Upgrading QRadar Network Packet Capture on IBM hardware
When you upgrade IBM®
QRadar Network Packet Capture, both the QRadar Network Packet Capture software and Red Hat® Enterprise Linux® operating system are upgraded. The
configuration files and packet capture files remain unchanged.
Before you begin
- You are logged in to the QRadar Network Packet Capture appliance as an administrator.
- You are using an IBM-supplied QRadar Network Packet Capture appliance.
- The computer that you use to mount the .iso file must be on the same
network as the appliance that you want to upgrade.
Network and internet latency across networks can cause the upgrade to fail.
- If you are using a USB flash drive to upgrade, connect a keyboard and monitor by using the VGA connection.
If your deployment includes QRadar Network Packet Capture appliances
that are in a stacked or grouped configuration, complete the following tasks before you upgrade:
- Ensure that traffic capture is stopped.
For more information, see Starting or stopping packet capture.
- Remove the appliances from the group or stack.
After all your appliances are upgraded to the same version, you can re-create the group or stack. By upgrading each appliance individually and then rebuilding the stack and group configuration, the packet capture data is preserved during the upgrade process.
For more information, see Stacked appliances and Grouped appliances.