IBM Support

WinCollect software upgrades and QRadar V7.3.3: [ERROR] This patch was meant for a different version (7.3, 7.3.0)

Troubleshooting


Problem

Administrators who attempt to install a WinCollect SFS file to upgrade their managed WinCollect agents can experience the following error message due to a version number change in QRadar V7.3.3: [ERROR] This patch was meant for a different version (7.3, 7.3.0). This error message occurs only when a user attempts to upgrade their QRadar V7.3.3 Console using an older WinCollect install file (SFS). Administrators must use the WinCollect 7.2.9 Patch 1 SFS or later to upgrade agents managed by QRadar V7.3.3 appliances.

Symptom

Administrators who attempt to install the WinCollect 7.2.8 (7.2.8.145) or WinCollect 7.2.9 (7.2.9.72) on a QRadar V7.3.3 Console receive a version error message and the WinCollect installer exits. This issue is caused by older WinCollect agent installers that do not comply with an new internal version numbering system in QRadar V7.3.3.

Figure 1: Example WinCollect installation error message.
image-20191203110219-1

Cause

In QRadar V7.3.3, IBM updated the back-end release version scheme to use a different format. Older WinCollect SFS installers expect a version of QRadar to start with 7.3.3.{date+buildverison}. In QRadar V7.3.3, the internal version scheme was updated to use {Year}.{Gate}.{FixPack}.{Build}. The installer for QRadar 7.2.9 Patch 1 and later includes a version check to ensure that the QRadar version is supported before installation. Older WinCollect installers cannot check for the new QRadar internal build version scheme and display the error message described in the article.

Example of the new internal numbering scheme in QRadar V7.3.3:
  • QRadar 7.3.2 and earlier: 7.3.2.20191022133252
  • QRadar 7.3.3 and later: 2019.14.0.20191031163225

Environment

All QRadar deployments at QRadar V7.3.3 and later who attempt to upgrade their WinCollect software using an SFS file released before WinCollect 7.2.9 Patch 1 (730_QRadar_wincollectupdate-7.2.9-96.sfs).

Resolving The Problem

To upgrade managed WinCollect agents, download and install the WinCollect 7.2.9 Patch 1 SFS file (or later) on your QRadar Console.


Table 1: WinCollect and QRadar V7.3.3 compatibility table
WinCollect and QRadar V7.3.3 compatibility table
Filename WinCollect version Installs on a QRadar V7.3.3 Console?
730_QRadar_wincollectupdate-7.2.9-96.sfs WinCollect 7.2.9 Patch 1 Yes
730_QRadar_wincollectupdate-7.2.9-72.sfs WinCollect 7.2.9 No
730_QRadar_wincollectupdate-7.2.8-145.sfs WinCollect 7.2.8 No
730_QRadar_wincollectupdate-728.145.P2.sfs WinCollect 7.2.8 Patch 2 No
730_QRadar_wincollectupdate-728.136.P1.sfs WinCollect 7.2.8 Patch 1
No
Important: All existing WinCollect versions are fully functional when used with QRadar V7.3.3. Administrators who need to upgrade their managed WinCollect agents must install the WinCollect 7.2.9 Patch 1 SFS file as older installers generate the error message described in this article.

NOTE: Administrators can always locate the latest WinCollect versions by using the WinCollect 101 site, which is maintained by QRadar Support.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"WinCollect","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
09 December 2020

UID

ibm11119057