IBM Support

QRadar: Viewing interim fix and patch levels for all systems in a deployment

Question & Answer


Question

How can you view the interim fix and patch levels for all systems in a QRadar environment?

Answer

UI steps
You can see the version for all appliances from the UI, but not the patch and interim fix levels. The About section shows the patch and interim fix versions for only the QRadar console. If you need more information, use the CLI instructions.
  1. Log in to the QRadar console as an admin.
  2. Open the Admin tab.
  3. Click System and License Management.
  4. Ensure Display is set to System.

    Results
    Look under the Version column to see each system's version.UI version
    Note: You can find the patch and interim fix versions for only the QRadar console by opening the menu and clicking About, but to find this information for all managed hosts, you must use the CLI. Example of the About section:
    About section
CLI steps
  1. SSH into the QRadar console as the root user.
  2. Enter the following command: 
    /opt/qradar/support/all_servers.sh -C -k /opt/qradar/bin/myver -v
    Note: If you have many systems, consider piping the output to a text file to make reading it easier: 
    /opt/qradar/support/all_servers.sh -C -k /opt/qradar/bin/myver -v > myver_output.txt

    Result
    The Core version field represents the installed version. Interim fix number indicates the interim fix that is installed. If no interim fix is installed, this line is not included in the output.
    Output example for one console:
    x.x.x.x -> scotta-qr.cslab.iss.local
Appliance Type: 3199	Product Version: 2021.6.1.20220215133427 
 09:57:38 up 22 min,  1 user,  load average: 6.73, 8.17, 8.49 
------------------------------------------------------------------------
Product is 'QRadar'
Appliance is '3199'
Core version is '2021.6.1.20220215133427'
Latest version is '2021.6.1.20220215133427'
Branded version is ''
External version is '7.5.0'
Branded latest version is ''
Release name is '7.5.0 UpdatePackage 1'
Version installed with is '2021.6.0.20211220195207'
Internal version is '2021.6.1.0'
RPM version is '2021.6.1.20220215133427'
RPM external version is '7.5.0'
QRM enabled: 'false'
QRM DB enabled: 'false'
QVM DB enabled: 'true'
QF DB enabled: 'false'
Graph DB enabled: 'false'
Console: 'true'
Console IP: 'x.x.x.x'
IP address: 'x.x.x.x'
Virtual IP: 'x.x.x.x'
Virtual Hostname: 'scotta-qr.cslab.iss.local'
Vendor: 'Q1 Labs'
Branded Product Name: 'QRadar'
Product Description: 'QRadar'
Kernel architecture: 'x86_64'
CPU supports 64bit: 'true'
Operating System: 'Red Hat Enterprise Linux Server release 7.9 (Maipo)'
HA identity: 'N/A'
Connection to Console is encrypted: 'false'
Docker enabled: 'true'
Supports Apps: 'true'
DNS: 'x.x.x.x', 'x.x.x.x'
Internal Hostname: 'x.localdeployment'
FIPS enabled: 'false'
Secure boot status: 'Only available on EFI firmware systems'

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
07 March 2023

UID

swg21990767

Page Feedback