QRadar Deployment Intelligence: How to preserve QDI 3.0.0 application data and upgrade to QDI 3.0.1

Steps

1. Download the Support_QDI_300_Backup-2.sh utility: Download link

   SHA256: e0a93a46a8363dbbbfe21e6804e903c08b2f961c1f1b31a2fc45a47d7f5cb9d0

   Note: If you previously downloaded a copy of Support_QDI_300_Backup.sh, replace your existing version with Support_QDI_300_Backup-2.sh as a newer version is available.
2. Copy the utility to a temp directory on the QRadar Console. For example, /storetmp.
3. Optional. If the QDI application runs on an App Host, type the following command to scp the utility to your App Host appliance:

   scp Support_QDI_300_Backup-2.sh root@<app_host_ip>:/storetmp

4. Type the following command to set permissions on the file:

   chmod +x /storetmp/Support_QDI_300_Backup-2.sh

5. To back up the QDI 3.0.0 database, type:

   /storetmp/Support_QDI_300_Backup-2.sh
   

6. If the script completes successfully, the following output is displayed:

   [root@examplehost ~]# ./Support_QDI_300_Backup-2.sh
   
   QDI Version 3.0.0
   Backing up QRadar Deployment Intelligence database to /store/docker/volumes/qapp-[appid]/store/qdi.dump 
      located on QRadar deployment
   Backing up QDI Health Reports to /root/reports/ on the current host the QDI Application is running 
      on. i.e Console or App Host
   Successfully backed up QRadar Deployment Intelligence database and reports ...

   Important: Administrators must confirm qdi.dump is backed up in /root/reports/ BEFORE you uninstall QDI 3.0.0.
7. Log in to the QRadar Console as an administrator.
8. Click Admin > Extension Management.
9. Select QRadar Deployment Intelligence 3.0.0 from the application list, click Uninstall.
10. Download QRadar Deployment Intelligence 3.0.1: Download link
11. In the Extension Management window, click Add and select QDI-3.0.1-extension.signed.zip file.
    Note: QDI 3.0.1 is compatible with the following QRadar versions:
    • QRadar 7.3.3 Fix Pack 6 or later
    • QRadar 7.4.1 Fix Pack 2 or later
    • QRadar 7.4.2 any Fix Pack version
    • QRadar 7.4.3
12. Select the Install Immediately check box and click OK.
13. After the app finishes installing, type the following command to restore the qdi.dump database:
    Important: You must run Support_QDI_300_Backup.sh and BEFORE you run the app and configure an Authorized Service token.

    /storetmp/Support_QDI_300_Backup-2.sh

    
    The script restores qdi.dump to the QDI 3.0.1 docker container and runs a pg_restore.  Restoring the qdi.dump database might take several minutes to complete. When complete and successful, the following output is displayed:

    [root@examplehost ~]# ./Support_QDI_300_Backup-2.sh
    QDI Version 3.0.1
    Restoring database for QRadar Deployment Intelligence from /root/qdi.dump
    Copying backup file from QRadar to QDI...
    pg_restore: while PROCESSING TOC:
    pg_restore: from TOC entry 3; 2615 2200 SCHEMA public postgres
    pg_restore: error: could not execute query: ERROR:  schema "public" already exists
    Command was: CREATE SCHEMA public;
    pg_restore: warning: errors ignored on restore: 1
    Old App ID:  1404
    ALTER TABLE
    ALTER TABLE
    ALTER TABLE
    UPDATE 1
    UPDATE 3
    UPDATE 3
    UPDATE 3
    ALTER TABLE
    ALTER TABLE
    ALTER TABLE
    Copying reports from QRadar to QDI...
    '/opt/app-root/app/static/reports/*' -> '/opt/app-root/store/reports/*'
    Copying reports from QRadar to QDI...
    Successfully backed up QRadar Deployment Intelligence database...

    
    Results
    After the QDI database is restored, administrators can run the application to add their existing authorized service token or create a new Authorized Service token. If the QDI tab does not display after the installation is complete, clear your browser cache and refresh your browser window or use Incognito or a Private Browsing mode to verify the tab is visible. If you experience issues with the Support_QDI_300_Backup-2.sh or you are unsure of any of the steps in this technical note, contact QRadar Support.