IBM Support

QRadar: Patch upgrade failed with ERROR: This patch was meant for a different version

Troubleshooting


Problem

During a patch upgrade, if an older versioned SFS file from a previous patch upgrade is still mounted to /media/updates
, the patch upgrade does not proceed and the following error outputs similar to:
Jul  7 18:38:40 2020: [ERROR] This patch was meant for a different version (2019.14.1.20191203144110).
Tue Jul  7 18:38:40 EDT 2020: ./patchInstaller.pl -patchfile /storetmp/733_QRadar_interimfix-7.3.3.20191203144110-IF01-20191220154048.sfs  -p ./superpatches.manifest.xml completed with result 0

Resolving The Problem

  1. SSH into the QRadar Console as the root user.
  2. Check to ensure the SFS file that is mounted to /media/updates is the expected version.
  3. Check to see whether older SFS files from previous patch upgrades are still mounted or have stale mount points. You can check this with the following commands:
    # df -Th
    # mount | grep media
  4. Run the following command as many times as needed until it reports back that nothing is mounted on /media/updates:
    # umount /media/updates
    umount: /media/updates: not mounted
  5. Mount the correct SFS file version to be used for the patch upgrade, as instructed by the version's release notes.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnhDAAS","label":"ATS-SecIntel Backup->QRadar->Patch->Console"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
05 January 2021

UID

ibm16244700