IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Upgrade failure 7.4.3 Fix Pack 2 (Build 20210810221124)

    Posted Tue October 12, 2021 07:02 PM

    Hi,

    Have anyone experienced upgrade failure from 7.4.3 (Build 20210517144015) to 7.4.3 Fix Pack 2 (Build 20210810221124)? When system goes on restart it is not booting up, freeze on black screen with white cursor in left side. SIEM is on dedicated hardware.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Upgrade failure 7.4.3 Fix Pack 2 (Build 20210810221124)

    Posted Wed October 13, 2021 07:44 AM

    Hi,

    not yet. Sounds unusual. I would recommend creating a support ticket.

    Regards,

    Ralph



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Upgrade failure 7.4.3 Fix Pack 2 (Build 20210810221124)

    Posted Wed October 13, 2021 01:59 PM

    I agree with Ralph, this is a system down upgrade issue. You should get a case opened with support so our system down team can evaluate the error logs. You can run a get_logs from the command line to retrieve the error logs if you can access the appliance from an SSH session.

    For more information on logs from the command line, see: https://ibm.biz/qradarlogs



    #QRadar
    #Support
    #SupportMigration


  • 4.  RE: Upgrade failure 7.4.3 Fix Pack 2 (Build 20210810221124)

    Posted Thu October 14, 2021 09:51 AM

    Hi,

    Precaution! Always create copies of config files before change!

    I have faced the same situation several times on different hardware (IBM M4 X series) and always with SFS upgrade, reinstall from ISO is always fine, reinstall from ISO is not a good solution itself. Problem is not constant. All doing according "Upgrading QRadar SIEM" .

    As it is not loading and freeze with no options to get to the grub, it leads that there is problem with boot loader or kernel.

    Steps to resolve(not all commands included only main points):

    1. Mount Qradar latest full iso from USB flash.
    2. Enter rescue shell.
    3. Mount SIEM file system.
    4. efibootmgr -v;
    5. detect red boot option in my case number 0003, delete: efibootmgr -b 0003 -B;
    6. from latest failed setup logs find exact command "efibootmgr -c -d ...." copy it, but it will not work!
    7. This command is working one: efibootmgr -c -d /dev/sda -p 1 -w -L red -l '\EFI\red\grubx64.efi' - crucial difference from not working one is those pesky characters '' which enclose .efi path.
    8. That's all, reboot and all working.

    This should be investigated by IBM, because I suspect that upgrade script commands and some bash interpreter are making bad jokes! Don't believe that I am the only lucky one.

    regards,

    John



    #QRadar
    #Support
    #SupportMigration


Related Content