IBM Support

Release of the QRadar Network Insights 7.3.1 Patch 6 ISO (7.3.1.20180912181210)

Release Notes


Abstract

This technical note contains installation instructions, new features, and includes a resolved issues list for the release of QRadar Network Insights 7.3.1 Patch 6 ISO (7.3.1.20180912181210). These instructions are intended for administrators who are upgrading from QRadar 7.2.8 Patch 3 or later to QRadar Network Insights 7.3.1 Patch 6 by using an ISO file.

Content

What's new


For information on what's new in QRadar products for version 7.3.1, see: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/c_qradar_ov_whats_new_731.html

About this upgrade


These instructions are intended to assist administrators to update appliances from QRadar 7.2.8 to QRadar Network Insights 7.3.1 Patch 6 by using an ISO file. This ISO can update QRadar SIEM, QRadar Risk Manager, and QRadar Vulnerability Manager products from 7.2.8 to version 7.3.1 Patch 6.

QRadar 7.3.1 Patch 6 uses an ISO file to update hosts to the latest software version. A minimum of QRadar 7.2.8 Patch 1 (or later) is required to be able to upgrade to QRadar Network Insights 7.3.1 Patch 6. Each host must be updated individually.

See QRadar: Software update check list for administrators for a list of steps to review before updating your QRadar deployment.

If you have installed QRadar 7.2.8 version or later, you are not required to install each ISO release to update to QRadar 7.3.1 Patch 6.

Current Version ISO Upgrades to QRadar Network Insights 7.3.1 Patch 6?
QRadar Network Insights 7.2.8 Patch 3 or later Yes, use these release notes to complete this process.
QRadar Network Insights 7.3.0 (any patch version) See the QRadar 7.3.1 Patch 6 SFS release notes .
QRadar Network Insights 7.3.1 See the QRadar 7.3.1 Patch 6 SFS release notes .


image
Figure 1: If you have installed QRadar 7.2.8 or later, you are not required to install each ISO release to update to QRadar 7.3.1 Patch 6.




Administrator notes

  1. The QRadar Console must be updated before you update your QRadar Network Insights appliance.
  2. If you have a software installation, you need your Red Hat Enterprise ISO and the QRadar Network Insights ISO. Administrators with software installations on their own hardware must read the QRadar Network Insights Install Guide to understand how to partition their systems appropriately.
  3. QRadar Network Insights must be on QRadar 7.2.8 Patch 3 or later to upgrade.
  4. The upgrade from QRadar 7.2.8 Patch 3 to QRadar Network Insights 7.3.1 Patch 6 will use a .ISO file. Previously, ISOs were for new appliance installations only, but QRadar 7.3.1 Patch 6 is an exception to this rule because of the Red Hat kernel update requirements.
  5. The ISO must be mounted to the appliance and run locally on each host.
  6. The 7.3.1 Patch 6 upgrade will take longer than expected due to the kernel changes to Red Hat 7 Enterprise. Early upgrade customers are reporting 2 to 2.5 hours to upgrade the Console appliance. You should be aware of this longer time frame and plan your maintenance accordingly.
  7. If power users created utilities or custom scripts for their QRadar deployment, these files should be copied off the system. During the 7.3.1 Patch 6 update, a warning is displayed that only data in /store is going to be preserved. After the appliance reboots, any scripts, 3rd party accounts, or utilities in /tmp, or /, or /root will be deleted. This does not impact ISO files mounted initially using /root because this cleanup only occurs later in the installation procedure.

Before you upgrade


Ensure that you take the following precautions:

  • Back up your data before you begin any software upgrade and verify that you have recent configuration backups that match your existing Console version. If required, take an on demand configuration backup before you begin. For more information about backup and recovery, see the IBM QRadar Administration Guide .
  • All appliances in the deployment must be at the same software and patch level in the deployment.
  • Verify that all changes are deployed on your appliances. The update cannot install on appliances that have undeployed changes.
  • A QRadar Network Insights 7.3.1 Patch 6 ISO is available to upgrade from QRadar 7.2.8 Patch 3 or install a new appliance or virtual machine. To complete a new installation, review the QRadar Network Insights Installation Guide .
  • If you are unsure of the IP addresses or hostnames for the appliances in the deployment, run the utility /opt/qradar/support/deployment_info.sh to get a .CSV file with information about the QRadar deployment. The CSV file will contain a list of IP addresses for each managed host.
  • If you are unsure of how to proceed when reading these instructions or the documentation, it is best to ask before starting your upgrade. To ask a question in our forums, see: http://ibm.biz/qradarforums .

Part 1. Staging files and pretesting your deployment (required)


It is important that you pretest your deployment to ensure that you will not experience unexpected issues when you update to QRadar 7.3.1 Patch 6. A pretest is a common precaution that should be taken before you install an update to locate potential issues. The pretest does not restart services and can be completed without scheduled downtime. The pretest typically takes between 3 to 5 minutes to complete on each appliance. If for some reason your SSH session is disconnected, you can reconnect to the remote host using screen.

Procedure
The pretest should be completed on all hosts by the administrator before you attempt to upgrade to QRadar 7.3.1 Patch 6.

  1. Download the QRadar Network Insights 7.3.1 Patch 6 ISO (5+ GB) from the IBM Fix Central website: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Security+QRadar+Vulnerability+Manager&fixids=7.3.1-QRADAR-QRSIEM-20180912181210&function=fixId&parent=IBM%20Security

    NOTE: QRadar Incident Forensics and QRadar Network Insights use the same ISO for both products to upgrade from 7.2.8 to 7.3.1 Patch 6.

  2. Use SSH to log in to your Console as the root user.
  3. Type the following command: screen
  4. To make the directory for the update, type: mkdir -p /media/cdrom
  5. To verify that you have enough space (5.5 GB), type: df -h /root /var/log | tee diskchecks.txt
    • Best directory option: /root
      It is available on all appliance types, and is the best option to host the ISO file.
    • 2nd best directory option: /var/log
      This directory is available on all appliances, but there might not be the required space available.
    • DO NOT USE: /tmp, /store/tmp, or /store/transient for your ISO upgrade. These directories are partitioned as part of the upgrade and administrators cannot use them as storage locations or mount points for the ISO file.

      If the disk check command fails, retype the quotation marks from your terminal, and then re-run the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have a minimum of 5.5 GB of space available in a directory to copy the ISO before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less than 5.5 GB available.

      Reminder: Utilities or custom scripts that administrators have created for QRadar should be copied off the system. During the 7.3.1 update a warning is displayed that only data in /store will be preserved. Therefore, scripts, 3rd party utilities in /tmp, or /, or /root will be deleted during the upgrade.

  6. If there is not 5.5GB of space in /root or /var/log, the administrator must make directory space for the ISO file.
  7. Use WinSCP or SCP to copy the ISO to the /root or /var/log directory on the QRadar Network Insights appliance.
  8. To check for any previously mounted files in the /media/cdrom directory, type the following command:
    df -h
  9. You must unmount any previously mounted files before you mount this software update file. To unmount any previously mounted files, type the following command:
    umount /media/cdrom
  10. To mount the ISO on all appliances, type mount -o loop /root/Rhe764QRadar7_3_1_20180912181210.stable-7-3-1.iso /media/cdrom
  11. To pretest the Console appliance, type: /media/cdrom/setup -t
    The pretest output is written to the command window. Review this output after the pretest completes.
  12. Use SSH to open an SSH session to the other appliances in your deployment. QRadar Support recommends that all administrators run the pretest on each host to identify issues before the update begins.
  13. To pretest the managed host, type: /media/cdrom/setup -t

    Results
    If an appliance in your deployment fails the pretest, take the recommended action from the pretest utility. The issue must be resolved before the update to 7.3.1 Patch 6 begins to prevent downtime for specific appliances. If there are messages you do not understand or want to discuss further, you can use our forums http://ibm.biz/qradarforums to get advice. Administrators can open a ticket directly with QRadar Support ( http://ibm.biz/qradarsupport ).

Part 2. Installing the QRadar Network Insights 7.3.1 Patch 6 ISO


These instructions guide administrators through the process of upgrading an existing QRadar Network Insights install at 7.2.8 Patch 1 or later to QRadar 7.3.1 Patch 6. The update on the Console must be completed before you attempt to update QRadar Network Insights.


Procedure

  1. Use SSH to log in to the Console as the root user.
  2. Use SSH to log in to the QRadar Network Insights appliance.
  3. To run the ISO installer on the Console, type the following command: /media/cdrom/setup

    Important: Upgrading from QRadar Network Insights 7.2.8 Patch 1 or later to QRadar Network Insights 7.3.1 Patch 6 can take approximately 1 to 2 hours.


Results
A summary of the ISO installation advises you of any issues. If there are no issues, administrators can use SSH to log in to managed hosts and start the installer on each host to run the setup in parallel.

Note: In QRadar 7.3.1 Patch 6, a kernel update is introduced to address issues with appliances failing to log in or list unit files. These issues could prevent the appliance from rebooting. This new kernel does not take effect until the appliance is rebooted. You might need to reboot your system manually for the kernel update to take effect.

To work around this issue, do one of the following:

  •  If you are able to use SSH, type the following command: systemctl --force --force reboot
  •  If you are not able to use SSH, you must perform a cold reboot of the appliance. To do this, physically reboot the appliance or use Integrated Management Module (IMM)

Part 3. Installation wrap-up

  1. After all hosts are updated, send an email to your team to inform them that they will need to clear their browser cache before they log in to QRadar SIEM.
  2. To unmount the /media/cdrom directory on all hosts, type: umount /media/cdrom
  3. Administrators can delete the ISO from all appliances.
  4. Review any static routes or customized routing. As mentioned in the administrator notes, all routes were removed and must be reconfigured after the upgrade completes.
  5. Review all configured iptable rules because the interface names have changed in QRadar 7.3.1 Patch 6 due to the Red Hat Enterprise 7 operating system updates. Any iptables rules that use the Red Hat 6 interface naming conventions must be updated.

Resolved issues


Some APAR links in the following table might take 24 hours to display properly after a software release is posted to IBM Fix Central.

Resolved issues in QRadar 7.3.1 Patch 6
Product Component Number Description
QRADAR DATA IJ07162 CONFIGURED DATA RETENTION DELETE SETTINGS ARE NOT HONORED FOR MULTI-TENANCY
QRADAR USER INTERFACE IJ05649 'DEPLOY CHANGES' CAN SOMETIMES CAUSE A DROP IN CONNECTION BETWEEN ECS-EC AND ECS-EP LEADING TO EVENTS BEING DROPPED
QRADAR RULES IV98895 RULE RESPONSE LIMITER FOR ANOMALY (THRESHOLD) RULES IS NOT FUNCTIONING AS EXPECTED
QRADAR UPGRADES IJ09572 PATCH/UPGRADE TO QRADAR 7.3.1 PATCH 6 CAN HANG FOR AN EXTENDED PERIOD OF TIME (HOURS) WITH "VULN_MAP_ASSET_MV DOES NOT EXIST"
QRADAR DOMAINS IJ07713 QRADAR DOES NOT ALLOW ALL TOP LEVEL DOMAINS IN EMAIL ADDRESS DATA VALIDATION, CAN RETURN 'EMAIL ADDRESS IS NOT VALID'
QRADAR USER INTERFACE IJ06980 DASHBOARDS AND/OR QUICK SEARCHES CAN DISAPPEAR AFTER MODIFICATIONS HAVE BEEN MADE TO USER SETTINGS
QRADAR SEARCHES IV54692 EVENT SEARCHES THAT FILTER BY THE EVENT PROCESSOR MIGHT DISPLAY UNEXPECTED GRAPH RESULTS
QRADAR REPORTS IJ07276 RTF FORMATTED REPORTS CAN FAIL TO GENERATE WITH A NULLPOINTEREXCEPTION DISPLAYED IN THE LOGS
QRADAR SEARCHES IJ07123 INCONSISTENT RESULTS FOR ASSET SEARCHES 'ASSETS WITH OPEN SERVICE = DNS' VS 'ASSETS WITH OPEN SERVICE = DOMAIN'
QRADAR REPORTS IJ06862 REPORT RUNNER OUT OF MEMORY CAN OCCUR WHILE ATTEMPTING TO GENERATE VERY LARGE TABLE CHART PDF REPORTS
QRADAR SEARCHES IJ06807 MODIFYING THE START TIME FOR A LOG ACTIVITY SEARCH CAUSES A BLANK UI WINDOW FOR SOME QRADAR USER LOCALES
QRADAR ASSETS IJ05767 WHEN AN ASSET'S 'GIVEN NAME' IS SET ON THE 'EDIT ASSET PROFILE' WINDOW, IT CAN NO LONGER BE EDITED SUCCESSFULLY
QRADAR ASSETS IJ05756 WHEN AN ASSET HAS A 'GIVEN NAME' ASSIGNED, ANY SUBSEQUENT ASSET NAME CHANGES DO NOT OCCUR IN 'EDIT ASSET PROFILE' WINDOW
QRADAR SEARCHES IJ00800 "HTTP ERROR 400" ERROR WHEN DRILLING DOWN INTO SEARCH RESULTS USING INTERNET EXPLORER 11 AND EDGE WEB BROWSER
QRADAR OFFENSES IV90797 DISPLAYING OFFENSE COUNT BY CATEGORY AND/OR NETWORK DOES NOT RESPECT USER ACCOUNT DOMAIN CONFIGURATION
QRADAR EVENTS IJ07456 EVENT DATA FROM SPILLOVER QUEUE CAN SOMETIMES FAIL TO PARSE WHEN PROCESSED BY THE REGULAR QRADAR PIPELINE
QRADAR HOSTS IJ07127 QRADAR HOSTS CAN TAKE A LONGER THAN EXPECTED TIME TO RECONNECT AFTER A VPN CONNECTION RESET OR INTERRUPTION HAS OCCURRED
QRADAR QUERIES IJ06633 SNMPD DAEMON CRASH OCCURS WHEN PERFORMING A WIDE QUERY
QRADAR DATA IJ02816 APPLICATION DATA CONTINUES TO BE SENT TO THE ASSET MODEL AFTER DISABLING 'CLIENT APPLICATION PROFILING'
QRADAR DASHBOARD IJ05151 DASHBOARD WIDGETS AND REPORTS CAN BE EMPTY AFTER A COMPLETED UPGRADE FROM 7.2.8P1+ TO 7.3.0+ OR 7.3.1+
QRADAR DATA IJ03225 DATA BACKUPS CAN TAKE LONGER THAN EXPECTED OR FAIL TO COMPLETE
QRADAR EVENTS IJ02598 MISSING THE FILE /STORE/PERSISTENT_QUEUE/ECS-EC.ECS-EC CAUSES EVENT PROCESSING/STORAGE TO FAIL
QRADAR INCIDENT FORENSICS SERVICES IJ07138 PACKET CAPTURE FAILS DUE TO NAPATECH3 SERVICE FAILING TO START
QRADAR FLOWS IJ08089 QFLOW PROCESS CAN FAIL ON A MANAGED HOST WHILE APPENDING MESSAGE TEXT SEQUENCE NUMBERS WHEN RECEIVING NETFLOW
QRADAR RULES IJ04902 GEOGRAPHIC RULE TESTS CONTAINING COUNTRIES WITH SPACES IN THEIR NAMES (MULTIPLE WORDS) ARE NOT BEING MATCHED
QRADAR USER INTERFACE IJ04174 APPS TABS CAN BE SLOW TO LOAD AND/OR OR FAIL TO LOAD IN THE USER INTERFACE DUE TO DOCKER FREE SPACE PROVISIONING
QRADAR NETWORK INSIGHTS LOG SOURCES IV87195 SOME QRADAR CONFIGURATIONS CONTAINING A LARGE NUMBER OF LOG SOURCES CAN SOMETIMES EXPERIENCE PERFORMANCE DEGRADATION
QRADAR DATA IJ06757 IMPORTED REFERENCE DATA DOES NOT EXPIRE AT ITS TIME TO LIVE WHEN THE REFERENCE DATA STRUCTURE IS IMPORTED USING CMT
QRADAR DATABASE IJ04182 CONTENT MANAGEMENT TOOL CAN FAIL DURING THE IMPORT OF CUSTOM_ACTION TABLES
QRADAR UPGRADES IV99773 QRADAR DEPLOY FUNCTION REQUIRED AFTER UPGRADE CAN FAIL IF THERE IS NOT ENOUGH FREE SPACE IN /TMP
QRADAR UPGRADES IJ07254 BUILD OR REBUILD OF A DISCONNECTED HIGH AVAILABILITY (HA) SECONDARY APPLIANCE (500) FROM QRADAR 7.2.8P1 TO 7.3.1 CAN FAIL
QRADAR LOGS IJ06866 LOG ROTATE NEEDS TO RUN MORE FREQUENTLY
QRADAR QUERIES IJ06633 SNMPD DAEMON CRASH OCCURS WHEN PERFORMING A WIDE QUERY
QRADAR APPLIANCES IJ06268 DBUS COMPONENT OF SYSTEMD CAN SOMETIMES ENTER A HUNG STATE CAUSING SOME RHEL COMMANDS TO FAIL TO RUN AS EXPECTED
QRADAR UPGRADES IJ06082 QRADAR UPGRADE TO 7.3.1.X CAN FAIL DURING THE INSTALLATION PROCESSES INCLUDED WITHIN "34-POSTGRESQL-UPGRADE.SH"
QRADAR SEARCHES IJ06148 'THERE WAS AN ERROR DOWNLOADING THIS ITEM' MESSAGE WHEN USING AN AQL SEARCH WITH TABLE, BAR, OR PIE CHARTS FOR A DASHBOARD
QRADAR APPLIANCES IJ02752 RUNNING THE QFLOW_DTLS_CERT_SETUP.PY AS PART OF A QNI APPLIANCE SETUP CAN FAIL
QRADAR RISK MANAGER BACKUP IJ06480 QRADAR UPGRADE TO 7.3.0.X CAN FAIL "...GENERATE_ENVIRONMENT.SH: OPTION REQUIRES AN ARGUMENT -- N"
QRADAR RISK MANAGER SIMULATIONS IJ06008 QRADAR RISK MANAGER SIMULATION CAN FAIL WITH 'NO RESULTS' IN THE SIMULATIONS SCREEN
QRADAR SEARCHES IJ06914 LEFT AND RIGHT KEYBOARD ARROW KEYS DO NOT RESPOND APPROPRIATELY WHILE BEING USED WITHIN SOME QRADAR SEARCH FIELDS
QRADAR VULNERABILITY MANAGER DEVICES IJ03313 'APPLICATION ERROR' WHEN PERFORMING A NORMALIZED DEVICE COMPARISON FOR A PALO ALTO DEVICE
QRADAR VULNERABILITY MANAGER LICENSES IJ01180 VULNERABILITY MANAGER 'TRY IT OUT' ICON IS STILL PRESENT AFTER APPLYING A PROPER VULNERABILITY MANAGER LICENSE
QRADAR OFFENSES IV90797 DISPLAYING OFFENSE COUNT BY CATEGORY AND/OR NETWORK DOES NOT RESPECT USER ACCOUNT DOMAIN CONFIGURATION
QRADAR EVENTS IJ07174 "(1026) INVALID DATA" WHEN ADDING COMMA SEPARATED IP ADDRESSES TO AN EVENT RULE
QRADAR OFFENSES IJ06833 OFFENSES CAN HAVE AN INCORRECT START TIME THAT IS PRIOR TO THE OFFENSE CREATION TIME WHEN USING "MATCH COUNT" RULES
QRADAR EVENTS IJ05592 NETWORK NAME AND EVENT 'DIRECTION' CAN BE DISPLAYED INCORRECTLY WHEN EVENTS CONTAIN IPV6 ADDRESSES
QRADAR USER INTERFACE IJ04928 HOVERING OVER AN IP ADDRESS DOES NOT SHOW THE NETWORK NAME IF THE COUNTRY FIELD IS NOT POPULATED IN NETWORK HIERARCHY
QRADAR OFFENSES IJ08032 QRADAR USERS WITHOUT THE 'MANAGE OFFENSE CLOSING' USER ROLE OPTION SELECTED CAN CLOSE OFFENSES
QRADAR AUTHENTICATION IJ07975 LDAP LOGIN CAN FAIL FOR USERS WITH INTERNAL OR OPERATIONAL ATTRIBUTES
QRADAR SERVICES IJ08436 PROCESS RUNNING OUT OF MEMORY DOES NOT CREATE SYSTEM.DMP FILE
QRADAR SEARCHES IJ08828 NON-ADMIN USERS ARE UNABLE TO USE SEARCH FILTER 'LOG SOURCE GROUP', THE LIST DOES NOT LOAD
QRADAR RULES IJ08845 /VAR/LOG/ FILLING WITH 'COM.Q1LABS.CORE.AQL.XFORCEFUNCTIONS: [ERROR]' MESSAGES


Where do I find more information?


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS6E69","label":"IBM QRadar Network Insights"},"Component":"Release Notes","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
18 January 2019

UID

ibm10729509