IBM Support

QRadar: Admin Tab Displays Event Collection Service is Available for Upgrade

Troubleshooting


Problem

After a QRadar upgrade, the Console's Admin tab repeatedly informs the administrator that a new version of the Event Collection Service (ecs-ec-ingress) is available. The banner continues to display the following message, even after a restart of the Event Collection Service completes:
"A new version of the event collection service is available for upgrade. To upgrade to the new version, on the Advanced menu, click Restart Event Collection Services."

Symptom

  1. Log in to the QRadar Console.
  2. Click the Admin tab.
  3. The banner on the page displays the following notice:
    image-20220303132143-2
  4. Click Advanced > Restart Event Collection Services.
    WARNING: This action globally restarts the ecs-ec-ingress collection service on all appliances that receive events and loads available updates. A restart temporarily stops all event collection on all appliances, checks for updates, then restarts. This action can cause gaps is event reporting and events cannot be received while the ecs-ec-ingress service is restarting. Typically, these actions are only completed during scheduled maintenance.
  5. Wait for the service restart to complete.
  6. On the next check by the Console, the following message is displayed again:image-20220303132153-3

Cause

The ecs-ec-ingress service failed to assign the new version to use and is still using the previous version.

Diagnosing The Problem

  1. Log in to the Console as the root user.
  2. Type the following command to confirm if there are any managed hosts that have a flag showing that ecs-ec-ingress needs to be updated. Hosts have this flag file present if the ecs-ec-ingress version is on a different version than the console:
    /opt/qradar/support/all_servers.sh -Ck "ls -l /etc/siemctl/ecs-ec-ingress.needs_update"
  3. Type the following command to review the ecs-ec-ingress versions on all appliances:
    /opt/qradar/support/all_servers.sh -C "siemctl list-versions ecs-ec-ingress"
  4. Review the output and confirm whether the Product Version differs from the (active) version on all the hosts. For example,
    Console IP -> qradar-console.test.local
    Appliance Type: 31XX Product Version: 2020.7.3.20210323172312
     
    ------------------------------------------------------------------------
    2019.18.4.20200629201233  
    2020.7.3.20210323172312 (active)
     
    <Apphost IP> -> qradar-apphost.test.local
    Appliance Type: 4000 Product Version: 2020.7.3.20210323172312
    ------------------------------------------------------------------------
    
    2019.18.4.20200629201233 (active)
    2020.7.3.20210323172312
    Figure 1: The host qradar-apphost has an active ecs-ec-ingress version (2019.18.4.20200629201233), which does not match the product version (2020.7.3.20210323172312).
  5. If the host displays an active version that does not match the product version, the upgrade alert is displayed on the Admin tab.

Resolving The Problem

NOTE: The administrator must confirm that all the managed host were upgrade to the same version.
  1. Use SSH to log in to the QRadar Console as the root user.
  2. SSH to the managed host that has the wrong active ecs-ec-ingress service version.
  3. Type the following command to assign the service to the proper version:
    siemctl set-active ecs-ec-ingress <version that matches the product version>
    For example, to set the ecs-ec-ingress version to 2020.7.3.20210323172312, type:
    siemctl set-active ecs-ec-ingress 2020.7.3.20210323172312
  4. If the flag file was not removed automatically from the managed host, after setting the ecs-ec-ingress service to the proper version, run the following command on the managed host: 
    rm /etc/siemctl/ecs-ec-ingress.needs_update 
  5. Log in to the QRadar Console as an administrator.
  6. Click the Admin tab.
  7. Click Advanced > Restart Event Collection Services.
    WARNING: This action globally restarts the ecs-ec-ingress collection service on all appliances that receive events and loads available updates. A restart temporarily stops all event collection on all appliances, checks for updates, then restarts. This action can cause gaps is event reporting and events cannot be received while the ecs-ec-ingress service is restarting. Typically, these actions are only completed during scheduled maintenance.Figure01

    Results
    After the Event Collection Services restart, the banner no longer displays. If the user interface displays, "A new version of the event collection service is available for upgrade" message, repeat this procedure to set the ecs-ec-ingress active version on other managed hosts in the deployment.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS009052398","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.3;7.4.0;7.4.1;7.4.2;7.4.3"}]

Document Information

Modified date:
28 April 2022

UID

ibm16555146