Installs and Upgrades 101
QRadar Support related to installs, upgrades and working with managed hosts in a QRadar deployment.
QRadar Architecture and Installation Resources
IBM® QRadar® architecture supports deployments of varying sizes and topologies, from a single host deployment, where all the software components run on a single system, to multiple hosts, where appliances such as Event Collectors, and Flow Collectors, Data Nodes, an App Host, Event Processors, and Flow Processors, have specific roles.
Managed Host Resources
A distributed IBM Security QRadar deployment is comprised of a Console and a number of managed hosts. Managed hosts are non-Console QRadar appliances that provide greater flexibility over data collection and event and flow processing.
- Adding a managed host
- Unable to add Managed Host to Deployment
- Removing a managed host
- Encrypted hosts, what does it mean?
- Firewalls & Port considerations
- Replacing a Console appliance using a new IP address or hostname
- Replacing a Console appliance using the same IP address or hostname
- Replacing a QRadar Managed Host appliance in a deployment (16xx, 17xx, 18xx)
- Migrating from an App Node to an App Host
Fix Packs (SFS Files)
The most common software update scenario for administrators is to install a QRadar fix pack update. Fix packs resolve known issues and normally do not contain features or major operating system changes. Fix Packs update the F in IBM’s V.R.M.F software deliveries).
Required Reading
- Fix Pack pre-install checklist
- QRadar 7.5 Upgrade Guide
- QRadar 7.4 Upgrade Guide
- All PDF documentation
Fix Pack Notes
Run drq health checks before you begin any upgrade. QRadar Support instructs administrators to stay updated and apply Fix Packs when available. Fix Packs are typically released on 8 to 12 week cycles for supported software versions as indicated by the QRadar Software Lifecycle.
Upgrades (ISO Files)
Upgrades are major release updates, delivered as an ISO file to add new features, operating system (OS) updates, and resolve issues as part of the installation. An upgrade generally increment the modification (M) numeric indicator for IBM V.R.M software deliveries).
Required Reading
- Major upgrade pre-install checklist
- QRadar 7.5 Upgrade Guide
- QRadar 7.4 Upgrade Guide
- All PDF documentation
Upgrade notes
Administrators might be required during major updates to install an ISO, then apply a Fix Pack to update a deployment to the latest software version. IBM does not release ISO files with every Fix Pack version. Administrators should review the Upgrade Guide to determine if VMs meet suggested memory requirements as new features can consume more resources over time.
Installation Known Issues
This list includes recent known related to upgrades and patching QRadar software versions.
- IJ17438: INSTALLATION OF QRADAR CAN FAIL DUE TO INCORRECT DETECTION OF BIOS CONFIGURATION
- IJ21608: QRADAR SOFTWARE INSTALL CAN FAIL DUE TO PARTITION SIZE CHECK FAILURE
- IJ21518: QRADAR NETWORK INSIGHTS (QNI) INSTALLATIONS CAN FAIL AT STORAGE PRE-CHECK
For a complete list of APARs, see the QRadar APARs 101 page.
Upgrade Known Issues
This list includes recent known related to upgrades and patching QRadar software versions.
- IJ22566: QRADAR PATCHING CAN FAIL AND ROLLBACK WHEN BLANK TABLES ARE PRESENT IN THE QVM FUSION DATABASE
- IJ12252: QRADAR PATCH FAILS WHEN MORE THAN ONE .SFS FILE IS MOUNTED
- IJ16960: THE QRADAR PATCH PRETEST FAILS WHEN A BACKUP IS IN ‘MISSING’ STATE IN THE DATABASE
- IJ20458: QRADAR PATCH AND OR REPLICATION PROCESS CAN FAIL WHEN MULTIPLE DUPLICATED ASSET.ASSETVIEW DATA EXISTS
- IJ21697: DOCKER CAN FAIL TO START DURING QRADAR PATCHING PROCESSES
- IJ17204: ECS-EP PROCESS FAILS TO START AFTER PATCHING TO QRADAR 7.3.2 (OR LATER) WHEN CUSTOM SNMP TRAP EVENTS WERE CONFIGURED
For a complete list of APARs, see the QRadar APARs 101 page.
“IBM prides itself on delivering world class software support with highly skilled, customer-focused people. QRadar Support is available 24×7 for all high severity issues. For QRadar resources, technical help, guidance, and information, see our QRadar Support 101 pages.”
Contact Support
Find your regional support contact
Give Feedback