IBM Support

Patch failed due to disk space check failure

Troubleshooting


Problem

The language locale of the Red Hat Enterprise system or the SSH environment language can cause the disk space check to fail during a fix pack (patch) installations.

Symptom

The fix pack (patch) update fails on the system and the following error is displayed in /var/log/setup-7.X.xxxxxxx/patches.log:

[ERROR] Patch failed due to disk space limitations. Please free up some disk space and try again.

Cause

The fix pack (patch) might incorrectly interpret the available disk space on the QRadar system when the default language locale for Red Hat or the SSH environment is not configured as English.

Some administrators might have deployments with managed hosts that have limited disk space. As a general rule of thumb, a system should have enough space equivalent to twice the size of the fix pack in the root directory. If the system does not have enough disk space to install the fix pack, the appliance is bypassed and a summary details which managed hosts were installed successfully and which were unsuccessful.

Diagnosing The Problem

Primary method of troubleshooting:

Administrators can review the patch log to determine the reason for the patch failure. Administrators should note that the "Available" line appears to wrap the text incorrectly and note characters that do not display properly.

The patch log file is available on the host in the /var/log/setup-7.X.xxxxxxx/patches.log. This log file will provide information and error messages related to the failed update.

Example of an update failure message:
Tue Apr 9 19:29:27 2013 [DEVEL] Free Space Check [ Mount Point: '/store', Needed: '24', Available: '211008680' ]
Tue Apr 9 19:29:27 2013 [DEVEL] Free Space Check [ Mount Point: '/', Needed: '473916', Available:
14172604' ]
Tue Apr 9 19:29:27 2013 [ERROR] Only 14172604 KB is available, but at least 473916 KB is required on /.
Tue Apr 9 19:29:27 2013 [ERROR] Only 211008680 KB is available, but at least 24 KB is required on /store.
Tue Apr 9 19:29:27 2013 [ERROR] Patch failed due to disk space limitations. Please free up some disk space and try again.

Administrators can review the free disk space on the system that reported the fix pack (patch) update failure.

  1. Using SSH, log in to the QRadar Console as the root user.
  2. Optional. If the update failure occurred on a managed host, SSH to the managed host.
  3. To verify the free disk space on the system, type the following command: df -PBK.
  4. Review the output of the df -PBK command to determine if the system contains enough disk space to complete the fix pack installation.
  5. Review the output of the df -PBK command to determine if the output contains and non-English characters. The installer script parses English strings and cannot determine the free disk space.

    Example of a disk free command output where the local is configured with a non-English locale.
  6. Dateisystem1024âBlöckeBenutzt Verfügbar Kapazit.Eingehängt auf
    /dev/sda21870600380K 12249772K 1763329552K 1%/
    tmpfs33046344K 0K 33046344K 0% /dev/shm
    /dev/sda1 99150K 38133K 55897K 41% /boot
    /dev/sda39829688K 3054204K 6251196K 33% /var/log
    /dev/sdb1 16910281628K 238482816K 15812805404K2% /store
    /dev/sda5 10320184K155664K 9640284K 2% /store/tmp

Resolving The Problem

To resolve this issue, the administrator can update the language to an English locale.

  1. Using SSH, log in to the QRadar Console as the root user.
  2. Optional. If the update failure occurred on a managed host, SSH to the managed host.
  3. To verify the the QRadar system is configured with English as the locale, type the following command: echo $LANG

    Example output when the language locale is configured for German:
  4. To change your locale, type the following command: export LANG="en_US.UTF8"
  5. To verify the language is updated, type the following command: df -PBK

    The output of the command should display English language in the headings of the free disk space check.
  6. Filesystem1024-blocksUsedAvailableCapacity Mounted on
    /dev/sda21870600380K 12249772K 1763329552K 1%/
    tmpfs33046344K 0K 33046344K 0% /dev/shm
    /dev/sda1 99150K 38133K 55897K 41% /boot
    /dev/sda39829688K 3054204K 6251196K 33% /var/log
    /dev/sdb1 16910281628K 238482816K 15812805404K2% /store
    /dev/sda5 10320184K155664K 9640284K 2% /store/tmp
  1. Start the fix pack installation on the failed host to determine if the system updates successfully.

    An example of valid output text for a disk space check in the patches.log file is provided below:

    Wed Jan 30 14:54:56 2013 [INFO] Checking Disk Space...
    Wed Jan 30 14:54:56 2013 [DEVEL] Disk space needed for each mount point:
    Wed Jan 30 14:54:56 2013 [DEVEL] '/dev/shm': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/': '170384'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/store': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/store/tmp': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/recovery': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/media/updates': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/boot': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] '/var/log': '0'
    Wed Jan 30 14:54:56 2013 [DEVEL] Free Space Check [ Mount Point: '/', Needed: '170384', Available: '1771450784' ]
    Wed Jan 30 14:54:56 2013 [DEVEL] Disk Space Sentinel Check [ Mount Point: '/', Threshold: 0.95', Current: '0.0530041568793009', Potential: '0.0530952420740981' ]
    Wed Jan 30 14:54:56 2013 [INFO] Disk Space Check Passed.

Alternate resolution:

The administrator can log in to a QRadar system and run the fix pack (patch) from a machine that is configured with English as the locale or change the SSH environment variable to an English locale.

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Upgrade","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1;7.3;7.2.8;7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21634239