Upgrading QRadar Network Insights
You must upgrade all of your IBM® QRadar® products in your deployment to the same version.
Before you begin
Custom changes that you make to QRadar configuration files do not persist when you upgrade your deployment. Before you upgrade, back up any customized configuration files so that you can refer to them after the upgrade. After the upgrade is complete, do not overwrite the new configuration files with the old files. You must manually re-apply the customized settings.
The file that you use to upgrade QRadar Network Insights depends on which products are installed in your deployment. You must download the correct upgrade file from Fix Central (www.ibm.com/support/fixcentral/).
|Deployment scenario||Fix Central download|
|Deployment does not include QRadar Incident Forensics||Use the QRadar patch
file, which looks similar to this one:
This file upgrades QRadar and QRadar Network Insights appliances.
|Deployment includes QRadar Incident Forensics||Use the QRadar Incident
Forensics patch file,
which looks similar to this one:
This .sfs file upgrades the entire QRadar deployment, including QRadar Incident Forensics and QRadar Network Insights.
- Download the patch update file from IBM Fix Central (www.ibm.com/support/fixcentral).
- Use SSH to log in to your system as the root user.
- Copy the patch file to the /tmp directory or to another location that has sufficient disk space.
To create the /media/updates directory, type the following command:
mkdir -p /media/updates
- Change to the directory where you copied the patch file.
To mount the patch file to the /media/updates directory, type the
mount -o loop -t squashfs <patchupdate_filename>.sfs /media/updates/
To run the upgrade installer, type the following command:
The first time that you run the patch installer script, there might be a delay before the first patch installer menu is displayed.
- Provide answers to the pre-patch questions based on your deployment.
Use the upgrade installer to upgrade all hosts in your deployment.
If your SSH session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the installation resumes.
After the upgrade is complete, type the following command to unmount the software update: