Release of the QRadar 7.3.0 Patch 4 ISO (7.3.0.20170830160510) UPDATED

Known issues identified
The following APARs have been reported for QRadar 7.3.0 Patch 4. Administrators are not recommended to upgrade to QRadar 7.3.0 Patch 4 until an update can be released to resolve these issues. Administrators with QRadar 1202 QFlow appliances should not upgrade to 7.3.0 Patch 4 due to a reported Napatech issue with flow collection. Administrators must log in to IBM.com to be able to view open issues.
   

 

About this upgrade & general information

These instructions are intended to assist administrators with updating appliances from QRadar 7.2.8 to QRadar 7.3.0 Patch 4 using an ISO file. This ISO can update QRadar, QRadar Risk Manager, QRadar Vulnerability Manager products from 7.2.8 to version 7.3.0 Patch 4. These instructions inform administrators how to update their deployment to the latest version. If you have a software installation, need the latest memory requirements, or are making use of off-board storage, it is recommended that you review the QRadar Upgrade Guide to prevent issues.

QRadar 7.3.0 uses an ISO file to update hosts to the latest software version. A minimum of QRadar 7.2.8 Patch 1 (or later) is required to be able to upgrade to QRadar 7.3.0 Patch 4. Each host must be updated individually, this includes HA secondary appliances.

Administrator notes

Current QRadar Version	Upgrades to QRadar 7.3.0 Patch 4?
QRadar 7.2.6 (any patch level) or earlier	No
QRadar 7.2.7 (any patch level)	No
QRadar 7.2.8.0	No
QRadar 7.2.8 Patch 1 to 7.2.8 Patch X (Latest)	Yes, administrators can use these instructions to upgrade to QRadar 7.3.0 Patch 4. The latest ISO can upgrade beyond the initial 7.3.0 release versions and there is no need to install multiple files. See Figure 1 below.
QRadar 7.3.0 to QRadar 7.3.0 Patch 3	Requires the QRadar 7.3.0 Patch 4 SFS to update

1. QRadar 7.3.0 Patch 4 changes how login authentication works for fallback LDAP, Radius, or Active Directory on administrator accounts. If the external authentication server is unavailable, not all administrators will be able to fall back to their local administrator passwords without a configuration change. For more information, see: QRadar: External Authentication Fails Due to Password Fallback Change for Administrators.
2. TLS v1.0 and TLSv1.1 is disabled in this release and connections to the user interface for legacy browsers might be rejected.
3. WinCollect agents at version 7.2.2-2 or older use TLSv1.0 and TLS v1.1 connections to uprade agents, which is disabled in QRadar 7.3.0 (all patch version). Administrators with managed WinCollect agents must upgrade to WinCollect 7.2.5 before installing QRadar 7.3.0 Patch 4. WinCollect 7.2.5 is a pre-requisite for QRadar 7.3.0. Stand-alone WinCollect agents are not impacted by this requirement.
4. Customized routes or static routes configured manually in QRadar are not preserved after the upgrade to QRadar 7.3.0 completes.
5. Any iptables rules configured by the administrator should be reviewed and noted for clean up post installation as the interface names have changed in QRadar 7.3.0 due to the Red Hat Enterprise 7 operating system updates.
6. You must be on QRadar 7.2.8 Patch 1 or later to upgrade to QRadar 7.3.0 Patch 4.
7. QRadar Network Insights administrators much be on QRadar 7.2.8 Patch 3 or later to upgrade.
8. The upgrade from QRadar 7.3.8 Patch 1 to QRadar 7.3.0 Patch 4 will use a .ISO file. In the past, support has stated that ISOs are for new appliance installs only, but QRadar 7.3.0 is going to be an exception to this rule because of the Red Hat kernel update requirements.
9. Each HA appliance must be updated individually using the ISO file. The SFS file is capable of allowing the primary appliance to update the secondary, but the ISO file does not support this functionality. If you run the ISO setup on an HA primary, you should wait for the update to complete, then run the setup on the HA secondary.
10. There is no patch "All" option as QRadar 7.3.0 uses an ISO file to upgrade. The ISO must be mounted to the appliance and run locally on each host. If you have a software install, you need your Red Hat Enterprise ISO and the QRadar ISO. Administrators with software installations on your own hardware MUST read the QRadar Upgrade Guide to understand how to partition their systems appropriately.
11. The 7.3.0 upgrade will take longer than expected due to the kernel changes to Red Hat 7 Enterprise. Early upgrade customers are reporting 2 to 2.5 hours to upgrade the Console appliance. Administrators should be aware of this longer time frame to plan their maintenance windows.
12. Utilities or custom scripts that power users might have created for their QRadar deployment should be copied off of the system. During the 7.3.0 update a warning is displayed that only data in /store is going to be preserved. After the appliance reboots, any scripts, 3rd party accounts, or utilities in /tmp, or /, or /root will be deleted. This does not impact ISO files mounted initially using /root as the this clean up only occurs later in the installation procedure.

 

Figure 1: Administrators on QRadar 7.2.8 version are not required to install each ISO release to update to the latest version. If an ISO is available for the latest 7.3.0 Patch version, you can install the latest ISO file.

The QRadar 7.3.0 Patch 4 ISO (7.3.020170830160510) can upgrade QRadar 7.2.8 Patch 1 (7.2.8.20161207001258) and later to QRadar 7.3.0. If you are on a version of QRadar earlier than QRadar 7.2.8 Patch 1, you must upgrade to QRadar 7.2.8 Patch 1 or later before proceeding to install the QRadar 7.3.0 ISO to upgrade. For a list of all release note for QRadar, see the QRadar Master Software List.

Before you upgrade

Ensure that you take the following precautions:
 

• Back up your data before you begin any software upgrade and verify that you have recent configuration backups that match your existing Console version. If required, take an on demand configuration backup before you begin. For more information about backup and recovery, see the IBM Security QRadar Administration Guide.
• HA appliances should have primaries in the online state and secondary as standby for their HA pair status.
• If you have off-board storage configured, see the QRadar Upgrade Guide as there are special instructions for administrators with /store using off-board storage.
• If you installed QRadar as a software install using your own hardware, see the QRadar Upgrade Guide for partition information.
• WinCollect 7.2.5 is a pre-requisite for QRadar 7.3.0 and all managed agents must be updated. Stand-alone WinCollect agents are not impacted by this requirement.
• All appliances in the deployment must be at the same software & patch level in the deployment.
• Verify that all changes are deployed on your appliances. The update cannot install on appliances that have changes that are not deployed.
• A QRadar 7.3.0 Patch 4 ISO is available for administrators to want to upgrade from QRadar 7.2.8 Patch 1 or install a new appliance or virtual machine. Administrators who want to complete a new install need to review the QRadar Installation Guide.
• To avoid access errors in your log file, close all open QRadar user interface sessions.
• If you are unsure of the IP addresses or hostnames for the appliances in the deployment, run the utility /opt/qradar/support/deployment_info.sh to get a .CSV file with information about the QRadar deployment. The .CSV file will contain a list of IP addresses for each managed host.
• If you are unsure of how to proceed when reading these instructions or the documentation, it is best to ask before starting your upgrade. To ask a question in our forums, see: http://ibm.biz/qradarforums.

Part 1. Staging files and pretesting your deployment (required)

It is important that administrators pretest their deployment to ensure that they will not experience unexpected issues when updating to QRadar 7.3.0. A pretest is a common precaution that should be taken by all administrators before they install an update to locate potential issues. The pretest does not restart services and can be completed without scheduled downtime. The pretest typically takes between 3 to 5 minutes to complete on each appliance. If for some reason your SSH session is disconnected, you can reconnect to the remote host using screen.

Procedure
The pretest should be completed on all hosts by the administrator before you attempt to upgrade to QRadar 7.3.0.

1. Download the QRadar 7.3.0 Patch 4 ISO (3.8 GB) from the IBM Fix Central website: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.3.0&platform=Linux&function=fixId&fixids=7.3.0-QRADAR-QRFULL-20170830160510&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc
   
   NOTE: It might take time for the ISO link to be available on IBM Fix Central for all administrators and users due to the file size.

2. Using SSH, log in to your Console as the root user.
3. Type the following command:

   screen

4. To make the directory for the update, type:

   /opt/qradar/support/all_servers.sh -k “mkdir -p /media/cdrom || umount /media/cdrom"

5. To verify you have enough space (5GB) in /tmp for the ISO on all appliances, type:

   /opt/qradar/support/all_servers.sh -k "df -h /root /var/log" | tee diskchecks.txt

• Best directory option: /root
  It is available on all appliance types, is the best option to host the ISO file.
• 2nd best directory option: /var/log
  This directory is available on all appliances, but there might not be the required space available.
• DO NOT USE: /tmp, /store/tmp, or /store/transient for your ISO upgrade. These directories are partitioned as part of the upgrade and administrators cannot use them as storage locations or mount points for the ISO file.
  
  If the disk check command fails, retype the quotation marks from your terminal, then re-run the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have at minimum 4GB of space available in a directory to copy the ISO before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less that 4GB available.
  
  Reminder: Utilities or custom scripts that administrators have created for QRadar should be copied off of the system. During the 7.3.0 update a warning is displayed that only data in /store will be preserved. Therefore, scripts, 3rd party utilities in /tmp, or /, or /root will be deleted during the upgrade.



• 1. If there is not 4GB of space in/root or /var/log, the administrator must make directory space for the ISO file.
  2. Using WinSCP or SCP, copy the ISO to the /root or /var/log directory on the QRadar Console with 4GB of disk space for the ISO file.
  3. To copy the files to all appliances, type:

  /opt/qradar/support/all_servers.sh -k -p /root/Rhe764QRadar7_3_0_20170830160510.stable-7-3-0.iso -r /root

  
  4. To mount the ISO on all appliances, type the following command:

  /opt/qradar/support/all_servers.sh -C -k “mount -o loop /root/Rhe764QRadar7_3_0_20170830160510.stable-7-3-0.iso /media/cdrom" 

  
  5. To pretest the Console appliance, type:

  /media/cdrom/setup -t

  The pretest output will be written to the command window. Review this output after the pretest completes.

  
  6. Using SSH, open an SSH session to the other appliances in your deployment. QRadar Support recommends that all administrators run the pretest on each host to identify issues before the update begins.
  7. To pretest the managed host, type:

  /media/cdrom/setup -t

  
  Results
  If an appliance in your deployment fails the pretest, the administrators can take the recommended action from the pretest utility. The issue must be resolved before the update to 7.3.0 begins to prevent downtime for specific appliances. If there are messages you do not understand or want to discuss further, you can use our forums http://ibm.biz/qradarforums to get advice. Alternately, administrators can open a ticket directly with QRadar Support (http://ibm.biz/qradarsupport).

Part 2. Installing the QRadar 7.3.0 ISO on the Console Appliance

These instructions guide administrators through the process of upgrading an existing QRadar install at 7.2.8 Patch 1 or later to QRadar software version 7.3.0. The update on the Console must be completed first, before you attempt to update any managed hosts to QRadar 7.3.0.

Procedure
You must complete: Part 1. Staging files and pretesting your deployment (required) before you begin the installation steps listed below.

1. Using SSH, log in to the Console as the root user.
2. To run the ISO installer on the Console, type the following command:

   /media/cdrom/setup

   Important: Upgrading from QRadar 7.2.8 Patch 1 or later to QRadar 7.3.0 should take approximately 2 hours on a Console appliance.
3. Wait for the Console primary update to complete.
4. For HA appliances. If you have an HA Secondary, you can now update the secondary appliance.
5. Open an SSH session to the HA Console secondary.
6. Type the following command to update the secondary Console:

   /media/cdrom/setup

7. Wait for the HA Console secondary to complete the update.

Results
A summary of the ISO installation advises you of any issues. If there are no issues, administrators can now SSH to managed hosts and start the installer on each host to run the setup in parallel.

Part 3. Installing the QRadar 7.3.0 ISO on all other managed hosts

After the Console and Console HA secondary are updated to QRadar 7.3.0, then the rest of the deployment can updated. There is no order required for updating specific appliance types after the Console is updated. Administrators can update Event Processors, Event Collectors, QFlow appliances in any order. You must open an SSH session to each host to run the setup command. The all_servers.sh utility is not supported for parallel ISO installations. Administrators can start the ISO update in parallel on multiple hosts, if they are not HA pairs.

Administrators with appliances that are HA pairs must upgrade the primary appliance first, then the secondary managed host.

Procedure
You must complete: Part 1. Staging files and pretesting your deployment (required) before you begin the installation steps listed below.

1. Using SSH, log in to the Console as the root user.
2. Open an SSH session to each managed host and type the following command:

   /media/cdrom/setup

   Important: Upgrades for managed hosts should take approximately 1.5 hours.
3. Wait for the managed host update to complete.
4. For HA appliances. If you have an HA Secondary, you can now update the secondary appliance.
5. Open an SSH session to the manage host HA secondary.
6. Type the following command to update the secondary:

   /media/cdrom/setup

7. Wait for the HA Console secondary to complete the update.
   
   Results
   A summary of the ISO installation advises you of any issues. If there are no issues, administrators can now run the ISO setup on the Console HA secondary appliance, if you have an HA pair. If you do not have a Console in HA, you can then start SSH sessions to each host and run the setup in parallel.

 

Part 4. Installation wrap-up

1. After all hosts are updated, administrators can send an email to their team to inform them that they will need to clear their browser cache before logging in to the QRadar SIEM interface.
2. To unmount the /media/cdrom directory on all hosts, type:

   /opt/qradar/support/all_servers.sh -C -k “umount /media/cdrom"

3. Administrators can delete the ISO from all appliances.
4. Administrators who use WinCollect agents version 7.2.6 or latest must reinstall the SFS file on the QRadar Console. This is due to issues were the ISO replaces the SFS on the Console with WinCollect 7.2.5 as described here: APAR IV96364. To reinstall the WinCollect SFS on the Console, see the WinCollect release notes: WinCollect 7.2.6 Release Notes.
5. Review any static routes or customized routing. As mentioned in the administrator notes, all routes were removed and will need to be reconfigured after the upgrade completes.
6. Any iptable rules configured should be reviewed as the interface names have changed in QRadar 7.3.0 due to the Red Hat Enterprise 7 operating system updates. Any iptables rules that use Red Hat 6 interface naming conventions will need to be updated.

Resolved issues

Some APAR links in the table below might take 24 hours to display properly after a software release is posted to IBM Fix Central.