When you install IBM QRadar® products, the installer (ISO image) is copied to the recovery partition. From this partition, you can reinstall QRadar products.
Not all QRadar systems have a recovery partition. For example, software installs do not. For systems that have a recovery partition, the recovery.py script allows for the replacement of the factory ISO image with a newer or older image. If you do not have the ISO, go to Fix Central, and download the version you want to set in the recovery partition.
- SSH into the QRadar Console as root.
- Run the following command to verify the current image in the recovery partition:
- To replace the existing ISO on the recovery partition with a new ISO, type the following command:
/opt/qradar/bin/recovery.py -r <Path to new ISO>
[root@qradar-750 ~]# /opt/qradar/bin/recovery.py -r /storetmp/750_QRadar_QRFULL_2021.6.0.20211220195207.iso INFO : Successfully mounted /recovery INFO : copying /storetmp/750_QRadar_QRFULL_2021.6.0.20211220195207.iso to /recovery/202160/750_QRadar_QRFULL_2021.6.0.20211220195207.iso INFO : copying /mnt/iso/images/updates.img to /recovery/202160/images/updates.img INFO : Found iso /recovery/202160/750_QRadar_QRFULL_2021.6.0.20211220195207.iso as QRadar 7.5.0 GA (Build 20211220195207) INFO : Wrote new grub.cfg INFO : Synced the new grub.cfg to disk INFO : copying /var/log/recovery.log to /recovery/recovery-2022-09-21.log INFO : Re-install ready
Was this topic helpful?
28 September 2022