IBM Support

IJ12252: QRADAR PATCH FAILS WHEN MORE THAN ONE .SFS IS MOUNTED

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that when two sfs files are mounted, the
    QRadar patch test is successful, but the patch fails with an
    error similar to "Original patch sfs file, '<patch_file_path>'
    not found, please verify and restore the file."
    Look for similar messages in
    /var/log/setup-<QRadar_version>/patches.log:
    Copying file
    /storetmp/732_QRadar_interimfix-7.3.2.20190522204210-IF02-201907
    10135412.sfs to host
    /storetmp:/storetmp/732_QRadar_interimfix-7.3.2.20190522204210-I
    F02-20190710135412.sfs
    cp: cannot create regular file
    'root@/storetmp:/storetmp/732_QRadar_interimfix-7.3.2.2019052220
    4210-IF02-20190710135412.sfs/732_QRadar_interimfix-7.3.2.2019052
    2204210-IF02-20190710135412.sfs': No such file or directory
    [ERROR] Couldn't copy patch file FILE to host /storetmp.
    [ERROR] Copied patch file to standby host, but MD5 sums do not
    match.
    [ERROR](a-i-has-testmode) HOSTNAME-secondary : patch test
    failed.
    [ERROR](a-i-has-testmode) Patching can not continue
    Patch Report for IP-ADDRESS, appliance type: 1828
    HOSTNAME-primary : patch test succeeded.
    Copied patch file to standby host, but MD5 sums do not match.
    See the following Technote for additional information:
    https://www.ibm.com/support/pages/node/1072998
    

Local fix

  • To resolve the issue,
    Remove the deleted mounts by typing umount /media/updates as
    many times as needed, or until all /media/updates mount
    references are removed.
    Type the command mount | grep media to verify the all volumes
    mounted to /media/updates are removed.
    Remount the .SFS file you need to patch or update your system.
    Check for deleted mounts on both Primary and Secondary HA nodes.
    See the following Technote for additional information:
    https://www.ibm.com/support/pages/node/1072998
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.1.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.1.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ12252

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-12-20

  • Closed date

    2020-08-07

  • Last modified date

    2020-08-07

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU029","label":"Software"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
12 August 2020