Upgrading QRadar Network Packet Capture on IBM hardware

When you upgrade IBM® QRadar Network Packet Capture, both the QRadar Network Packet Capture software and Red Hat® Enterprise Linux® operating system are upgraded. The configuration files and packet capture files remain unchanged.

Before you begin

Ensure that the following requirements are met:
  • You are logged in to the QRadar Network Packet Capture appliance as an administrator.
  • You are using an IBM-supplied QRadar Network Packet Capture appliance.
  • The computer that you use to mount the .iso file must be on the same network as the appliance that you want to upgrade.

    Network and internet latency across networks can cause the upgrade to fail.

  • If you are using a USB flash drive to upgrade, connect a keyboard and monitor by using the VGA connection.
If your deployment includes QRadar Network Packet Capture appliances that are in a stacked or grouped configuration, complete the following tasks before you upgrade:
  • Ensure that traffic capture is stopped.

    For more information, see Starting or stopping packet capture.

  • Remove the appliances from the group or stack.

    After all your appliances are upgraded to the same version, you can re-create the group or stack. By upgrading each appliance individually and then rebuilding the stack and group configuration, the packet capture data is preserved during the upgrade process.

For more information, see Stacked appliances and Grouped appliances.

Procedure

  1. Download the .iso image from IBM Fix Central (www.ibm.com/support/fixcentral).
    The .iso file is named x.x.x-QRadar-NETPCAP-Upgrade-nnnn.iso, where:
    • x.x.x is the release version.
    • nnnn is a four-digit number that is allocated to the build.
    For example, if you are upgrading to QRadar Network Packet Capture 7.4.3 Fix Pack 2, select 7.4.3-QRadar-NETPCAP-Upgrade-1304.
  2. To use IMM2 to mount the .iso image, follow these steps:
    1. Log in to the IMM2 management module.

      You must access the IMM2 management module by using Active X with Internet Explorer, or a browser that supports Java™.

    2. Click Remote Control.
    3. To start the remote control session, click Active X if you are using Internet Explorer, or click Java for all other browsers.
    4. Click Start Remote Control in Single User Mode to start the session.
    5. On the Virtual Media menu, click Activate.
    6. On the Virtual Media menu, click Select Devices to Mount.
    7. In the Select Devices to Mount window, click Add Image.
    8. Locate the .iso image that you want to use, and click Open.
    9. Select the Mapped checkbox next to the drive to mount, and click Mount Selected.

    To watch a video tutorial about mounting an .iso by using the IMM2 management module, see QRadar: Mounting ISOs Using IMM (https://www-01.ibm.com/support/docview.wss?uid=swg21974632).

  3. Alternatively, you can copy the .iso to a bootable USB flash drive.

    For more information, see Creating a bootable USB flash drive with Red Hat Linux.

  4. Restart the appliance.
  5. On the Boot Devices Manager window, select the Upgrade option to start the upgrade process.
    Warning: The upgrade process ensures that your configuration files and captured data remain intact. Choosing any other option might reset your configuration and delete your capture data.
  6. After the upgrade is completed, restart the appliance.

Results

QRadar Network Packet Capture is upgraded.