Restoring a secondary HA host to a previous version or factory default

Restore an IBM QRadar secondary high-availability (HA) host to a previous version or factory default. You can restore a failed QRadar secondary HA host that does not include a recovery partition or a USB port to a previous version. You can also restore the system to factory defaults. When you restore the failed secondary HA host, all data is removed and the factory default configuration is restored on the host.

Before you begin

Warning: Factory reinstall with QRadar 7.5.0 Update Package 8 ISO in the recovery partition on M5 hardware is not supported. Alternatively, you can use one of the following methods:

Reinstall QRadar from media. For more information, see Reinstalling QRadar from media.
Replace the factory reinstall image in the recovery partition with a previous version. For more information, see https://www.ibm.com/support/pages/node/6490659.

Procedure

Use SSH to log in to the console as the root user.
Copy the recovery.py script from the console to the failed secondary HA host.

scp recovery.py root@<TargetIP_address>:/root
Obtain the QRadar ISO from the following location: https://www.ibm.com./support
Copy the ISO file to the target QRadar host.

scp <iso_file_name> root@<TargetIP_address>:/root
Use SSH to log in to the secondary HA host.

Type the following commands:

chmod 755 recovery.py

./recovery.py -r --default --reboot <iso_file_name>

Press Enter when prompted to restart the system.
When prompted, type flatten and press Enter.

Results

The installer repartitions and reformats the hard disk, installs the operating system, and then installs QRadar. Wait for the flatten process to complete. This process can take up to several minutes. After the process is complete, the normal installation process continues.

What to do next

Recovering a failed secondary HA host