Interim Fix 02 - For QRadar 7.3.0 Patch 5 (7.3.0.20171023152653)

Content

This interim fix is intended to resolve specific issues reported in QRadar 7.3.0 Patch 5. This interim fix is a cumulative update, meaning that it includes the application framework update in interim fix 01, plus a log source user interface issue in interim fix 02. If you are on QRadar 7.3.0 Patch 5 (7.3.0.20170927150848), the installing this update will resolve both of the reported issues. This update requires that your deployment is installed with IBM QRadar 7.3.0 Patch 5 (7.3.0.20170927150848). Administrators who are on QRadr 7.3.0 Patch 5 or QRadar 7.3.0 Patch 5 Interim Fix 01 can install interim fix 02. Administrators only need to install IF02 to get the cumulative list of fixes.

Before you begin
The following information will help prevent installation messages during install:

• To avoid access errors in your log file, close all open QRadar sessions.
• The interim fix for QRadar cannot install on a Console that is at any version below 7.3.0 Patch 5.
• Verify that all changes are deployed on your appliances. The patch cannot install on appliances that have changes that are not deployed.
• This interim fix will restart Tomcat during the update, which will log off all active users. The Tomcat restart will also impact reports in progress and they might need to be manually restarted in the user interface after the interim fix is applied and the user interface is available.
  

Procedure

1. Download the interim fix 02 for QRadar 7.3.0 Patch 5 (7.3.0-QRADAR-QRSIEM-20171023152653INT) from the IBM Fix Central website: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.3.0&platform=Linux&function=fixId&fixids=7.3.0-QRADAR-QRSIEM-20171023152653INT&includeSupersedes=0&source=fc
   
2. Using SSH, log in to your system as the root user.
   
   
3. Copy the interim fix to the /storetmp directory on the QRadar Console.
   
   Note: If space in the /storetmp directory is limited, copy the interim fix to another location that has sufficient space, such as /var/log or the root directory (/).
   
   
4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
   
   
5. Change to the directory where you copied the patch file. For example, cd /storetmp
   
   
6. To mount the patch file to the /media/updates directory, type the following command: 
   mount -o loop -t squashfs /storetmp/730_QRadar_interimfix-7.3.0.20170927150848-IF02-20171023152653.sfs /media/updates/
   
   
7. To run the patch installer, type the following command: /media/updates/installer
   
   NOTE: The first time that you run the interim fix, there might be a delay before the installation menu is displayed.
   
   
8. Using the patch installer, select all.
   
   The all option updates the software on all systems in your deployment. In HA deployments, primary HA appliances are patched and replicate the patch update to the secondary HA appliance. For interim fixes, the all option is recommended as the updates are typically small (less than 10MB) and install quickly.
   
   NOTE: If your Secure Shell (SSH) session is disconnected while the installation is in progress, the installation continues. When you reopen your SSH session and rerun the installer, the current state of the installation is displayed.
   
   
9. After the install completes, administrators and users should clear their browser cache before logging in to the Console.

Results

A summary of the interim fix installation advises you of any errors reported by the installer. If the interim fix fails to install on the QRadar Console or error messages are generated, we recommend that issues be reported to QRadar Support.

Where do I find more information?