Sense Map Object. This article highlights few of them but the list is not exhaustive. As addition, see also Qlik Sense / NPrinting: Export vs Using Proxy, Q&A.

Question: when using built-in map object, what does the Qlik Server connect to? Qlik proprietary server? 3rd party geo services? 
Answers: maps.qlikcloud.com and arcgisonline.com.
                But if you are using your own Enterprise GeoAnalytics Server, you can change the in-built map chart url. See How to change the map url in built-in map chart to a local GeoAnalytics map server

Question: What information is transmitted out via the Internet? 
Answers:

• on data traffic: Qlik Online Help for Qlik GeoAnalytics > Using Qlik GeoAnalytics for Qlik Sense What data is transferred to the server from the map extension?
• on ports: Qlik Online Help for Qlik Sense for administrators > Planning your deployment > Ports

Environment:

• Qlik Sense Enterprise
• Qlik sense Desktop

End of Support for Qlik products follows Release Management Policy, as documented in the Product Terms found on the Qlik Site: On-Premise Products Release Management Policy

For detailed information on end of life and release dates, see:

Qlik Sense Enterprise on Windows Product Lifecycle  
Qlik NPrinting Product Lifecycle 
QlikView Product Lifecycle  

Related Content:

• NPrinting 16 to NPrinting 19+ Migration Playbook
• QlikView Release Management and End of Life
• On-Premise Products Release Management Policy

How to configure to use a new .pfx certificate for use with Qlik NPrinting Web Console and/or the NewsStand after converting it to the .key and .crt format

CNG-type certificates are not supported for use with NPrinting Server. See Requirements(help.qlik.com).

Items Needed:

• A certificate with the Private Key that can be extracted (PFX files are the easiest)
• Import the Password for the PFX certificate
• OpenSSL (3rd Party free software- see disclaimer at end of this article) to extract the certificate and gather the .crt and .key files. See Installing OpenSSL

Please review this information with your internal Certificate Authority or appropriate IT team that would provide the certificate and follow their guidelines if it differs from the steps here. If a new certificate cannot be issued for the Qlik NPrinting server, a workaround for the issue may be found under General: what does the certificate error(red cross) in browser mean and how to fix it.

All the steps below can be performed automatically with one click using a third-party tool called NPrinting Certificate Configurator, which can be downloaded from the Releases section. Keep in mind that Qlik does NOT support the 3rd party software mentioned and used in this documentation. Please use them at your own discretion and, if concerned, contact the proper IT team within your company to verify the ability to use non-Qlik related software in the environment.

Before proceeding to the following steps, you must first install Open SSL. See Installing OpenSSL.

Extract the .CRT and .KEY files

Three Steps:

1. Extract the .crt file from the .pfx file. Using an administrative command prompt, navigate to the Open SSL/bin folder on your NPrinting computer and extract the .crt file from the .pfx file.
   
   
   
   Test Command: openssl pkcs12 -in C:\NPCerts\QS3Cert.pfx -clcerts -nokeys -out C:\NPCerts\QS3.crt
   Example Command: openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]
   
   Note: The Import Password is determined by the CA when the certificate is exported/created. This is to help protect the Private Key. It should be supplied with the certificate from the 3rd Party SSL CA  / Internal CA. If you do not have this password, you will not be able to use the certificate.
   
   
   
2. Extract the .key file from the .pfx file.
   
   
   
   Test Command: openssl pkcs12 -in C:\NPCerts\QS3Cert.pfx -nocerts -out C:\NPCerts\QS3.key
   Example Command:  openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]
   
   Note: The PEM passphrase is used to protect the new .key file you’ve created.
   

3. Decrypt the .key file. Qlik NPrinting cannot have a passphrase on the .key file. Follow steps below to remove/decrypt the .key file. This is REQUIRED.



Test Command: openssl rsa -in C:\NPCerts\QS3.key -out C:\NPCerts\QS3.key
Example Command:  openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Note: At this stage, we’re removing the pass phrase from the .key, unencrypting it for Qlik NPrinting to read it.

In the Test Command, we’re overwriting the same file in the command. This works, but if you want a separate copy of the encrypted and decrypted Key you’ll need to make them different file names or locations.  

NPrinting Web Console

1. Place the extracted .crt and .key files in the webconsoleproxy folder and update the app.conf file.
   
   
    
2. Edit the Qlik NPrinting Web Console proxy configuration file: %ProgramData%\NPrinting\webconsoleproxy\app.conf.
   1. Uncomment by removing the # and change or add the following lines to:
3. http.sslcert=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.crt. Change the certificate file name if necessary.
4. http.sslkey=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.key. Change the private key file name if necessary.
   1. ${ProgramData} is the Windows ProgramData environment variable with the notation for the configuration file. As an alternative, you can insert your full path, for example, C:\ProgramData\NPrinting\webconsoleproxy\NPrinting.crt.
5. SAVE the app.conf file to preserve the changes

Qlik NPrinting Newsstand

1. Place the new .crt / .key files in the newsstandproxy folder and update the app.conf  file.
   
   
   
   
2. SAVE the app.conf file to preserve the changes

Finalize

Restart the Qlik NPrinting Web Engine and check the nprinting_webengine.log to verify there’s no issues with new certificate information.



Note:  The above is an example of a clean start of the Web Engine. Default location for those logs are located: "C:\ProgramData\NPrinting\Logs"

Verify the Certificates

Verify that the certificate is being used in the browser.


 
Note: In this example, the certificate is correctly being presented to the browser under the URL of qlikserver3.domain.local. With this certificate, it’s the ONLY name that this certificate will trust.


 
Note: This is the result using the servername instead of the FQDN. You can access the URL, but it presents a “Not secure” message, but shows the correctly installed certificate. The reason for this is that the server recognizes the name, but the certificate only allows qlikserver3.domain.local. If you want multiple URL/Aliases, they need to be added in the certificate. 

Related Content:

Securing the NPrinting Web Console with 3rd party certificates 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Session Recovery allows users to resume their session in a QlikView document after they have terminated the previous session. It re-applies selections active when the session was closed.  The feature is only available in the Full Browser/AJAX client.

This feature is only available in QlikView.

Session recovery is not available for the QlikView Plugin or Desktop Client.

Environment:  

Allow Session Recovery

 

How to clear a saved session

• Click view details on the document
• In the pop-up window,  click Remove Last Document state
  
  

Information about app and storage size for Qlik Cloud for Qlik Sense Enterprise SaaS and Qlik Sense Business can be found in Qlik Sense capacity.  

Note: An app on disk is typically 4-6 times bigger in memory, although this is a rule of thumb and exceptions can and do occur, and an app within the "on-disk" size limit may balloon past the "in memory" limit.  

App Objects have a memory limit of 10 GB, except when run on dedicated capacity.

If you are looking to compare other features between Qlik Sense Business and Qlik Sense Enterprise SaaS, see Compare product features 

For more information about capacity, see:

Qlik Sense specifications and capacity 
Pricing | Qlik Sense

You can change or reset the password of your Qlik Account on either Qlik.com or MyQlik.

Choose your option:

• Scenario 1: Reset Password from MyQlik portal
• Scenario 2: Forgot Password via Qlik Portals

Related Article: How to Register for a Qlik Account

Scenario 1: Reset Password from MyQlik portal

1. Log in to https://myqlik.qlik.com/portal with your email address and current password
   
   
2. Open Password & Security and Click Reset
   
    

    

3. A message pops up. Click Reset Password
   
   
   
   
4. Find the email sent by no.reply@qlik.com 
   
   Note: Check your spam folder if you cannot locate it.
   
   
5. Click Reset Password in the email
   
   
6. Follow the on-screen instructions to choose a new password.
   
   
   
   
7. You will now be able to log in with your new credentials (email and password combination)

Scenario 2: Forgot Password via Qlik Portals

1. Go to Qlik.com
   
   
2. Hover over Login in the top right corner
   
   
3. Select any of the portals you want to access.
   
   
   
   
4. Click I forgot my password
   
   
   
   
5. Confirm your email address
6. Click Send email
   
   
   
   
7. An email will be sent
   
   
8. Find the email sent by no.reply@qlik.com 
   
   Note: Check your spam folder if you cannot locate it.
   
   
9. Click Reset Password in the email
   
   
10. Follow the on-screen instructions to choose a new password.
    
    
    
    
11.  You will now be able to log in with your new credentials (email and password combination)
    
    

If at any point you do not receive a password or an email, see No Activation or Password Reset Email arrives or contact our support representatives.