IBM Support

QRadar: Reinstalling or upgrading QRadar in UEFI mode fails to configure GRUB and will not boot

Troubleshooting


Problem

After you upgrade or reinstall QRadar, an error can display when the system attempts to boot with the UEFI boot loader. The host completes a POST successfully, but the boot halts at a blank screen and does not load GRUB as expected. When this issue occurs, the administrator must manually set the boot loader to /EFI/red/grubx64.efi or /EFI/redhat/shimx64.efi. This technical note advises users how to resolve this issue.

Symptom

After an upgrade, one of the following error conditions can occur to indicate you are experiencing a boot loader issue:
  • Error message:
    The following error occurred while installing the boot loader. The system will not be bootable. Would you like to ignore this and continue with installation?
    failed to set a new efi boot target. This is most likely a kernel bug.
    Please respond 'yes' or 'no':
  • The appliance boots and halts at the grub> prompt.
  • After POST, the host boots to a blank screen and does not boot Linux GRUB.

Cause

The original install used the Legacy BIOS GRUB and the boot mode in setup is set to Legacy. If the software is reinstalled or upgraded with an UEFI GRUB, the host cannot boot correctly until the Boot Mode setting is corrected.
To resolve this issue, administrators must confirm the Boot Mode configuration in the F1-Setup (Legacy or UEFI) matches the GRUB configuration.

Resolving The Problem

Administrators who experience installation errors on QRadar hardware appliances can check to see whether the UEFI boot loader is set as the first boot option. If needed, Boot Mode can be updated to match the boot loader.

QRadar M5 Appliance

  1. Restart the appliance.
  2. To access the BIOS settings, press the F1 key when you see the message, <F1> Setup.
  3. From the menu, select Boot Manager.
  4. From the Boot Manager menu, select Change Boot Options.
  5. Look at the first boot option and to verify whether the boot option is a UEFI bootloader.
    • QRadar 7.5.0 Update Pack 1 is expected to display the label red, for the UEFI bootloader
    • QRadar 7.5.0 Update Pack 2 and later is expected to display the label redhat, for the UEFI bootloader
  6. If a UEFI bootloader is listed, the Boot Mode must be set to UEFI. If the UEFI bootloader is not found, the user might see Hard Drive or Legacy Only as the first option. These boot options indicate that the host has a Legacy BIOS GRUB, and Boot Mode must be set to Legacy.
  7. To check and correct the Boot Mode, press [ESC] to return to the Boot Manager menu.
  8. Press the Arrow ↑ or ↓ to highlight and select Boot Modes and press [Enter].
    image-20230726213136-1
  9. Ensure that System Boot Mode is set correctly. 
    • If a UEFI bootloader displayed in Step 5, configure the System Boot Mode must be set to UEFI Mode.
      Image 1810
    • If the bootloader displayed Hard Drive or Legacy Only, configure the boot mode to Legacy Mode.
  10. Press [ESC] until you return to the main menu.
  11. Select Save.
  12. Select Exit.

QRadar M6 and M7 Appliance

  1. Restart the appliance.
  2. To access the BIOS settings, press the F1 key when you see the message, F1:System Setup to load the Provisioning Manager.
  3. In the left side Navigation panel, select UEFI Setup, then Boot Manager.
  4. From the Boot Manager menu, select Change Boot Order.
  5. Look at the first boot option and to verify whether the boot option is a UEFI bootloader.
    • QRadar 7.5.0 Update Pack 1 and earlier displays red as the label for the UEFI bootloader
    • QRadar 7.5.0 Update Pack 2 and later displays redhat as the label for the UEFI bootloader
      image-20230803185805-3
  6. If a UEFI bootloader is listed, the Boot Mode must be set to UEFI. If the UEFI bootloader is not found, the user might see Hard Disk or CD/DVD Rom as the first option. These boot options indicate that the host has a Legacy BIOS GRUB, and Boot Mode must be set to Legacy.
  7. To check and correct the Boot Mode, click the Back Arrow on the right side bar or the Boot Manager link on the left side.
  8. Click Boot Modes.
    image-20230803183019-1
  9. Ensure that System Boot Mode is set correctly. If the wrong mode is selected, click the drop-down menu to select the correct option.
    • If red or redhat was the first boot option, confirm that UEFI Mode is selected.
    • If Hard Drive or CD/DVD Rom was the first boot option, confirm that Legacy Mode is selected. 
      image-20230803185019-2
  10. Click Save.
  11. Click Exit UEFI Setup in the navigation menu.
  12. Click Yes to confirm exiting UEFI setup.
  13. Reboot the host.
 
 

Results
After the changes are saved, the system starts the QRadar installation without issue. If you continue to experience issues related to this error message, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"},{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
21 August 2023

UID

ibm11101735

Page Feedback