Troubleshooting
Problem
In QRadar, most of the RPMs depend on other packages capabilities to work, and sometimes the RPM installation can fail due to its dependencies. The error returned is similar to the following: "Error: Package: PROTOCOL-XXX.noarch Requires: PROTOCOL-YYY >="
Symptom
For example, if an administrator tries to manually install the PROTOCOL-AmazonAWSRESTAPI-7.5-20220426150330 rpm with the yum command, the installation fails with the following error:
Error: Package: PROTOCOL-AmazonAWSRESTAPI-7.5-20220426150330.noarch (/PROTOCOL-AmazonAWSRESTAPI-7.5-20220426150330.noarch)
Requires: PROTOCOL-AmazonWebServices >= 7.5-20220301183129
Installed: PROTOCOL-AmazonWebServices-7.4-20210420162916.noarch (@/PROTOCOL-AmazonWebServices-7.4-20210420162916.noarch)
PROTOCOL-AmazonWebServices = 7.4-20210420162916
The error informs that the dependency PROTOCOL-AmazonWebServices with version 7.5-20220301183129 is needed to install the AmazonAWSRESTAPI protocol.Cause
The error happens because the RPM dependencies are either missing an older version.
Diagnosing The Problem
Follow these steps to identify the dependencies for an RPM.
- SSH to the QRadar console as a root user.
- Move the RPM you want to install to the console.
- Use the following command to check the decencies before the RPM installation, replace <RPM_File> with the rpm you want to install:
Command example:rpm -qpR <RPM_File>
Output example:rpm -qpR PROTOCOL-AmazonAWSRESTAPI-7.5-20220426150330.noarch.rpm
This output shows that PROTOCOLs-Common with version 7.5-20211020135852, PROTOCOLs-AmazonWebServices with version 7.5-20220301183129 and PROTOCOLs-FlowCommon with version 7.5-20211020135852 are the prerequisites.# rpm -qpR PROTOCOL-AmazonAWSRESTAPI-7.5-20220426150330.noarch.rpm PROTOCOL-Common >= 7.5-20211020135852 PROTOCOL-AmazonWebServices >= 7.5-20220301183129 PROTOCOL-FlowCommon >= 7.5-20211020135852 - Use the following command to check whether the dependencies are installed, replace <RPM_Name> with the rpm name:
Command example:rpm -qa | grep -i "<RPM_Name>"
Output example:rpm -qa | grep -i "PROTOCOL-Common"
This output shows that the PROTOCOL-Common rpm is installed with version 7.5-20220922151234.
You can also check multiple RPM's with the same command, for example:rpm -qa | grep -i "PROTOCOL-Common" PROTOCOL-Common-7.5-20220922151234.noarchrpm -qa | grep -i 'PROTOCOL-Common\|FlowCommon\|AmazonWebServices' PROTOCOL-FlowCommon-7.5-20211020135852.noarch PROTOCOL-AmazonWebServices-7.4-20210420162916.noarch PROTOCOL-Common-7.5-20220922151234.noarchResult
The administrator confirms which dependencies the RPM requires.
Resolving The Problem
- SSH to the QRadar console as a root user.
- Download the RPM and its dependencies from Fix Central.
- Move all the RPMs to the QRadar console.
- Open the folder where you put the RPMs and then install all the RPMs at the same time. In the following command, replace the <RPM> with the RPM names:
yum -y install <RPM-1> <RPM2>Command example:yum -y install PROTOCOL-AmazonWebServices-7.5-20230106033819.noarch.rpm PROTOCOL-AmazonAWSRESTAPI-7.5-20230106033819.noarch.rpm
Result
The administrator installs the RPM without receiving a dependency error. If the error persists, contact QRadar Support for assistance.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
11 July 2023
UID
ibm16982911