IBM Support

QRadar: Patchtest failed due to [ERROR] Error retrieving version of QRadar

Troubleshooting


Problem

Patchtest failed due to [ERROR] Error retrieving version of QRadar.

Symptom

During a QRadar upgrade, the patch fails on the pre-test stage with the following error.

[ERROR] Error retrieving version of QRadar

Diagnosing The Problem

Review the /var/log/setup-xxxx-xx.xxxx/patches.log for the following error:

[ERROR] Error retrieving version of QRadar

An error was encountered attempting to process patches.

Please contact customer support for further assistance.

[onexit.d] Running cleanup_hostcontext_timout.sh

[onexit.d] Running cleanup_manually_stopped.sh

[onexit.d] Running cleanup_patch_conf.sh

[onexit.d] Running cleanup.sh

[onexit.d] Running restore_cron.sh

Press enter to close screen

Resolving The Problem

  1. SSH into the QRadar-affected server.
  2. Create a file “/opt/qradar/conf/hostcontext.STOP” to manually stop the Hostcontext service. 
    touch /opt/qradar/conf/hostcontext.STOP
  3. Run the installer.  
    #/media/update/installer
  4. After the upgrade is completed, delete the hostcontext.STOP token generated in step 2.   
    rm -rf /opt/qradar/conf/hostcontext.STOP
  5. Restart hostcontext service.   
    #systemctl restart hostcontext
  6. Check the status of the hostcontext service. It must be Active-Running.   
    # systemctl status hostcontext
    ● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/httpd.service.d
           └─qradar.conf
   Active: active (running) since Wed 2023-05-03 11:26:14 IST; 27min ago
     Docs: man:httpd(8)
           man:apachectl(8)
 Main PID: 4603 (httpd)
Result
The error is no longer displayed. If you still see any issues, contact IBM Support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
09 June 2023

UID

ibm16999607

Page Feedback