IBM Support

QRadar: Upgrade failed with YUM error "database disk image is malformed"

Troubleshooting


Problem

Administrators who are upgrading their QRadar appliances found this YUM transactional error "database disk image is malformed"

Cause

The YUM (Yellowdog Updater, Modified) transaction database is corrupted.

Diagnosing The Problem

To confirm if the database is OK or corrupted, run the following steps:
  1. Login to the QRadar Console as the root user.
  2. Optional: Use SSH to log in to the respective managed host if it is not t'he QRadar Console.
  3. Check the YUM transactional SQLITE3 database integrity, run the following command: 
    sqlite3 /var/lib/yum/history/history-*.sqlite "PRAGMA integrity_check"
    The expected output for a healthy SQLITE3 database is: 
    Ok
    Result
    The administrator knows the health status of the YUM transactional SQLITE3 database. If the database is corrupted, move to the Resolving The Problem section.
     

Resolving The Problem

The YUM transactional history records all YUM transactions for audit purposes and enables YUM to undo or replicate transactions. Removing this history to recreate it does not impact the system functionality.
To fix the YUM transactional database error, run the following steps on the affected appliance:
  1. Login to the QRadar Console as the root user.
  2. Optional: Use SSH to log in to the respective host if it is not the QRadar Console.
  3. Create a backup directory: 
    mkdir -pv /store/ibm_support/yum_hist
  4. Move the YUM transactional history to a backup directory: 
    mv /var/lib/yum/history /store/ibm_support/yum_hist/history_backup
  5. Recreate the YUM  transactional history directory: 
    mkdir -pv /var/lib/yum/history
  6. Fix the permissions for the YUM transactional history directory: 
    chmod 0755 /var/lib/yum/history
  7. Fix the ownership for the YUM transactional history directory: 
    chown root:root /var/lib/yum/history
    Result
    The YUM transaction history has been reset; subsequent transactions will initiate a fresh history log. If the issue persists, contact QRadar Support for assistance.
     

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
12 April 2024

UID

ibm17145116

Page Feedback