Restoring a primary HA host to a previous version or factory default

Restore an IBM QRadar primary high-availability (HA) host to a previous version or factory default. You can restore a failed QRadar primary HA host that does not include a recovery partition or a USB port to a previous version. You can also restore the system to factory defaults. When you restore the failed primary HA host, all data is removed and the factory default configuration is restored on the host.

Before you begin

Warning: Factory reinstall with QRadar 7.5.0 Update Package 8 ISO in the recovery partition on M5 hardware is not supported. Alternatively, you can use one of the following methods:

Procedure

  1. Use SSH to log in to the console as the root user.
  2. Copy the recovery.py script from the console to the failed primary HA host.

    scp recovery.py root@<TargetIP_address>:/root

  3. Obtain the QRadar ISO from the following location: https://www.ibm.com./support
  4. Copy the ISO file to the target QRadar host.

    scp <iso_file_name> root@<TargetIP_address>:/root

  5. Use SSH to log in to the primary HA host.
  6. Type the following commands: 
    chmod 755 recovery.py
    ./recovery.py -r --default --reboot <iso_file_name>
  7. Press Enter when prompted to restart the system.
  8. When prompted, type flatten and press Enter.

Results

The installer repartitions and reformats the hard disk, installs the operating system, and then installs QRadar. Wait for the flatten process to complete. This process can take up to several minutes. After the process is complete, the normal installation process continues.

What to do next

Recovering a failed primary HA host