IBM Support

QRadar Deployment Intelligence: How to preserve health reports before an upgrade from QDI 2.2.x to 3.0.0 or 3.0.1

How To


Summary

Administrators who plan to upgrade to QRadar Deployment Intelligence (QDI) 3.0.0 or 3.0.1 and use QDI's generated health reports must run a support script before you upgrade the application. This technical note includes a download and instructions for the Support_QDI_Cleanup.sh utility to ensure that previously generated health reports are preserved. Administrators installing QRadar Deployment Intelligence for the first time can disregard this utility as it is only intended for application upgrades.

Objective

About the Support_QDI_Cleanup.sh utility:
  • Important: If the Support_QDI_Cleanup.sh utility is not run before a QDI 3.0.x upgrade, any previous health reports generated by the app are removed during the application update. Administrators who need to preserve existing health reports for the QDI application must run the utility on the QRadar Console or the App Host appliance where QDI 2.2.x is installed before you upgrade to QDI 3.0.x. If you have no health summary reports saved, you can ignore this technical note.

    To verify if you have QRadar Deployment Intelligence reports, select 30 days Health Summary Reports from the user interface and confirm whether any reports are listed in the menu.
    image 10105
  • The utility needs to be run one time before the administrator upgrades from QDI 2.2.4 or 2.2.5 to 3.0.0 or 3.0.1. This script copies existing health reports from /app/static/reports directory to /store/reports within the QDI container. 
  • New QDI installations at version 3.0.0 or 3.0.1 or later do not need to run this utility. Administrators installing QDI for the first time can disregard this technical note.

 

Environment

Administrators planning an upgrade to QDI on the following versions must run the Support_QDI_Cleanup utility:
QRadar version Current QDI app version New version Run Support_QDI_Cleanup?
7.3.3 Fix Pack 5 or earlier QDI 2.2.4 or 2.2.5 QDI 3.0.0 Yes, run the utility before you upgrade QDI.
7.3.3 Fix Pack 6 or later QDI 2.2.4 or 2.2.5 QDI 3.0.1 Yes, run the utility before you upgrade QDI.
7.4.1 Fix Pack 1 or earlier QDI 2.2.4 or 2.2.5 QDI 3.0.0 Yes, run the utility before you upgrade QDI.
7.4.1 Fix Pack 2 or later QDI 2.2.4 or 2.2.5 QDI 3.0.1 Yes, run the utility before you upgrade QDI.
N/A (new QDI installations) N/A (new QDI installations) QDI 3.0.x or later No. If you are installing QDI for the first time, there is no need to run the included support utility.

 

Steps

  1. Download the Support_QDI_Cleanup_0.sh utility: Download link
    SHA256: f73cb8c71d1a67fac11f2f947dfc459945847a73ca807f7b401bb47ee2e9c3c4
    Note: If you are on a Windows system, you can use Powershell to confirm the SHA256 sum.
    image 9993
  2. Copy the utility to a temp directory on the QRadar Console. For example, /storetmp.
  3. Optional. If the QDI application runs on an App Host, type the following command to scp the utility to your App Host appliance:
    scp Support_QDI_Cleanup_0.sh root@<app_host_ip>:/storetmp
  4. Type the following command to set permissions on the file:
    chmod +x /storetmp/Support_QDI_Cleanup_0.sh
  5. To run the Support_QDI_Cleanup utility, type:
    /storetmp/Support_QDI_Cleanup_0.sh
  6. If the script completes successfully, the following output is displayed:
    [root@apphost storetmp]# /storetmp/Support_QDI_Cleanup_0.sh
    
    Copying QRadar Deployment Inteligence reports to /store/reports
    Successfully copied QRadar Deployment Inteligence reports...

    Results
    Administrators can upgrade your QDI app normally to 3.0.0 or 3.0.1. If you continue to experience issues or you are unsure of any of the steps in this technical note, contact QRadar Support.

Document Location

Worldwide

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Document Information

Modified date:
24 June 2021

UID

ibm16454155