IBM QRadar

Abdul Quadeer posted Sat March 08, 2025 02:06 PM

Hi Shubham,

Could you please share the host device config also what process you have followed for this installation?

Shubham Shah posted Sun March 09, 2025 08:13 AM

Hi ,

I have tried the below following steps.

1. installed VMware Worsktation Pro 17 on my laptop
2. Got the Qradar community edition installer file from the link "https://www.ibm.com/community/101/qradar/ce/"
3. opened the File as VM in vmware with following necessary system config , 25 GB ram , 6 cores , 300 GB of disk
4. Begin the installation and on start only the error image came.
5. Tried few RedHat quick fix on the error but did not got much progress.

let me know what can be done to get this work.

Karl Jaeger IBM Champion posted Tue March 11, 2025 07:02 AM

Shubham

just to set this right. The CE image should be pointed at by your virtual CD ROM drive as an boot image in your new vm config. Everything else will happen automatically then.

BR Karl

Abdul Quadeer posted Tue March 11, 2025 04:32 PM

Hi,

In addition to Karl's suggestion, also check whether you are using sata/ssd or nvme? QRadar CE can't be installed on nvme (as far as i have experienced) you have to use ssd/sata.

Shubham Shah posted Wed March 12, 2025 08:58 AM

Hey Guys,
Thanks for the troubleshoot

What I can understand from my VMware drives config are
1.Hard Disk is NVME 0:0.
2.CD / DVD 2 SATA has the ISO image linked 
3. CD / DVD ( SATA ) has the autoinst.iso file

I have attached the screenshots of the drives that are being used.

I am not sure what config I can change to make it work.

Abdul Quadeer posted Wed March 12, 2025 04:14 PM

Hi Shubham,

In "Hard disk Advanced Settings" change it to sata from nvme. You can also delete it and readd it as sata, it should solve problem. Rest config is fine.

Shubham Shah posted Thu March 13, 2025 01:44 AM

Hey,
I am bit confused as I am not getting SATA option under "Hard disk Advanced Settings" .
All I can see is NVME different versions. ( Attached the screenshot)

Karl Jaeger IBM Champion posted Sun March 16, 2025 07:32 AM

Hi, concerning the drive options. For hard disk I am using SCSI controller. Using workstation 17 I am not 100% sure but pls try your NVM settings if SCSI controller is not available. Regarding the CD ROM drives I am a bit confused. As outlined already a single drive will do the trick pointing to ISO [datastore1] qradar-750-CE/750-QRADAR-QRFULL-2021.6.8.20240302192142.iso using SATA controller as being discussed alreaady. There is no need to assign another iso. Even mor your VM will get confused where to boot from. Pls remove your 2nd cdrom drive and just use the standard CE iso. QRadar boot will identify the instal procedure and go on after booting. Eventually you have to checkup your CD options. Make sure its connected while powering on.

Shubham Shah posted Sun March 16, 2025 08:20 AM

Hi Karl,
Thank you for your response.

I did removed the extra drive attached under SATA and made one to get booted.
This time I got the error of disk space is not sufficient. ( Attached Screenshot)

Config current attached is 300 GB & also tried the same with 350 GB ( got the same error).

Abdul Quadeer posted Sun March 16, 2025 05:30 PM

Hi,

Do you have any SSD/HDD installed in the system? If yes you should get that option. The error shown in your snap arises when you use nvme. See my snap for reference. Also go through this Reddit post :  https://www.reddit.com/r/QRadar/comments/1cvl0n7/how_to_install_qradar_community_edition_75/

Karl Jaeger IBM Champion posted Mon March 17, 2025 06:38 AM

Hi Shubham, thx for the HD definitions. The problem with CE is that you have to define your HD with dynamic thin provisioning rather than allocated fixed size. The minimum size is irrelevant , I am using 250 GB. The disk type is the one thats causing the error. My max size is 880GB btw. so pls use a limit thats large enough. Yes I am using SD on my machine.