IBM Support

QRadar: Software installation or upgrade with ISO mounted remotely fails

Troubleshooting


Problem

Clients mount an ISO over a slow network and the result can be either slow or result in random errors.
WARNING: Remote mount of installation files, ISO, can corrupt the environment. This corruption can result in reinstalling locally in the Data Center.

Symptom

  • Installation with ISO mounted remotely is stuck on "Running post-installation scripts" for over 4 hours.
    Note: It is common for installation or upgrade to be on "Running post-installation scripts" line for 3 hours.
  • A black screen is not indicative of failure by itself, press Ctrl on your keyboard to wake up the screen saver.
  • After installation, QRadar is not running as expected: 
    1. Services might be missing or not running.
    2. Partitions might be missing.
    3. System is not booting.
    4. Errors from missing files.
    Note: This corruption would require a reinstall if caused by a remote ISO installation or upgrade.

Cause

Important: QRadar ISO software installations are not intended over Integrated Management Modules (IMM) or XClarity Controllers (XCC) and are not supported. Remote software installations of QRadar over IMM, or XCC, are not validated by development or quality teams.

Known errors related to software installations over IMM, or XCC:

  • Administrators with network speeds under 1000 Mbps report installation errors over remote mount.
  • Network infrastructure, such as IPS devices or firewalls can drop connections, leading to installation errors.

Diagnosing The Problem

Verify IMM, or XCC, network speeds.

Resolving The Problem

Options:
  • Whether the bandwidth is not sufficient for remote mounting, or the remote mounting causes failure, the recommended solution is to have someone update the firmware by using the USB installation instructions:
    1. For ISO upgrades, create a bootable USB drive with a Windows system.
    2. For firmware upgrades, select your hardware types USB installation link.
      Note: Firmware versions can be checked: 
      dmidecode | grep 'Product Name\|Integrated\|UEFI Primary\|DSA\RAID'
​​​​​​​/opt/MegaRAID/MegaCli/MegaCli64 -ShowSummary -aALL | grep "FW Package Version" | awk -F: {' print $2 '}
  • Mounting ISO to network drive that was located in the same city as the servers that use them, was able to install much faster.
  • For reinstalls ONLY, update the recovery partition to the new ISO version on Lenovo systems.

Related Information

Mounting ISOs using an IMM or XCC

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"},{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS012727898","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Document Information

Modified date:
17 August 2023

UID

ibm17025108

Page Feedback