IBM Support

QRadar: Services do not start after a Dell firmware update



The administrator received firmware update from Dell and after updating firmware QRadar would no longer start as expected.


When this error occurs, the logs in /var/log/qradar.error display the following error:

Oct 23 11:00:09 QRADAR4 hostcontext[19681]: Caused by: org.xml.sax. SAXParseException: The value of attribute "hardwareSerial" associated with an element type "HostCapabilities" must not contain the '<' character.

When this issue occurs, the /opt/qradar/conf/capabilities/hostcapabilities.xml file displays: hardwareSerial="<BAD INDEX>"


This issue is caused by installing the wrong BIOS firmware. As an appliance QRadar must use the OEM Bios firmware and not "regular" Dell Bios firmware updates. If a regular Dell Bios was installed, the installation of the correct OEM Bios can resolve the issue.


QRadar 7.x

Diagnosing The Problem


  1. To diagnose this issue, the administrator can type the following command: cat /opt/qradar/conf/capabilities/hostcapabilities.xml
  2. If the file lists the following parameter, then the BIOS must be repaired:hardwareSerial="<BAD INDEX>"

Resolving The Problem

To repair the Dell BIOS use the following steps:

  1. Download the correct Dell OEM BIOS package, and create bootable BIOS update media by running the .exe file from the Dell OEM BIOS package.
  2. Boot the appliance from the BIOS update media.
  3. The BIOS update package will try, but will fail to install due the current BIOS version installed.
  4. Press any key to exit to the DOS prompt
  5. Use the DIR command to locate the appropriate BIOS update executable. For example: C011100.EXE
  6. Run the update command with the /forcetype /forceit switches. For example: C:\> c011100.exe /forcetype /forceit

    The BIOS update should now proceed and update the BIOS. Follow the instructions, and when complete, reboot, and remove the media.


Where do I find more information?
If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support for assistance:

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Hardware","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018