IBM Support

QRadar: Kernel 3.10.0-1127.EL7.X86_64 can cause XFS filesystem mount failures in QRadar 7.4.0 Fix Pack 3 (APAR IJ25612)

Troubleshooting


Problem

Administrators who upgrade to QRadar® 7.4.0 Patch 3 can experience a Red Hat kernel issue where appliances are unable to mount the filesystem or properly boot as documented in APAR IJ25612. Administrators can experience this issue on a per appliance basis. To assist users in identifying this issue, QRadar development has created an identification utility that can be run on appliances to identify potential issues.

Symptom

Administrators who install QRadar® 7.4.0 Fix Pack 3 can install the fix pack, but the appliance reboots fails with a number of XFS errors where the filesystem cannot be mounted. This issue is identified as APAR IJ25612 by QRadar Support.

Error message:
  XFS (dm-0): SB strip unit sanity check failed  XFS (dm-0): SB validate failed with error -117. 
Screen capture:
image 4420
Figure 1: After the fix pack installation, an appliance reboot can fail the XFS filesystem check due to Red Hat kernel issues.

Document Location

Worldwide

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000Gnc6AAC","label":"QRadar-\u003EUpgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.3;7.4.0","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
22 June 2020

UID

ibm16235774