IBM QRadar

Hi,

Have anyone experienced upgrade failure from 7.4.3 (Build 20210517144015) to 7.4.3 Fix Pack 2 (Build 20210810221124)? When system goes on restart it is not booting up, freeze on black screen with white cursor in left side. SIEM is on dedicated hardware.

Hi,

not yet. Sounds unusual. I would recommend creating a support ticket.

Regards,

Ralph

I agree with Ralph, this is a system down upgrade issue. You should get a case opened with support so our system down team can evaluate the error logs. You can run a get_logs from the command line to retrieve the error logs if you can access the appliance from an SSH session.

For more information on logs from the command line, see: https://ibm.biz/qradarlogs

Hi,

Precaution! Always create copies of config files before change!

I have faced the same situation several times on different hardware (IBM M4 X series) and always with SFS upgrade, reinstall from ISO is always fine, reinstall from ISO is not a good solution itself. Problem is not constant. All doing according "Upgrading QRadar SIEM" .

As it is not loading and freeze with no options to get to the grub, it leads that there is problem with boot loader or kernel.

Steps to resolve(not all commands included only main points):

1. Mount Qradar latest full iso from USB flash.
2. Enter rescue shell.
3. Mount SIEM file system.
4. efibootmgr -v;
5. detect red boot option in my case number 0003, delete: efibootmgr -b 0003 -B;
6. from latest failed setup logs find exact command "efibootmgr -c -d ...." copy it, but it will not work!
7. This command is working one: efibootmgr -c -d /dev/sda -p 1 -w -L red -l '\EFI\red\grubx64.efi' - crucial difference from not working one is those pesky characters '' which enclose .efi path.
8. That's all, reboot and all working.

This should be investigated by IBM, because I suspect that upgrade script commands and some bash interpreter are making bad jokes! Don't believe that I am the only lucky one.

regards,

John