IBM Support

QRadar: How to reinstall an DSM or Protocol RPM when it is not available on Fix Central

Troubleshooting


Problem

An issue is identified where an RPM cannot be found on Fix Central. This issue can cause difficulty when you update or reinstall RPMs. When this issue occurs, users might find it difficult to resolve problems with their RPMs.

Cause

Base versions of the RPMs are not available on Fix Central. Fix Central contains only RPMs for DSMs and Protocols which were updated.

Diagnosing The Problem

When you search for the RPM version, you receive this output on Fix Central:
No results were found that match your filter request
NOTE: Sometimes the RPM might be from the 7.4 version of QRadar. In this case, check the 7.4 version of FixCentral first for your RPM.

Resolving The Problem

  1. Download the respective QRadar ISO version to your host.
  2. Mount it.
    1. On Linux®, you can create a mount point and then use the MOUNT command to mount the ISO image, for example: 
      mkdir -pv /media/cdrom
mount -o loop 750-QRADAR-QRFULL-2021.6.7.20230822112654.iso /media/cdrom
    2. On Windows®, you can double click an ISO image and it mounts itself as a drive.
  3. To find the necessary RPM versions, you can use the YUM command.
    Example:
    [root@qradar ~]# yum search protocol
Updating Subscription Management repositories.
=================================================== Name & Summary Matched: protocol ===================================================
PROTOCOL-AhnLabPolicyCenterJdbc.noarch : PROTOCOL @rpm.description@ Install
PROTOCOL-AkamaiKonaRESTAPI.noarch : PROTOCOL null Install
PROTOCOL-AlibabaCloudSimpleLogService.noarch : PROTOCOL null Install
PROTOCOL-AmazonAWSRESTAPI.noarch : PROTOCOL @rpm.description@ Install
PROTOCOL-AmazonWebServices.noarch : PROTOCOL @rpm.description@ Install
PROTOCOL-ApacheKafka.noarch : PROTOCOL null Install
.
.
.
  4. On Linux: Find the required version in the directory post/dsmrpms and do yum install <RPM filename> to install it.
    On Windows: Use File Explorer to view the RPMs in <Drive>:\post\dsmrpms, and use WinSCP or similar application to copy the file to the QRadar Console. Install the RPM with yum install <RPM filename>.
  5. When the RPM installation is complete, perform a Deploy Changes or Deploy Full Configuration.
NOTE: If you can't find the RPM on Fix Central or in the ISO, you might have downloaded the wrong QRadar version.
If these steps did not resolve the issue, raise a support case.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
31 July 2024

UID

ibm17161915

Page Feedback