IBM Support

QRadar: How to upgrade the factory reinstall image from the recovery partition

How To


When you install IBM QRadar® products, the installer (ISO image) is copied to the recovery partition. From this partition, you can reinstall QRadar products.


The factory reinstall image from the recovery partition does not get upgraded when the running partition is being patched. If a server must be factory reinstalled, all the upgrades need to be reapplied to bring the system up to date. To avoid losing time and recover a system faster, the original recovery image can be replaced with a newer image, thus allowing the system rebuild to be closer to the wanted version.


Not all QRadar systems have a recovery partition. For example, software installs do not. For systems that have a recovery partition, the script allows for the replacement of the factory ISO image with a newer or older image. If you do not have the ISO, go to Fix Central, and download the version you want to set in the recovery partition.

  1. SSH into the QRadar Console as root.
  2. Run the following command to verify the current image in the recovery partition:
    file /recovery/2020110/product.iso
    Example output:
    Current image
  3. To replace the existing ISO on the recovery partition with a new ISO, type the following command:
    /opt/qradar/bin/ -r <Path to new ISO>
    Example output:
    [root@qradar-750 ~]# /opt/qradar/bin/ -r /storetmp/750_QRadar_QRFULL_2021.6.0.20211220195207.iso
    INFO : Successfully mounted /recovery
    INFO : copying /storetmp/750_QRadar_QRFULL_2021.6.0.20211220195207.iso to /recovery/202160/750_QRadar_QRFULL_2021.6.0.20211220195207.iso
    INFO : copying /mnt/iso/images/updates.img to /recovery/202160/images/updates.img
    INFO : Found iso /recovery/202160/750_QRadar_QRFULL_2021.6.0.20211220195207.iso as QRadar 7.5.0 GA (Build 20211220195207)
    INFO : Wrote new grub.cfg
    INFO : Synced the new grub.cfg to disk
    INFO : copying /var/log/recovery.log to /recovery/recovery-2022-09-21.log
    INFO : Re-install ready
Upon restart, the GRUB menu shows the new version of the recovery image. The following is an example of what the GRUB menu might display for a QRadar 7.5.0 ISO:

Document Location


[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
28 September 2022