IBM Support

WinCollect: Version upgrade on HA ends successfully, but WinCollect is still not upgraded on QRadar

Troubleshooting


Problem

A WinCollect upgrade on QRadar ends with a "patch succeeded" message, but the WinCollect version on QRadar still is not updated.
Installation example output:
Patch Report for 192.x.x.x, appliance type: 3199
hostname :  patch test succeeded.
hostname :  patch succeeded.

Symptom

  1. Log in to QRadar GUI.
  2. From the upper left menu, open the About page.
    image-20230630162232-1
  3. Use the Search function in your browser (usually by pressing CTRL+F or similar). Search for wincollect.
    Read the line that mentions AGENT-WINCOLLECT, what does the date section after the version (7.4 or 7.5) say - is it a recent version, or an old version of Wincollect? The format is <yyyymmdd><build version>.
    image-20230630162553-2
  4. If the date and build numbers did not change after the upgrade, then you might be affected by the issue described in this article.

 

Cause

Postgresql database connections are by default set to 750. In case there are old idle connections not released, one might end up in a situation where the connections are all taken, and the upgrade is unable to install files.

Diagnosing The Problem

  1. Log in to the Console command-line interface (CLI).
  2. Examine the /var/log/setup-...../patches.log file.
  3. If you see these errors, you might be affected by an issue where the Postgresql database runs out of connections, and is unable to complete the installation: 
    Postgres maximum connection is 750 and there are already 1138 connections. We need at least 5 free to install the rpm.
error: %pre(PROTOCOL-WinCollectMicrosoftExchange-7.5-20230216203032.noarch) scriptlet failed, exit status 10
Error in PREIN scriptlet in rpm package PROTOCOL-WinCollectMicrosoftExchange-7.5-20230216203032.noarch
error: PROTOCOL-WinCollectMicrosoftExchange-7.5-20230216203032.noarch: install failed
Postgres maximum connection is 750 and there are already 1138 connections. We need at least 5 free to install the rpm.
error: %pre(PROTOCOL-WinCollectConfigServer-7.5-20230216203032.noarch) scriptlet failed, exit status 10
Error in PREIN scriptlet in rpm package PROTOCOL-WinCollectConfigServer-7.5-20230216203032.noarch
error: PROTOCOL-WinCollectConfigServer-7.5-20230216203032.noarch: install failed

Resolving The Problem

If your deployment is affected by the issue described in this article, then raise an IBM QRadar Support case and refer this article (include the URL to this article).

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"TS012993528","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
21 July 2023

UID

ibm17004279

Page Feedback