QRadar: Upgrade of QRadar Network Packet Capture stalls or fails with "No more mirrors to try" error

Troubleshooting

Problem

An upgrade to QRadar Network Packet Capture (NPCAP) counterflow times out and fails because server unreliability prevents streaming of the necessary files.

Symptom

The installation hangs for over 15 minutes or reports errors similar to the following:

2:vim-filesystem-7.4.629-8.e17_9.x86_64: [Errno 256] No more mirrors to try. 
subscription-manager-rhsm-1.24.48-1.e17_9.x86_64:  [Errno 256] No more mirrors to try. 
kernel-3.10.0-1160.45.1.e17.x86_64:  [Errno 256] No more mirrors to try. 
2:microcode_ctl-2.1-73.11.e17_9.x86_64:  [Errno 256] No more mirrors to try. 
redhat-release-server-7.9-6.e17_9.x86_64:  [Errno 256] No more mirrors to try. 

System upgrade failed: Command '['chroot', '/upgrade', 'yum', 'y', 'nogpg', 'disablerepo=*', '-enablerepo-upgrade', 'upgr
ade']' returned non-zeri exit status 1

Cause

Unreliable connection prevents the ISO from being downloaded during the installation.

Environment

Network Packet Capture appliances (NPCAP 7.4.2-1203) upgrading to 7.5.0 over IMM, SSH, or other remote management tools.

Resolving The Problem

To resolve the issue, the ISO file must be copied and mounted locally. "Local" for the sake of this procedure refers to mounting the ISO file on a computer with in the same network (or a 1 GB or greater connection). If the computer hosting the ISO and the Network Packet Capture appliance are separated by a VPN or a high network latency, the upgrade might fail. In those cases, follow the Mounting on the appliance instructions.

Log in to the computer you plan to host the ISO on. Remember, it must be in the same network as the NPCAP appliance, and it must be able to attach to the IMM or XCC Web Browser so you can start a remote session on the NPCAP appliance.
Download the 7.5.0 upgrade package from fix central to your system by using SFTP.
Note: If this is not the version you want, see the upgrade guide for help with identifying the version you want.
Open the IMM or XCC Web Browser (depending on your hardware).
Open a remote control session on the NPCAP. If you are not automatically brought to the login prompt, click Alt-F2 to start a session.
Mount the ISO in the Remote Viewer. This option is in the Virtual Media menu. See the second step of the upgrade procedure for a walk-through of the UI for IMM2.
Mount the virtual media device that contains the ISO by entering the following command into the console prompt. You must replace /dev/sr0 with your mount location.
```
mount /dev/sr0 /mnt/cdrom
```
Run the upgrade:
```
/mnt/cdrom/upgrade
```
When the upgrade is complete, unmount the ISO.
```
umount /mnt/cdrom
```
Reboot the NPCAP appliance.

Results
The upgrade runs without hanging. If the connection between the device mounting the ISO and the NPCAP appliance is not strong enough and repeats the timeout error, you can attempt Mounting on the appliance instead.

Mounting on the appliance

This method is for users who have no other device that can connect to their Network Packet Capture server with a reliable enough connection to stream a large ISO file. It requires mounting the ISO on the device directly.
Important: This process works for upgrades only. It cannot be used for fresh installations or downgrades.

Steps

Log in to the computer you plan to host the ISO on. It must be able to attach to the IMM or XCC Web Browser, but the connection does not need to be as strong as in the first method.
Download the 7.5.0 upgrade package from fix central to your system by using SFTP.
Note: If this is not the version you want, see the upgrade guide for help with identifying the version you want.
Open the IMM or XCC Web Browser (depending on your hardware).
Open a remote control session on the NPCAP appliance. If you are not automatically brought to the login prompt, click Alt-F2 to start a session.
SCP the file from the host device to the NPCAP appliance. Depending on your connection, the copy might take a while.
Create the directory to mount the ISO into. This directory is where you perform the upgrade from.
```
mkdir -p /media/cdrom
```

Mount the ISO file.

mount -o loop /path_to_ISO/isofile.iso /mnt/cdrom

Perform the upgrade.
```
/media/cdrom/upgrade
```
When upgrade is complete, unmount the ISO.
```
umount /media/cdrom
```
Reboot the Packet Capture appliance.

Result
The upgrade completes without hanging.

Related Information

https://www.ibm.com/support/pages/release-qradar-network-packet-capture-750-bui…

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.4.2"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMT8P","label":"IBM QRadar Network Packet Capture Appliance"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Tips