IBM Support

Release of the QRadar 7.3.1 Patch 6 SFS (7.3.1.20180912181210)

Release Notes


Abstract

This technical note contains installation instructions, and a list of new features and resolved issues for the IBM Security QRadar 7.3.1 Patch 6 (7.3.1.20180912181210) SFS. These instructions are intended for administrators who use an SFS file to upgrade from QRadar 7.3.1 to QRadar 7.3.1 Patch 6.

Content

Upgrade information
QRadar 7.3.1 Patch 6 resolves reported issues from users and administrators from previous QRadar versions. This cumulative software update fixes known software issues in your QRadar deployment. QRadar software updates are installed by using an SFS file. The software update can update all appliances attached to the QRadar Console. If you have installed any of the following QRadar versions, install software update 7.3.1-QRADAR-QRSIEM-20180912181210 to upgrade to QRadar 7.3.1 Patch 6:

Current QRadar Version Upgrades to QRadar 7.3.1 Patch 6?
QRadar 7.2.8 (any patch version) No, see QRadar 7.3.1 Patch 6 ISO Release Notes .
QRadar 7.3.0 (any patch version) Yes. Administrators can apply this SFS file to update to 7.3.1 Patch 6.
QRadar 7.3.1 Yes. Administrators can apply this SFS file to update to 7.3.1 Patch 6.


The 7.3.1-QRADAR-QRSIEM-20180912181210 SFS file can upgrade QRadar 7.3.0 to QRadar 7.3.1 Patch 6. However, this document does not cover all the installation messages and requirements, such as changes to appliance memory requirements or browser requirements for QRadar. To review any additional requirements, see the QRadar Upgrade Guide .

See QRadar: Software update check list for administrators for a list of steps to review before updating your QRadar deployment.

Before you begin
Ensure that you take the following precautions:

  • Back up your data before you begin any software upgrade. For more information about backup and recovery, see the QRadar Administration Guide .
  • To avoid access errors in your log file, close all open QRadar sessions.
  • The software update for QRadar cannot be installed on a managed host that is at a different software version from the Console. All appliances in the deployment must be at the same software revision to update the entire deployment.
  • Verify that all changes are deployed on your appliances. The update cannot install on appliances that have changes that are not deployed.
  • If this is a new installation, review the instructions in the QRadar Installation Guide .

Installing the QRadar 7.3.1 Patch 6 Software Update
These instructions guide you through the process of upgrading an existing QRadar version from 7.3.1 to QRadar 7.3.1 Patch 6. For information about updating appliances in parallel, see: QRadar: How to Update Appliances in Parallel .

Procedure

  1. Download the software update to install QRadar 7.3.1 Patch 6 from the IBM Fix Central website: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Security+QRadar+Vulnerability+Manager&fixids=7.3.1-QRADAR-QRSIEM-20180912181210&function=fixId&parent=IBM%20Security
  2. Use SSH to log in to your Console as the root user.
  3. To verify that you have enough space (3 GB) in /storetmp for the QRadar Console, type:
    df -h /tmp /storetmp /store/transient | tee diskchecks.txt
    • Best directory option: /storetmp
      It is available on all appliance types, is not cleaned up if you need to postpone your update, and is available on all appliance types at all versions. In QRadar 7.3.0 versions /storetmp is a symlink to the /storetmp partition.
    • 2nd best directory option: /tmp
      This directory is available on all appliances, but in the 7.3.0 versions it is significantly smaller. Moving a file to this directory can cause services to stop. If you leave a file in /tmp for 10 days without completing the SFS update, it might get cleaned up by Red Hat's tmpwatch cron job.
    • 3rd best option: /store/transient
      The store/transient directory was introduced in QRadar 7.2.1 and is allocated 10% of the overall /store directory. However, this directory does not exist on all appliances, such as QFlow or QRadar Network Insights and might not be an actual partition on all appliances.


      If the disk check command fails, retype the quotation marks from your terminal, and then re-run the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have at minimum 3 GB of space available in a directory to copy the SFS before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less that 3 GB available.


      Note: In QRadar 7.3.0 and later, an update to directory structure for STIG compliant directories reduces the size of several partitions. This can impact moving large files to QRadar.

  4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
  5. Use SCP to copy the files to the /storetmp directory on the QRadar Console or a location with 3 GB of disk space.
  6. Change to the directory where you copied the software update file. For example, cd /storetmp
  7. To check for any previously mounted files in the /media/updates directory, type the following command:
    df -h
  8. You must unmount any previously mounted files before you mount this software update file. To unmount any previously mounted files, type the following command:
    umount /media/updates
  9. To mount the software update file to the /media/updates directory, type the following command:
    mount -o loop -t squashfs /storetmp/731_QRadar_patchupdate-7.3.1.20180912181210.sfs /media/updates
  10. To run the software update installer, type the following command: /media/updates/installer
    Note: The first time that you run the software update, there might be a delay before the installation menu displays.
  11. Using the software update installer, select all.
    • The all option updates the software on all appliances in the following order:


      1. Console.
      2. No order required for remaining appliances. All remaining appliances can be updated in any order you require.

    • If you do not select the all option, you must select your Console appliance.

      As of QRadar 7.2.6 Patch 4 and later, you are only provided the option to update all or update the Console appliance. Managed hosts are not displayed in the installation menu to ensure that the Console is updated first. After the Console is updated, a list of managed hosts that can be updated is displayed in the installation menu. This change was made starting with QRadar 7.2.6 Patch 4 to ensure that the Console appliance is always updated before managed hosts, to prevent upgrade issues.

      If you want to update systems in series, you can update the Console first, then copy the software update to all other appliances and run the installer individually on each managed host. The Console must be updated before you can run the installer on managed hosts. When updating in parallel, there is no order required in how you update appliances after the Console is updated.

      If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and re-run the installer, the software update installation resumes.


       

Note: In QRadar 7.3.1 Patch 6, a kernel update is introduced to address issues with appliances failing to log in or list unit files. These issues could prevent the appliance from rebooting. This new kernel does not take effect until the appliance is rebooted. You might need to reboot your system manually for the kernel update to take effect.

To work around this issue, do one of the following:

  •  If you are able to use SSH, type the following command: systemctl --force --force reboot
  •  If you are not able to use SSH, you must perform a cold reboot of the appliance. To do this, physically reboot the appliance or use Integrated Management Module (IMM)

Installation wrap-up

  1. After the update completes and you have exited the installer, type the following command: umount /media/updates
  2. Clear your browser cache before logging in to the Console.

    Results
    A summary of the software update installation advises you of any managed host that were not updated. If the software update fails to update a managed host, you can copy the software update to the host and run the installation locally.

    After all hosts are updated, you can send an email to your team to inform them that they will need to clear their browser cache before logging in to the QRadar SIEM interface.

Known and Resolved Issues


Some APAR links in the following table might take 24 hours to display properly after a software release is posted to IBM Fix Central.

Resolved issues in QRadar 7.3.1 Patch 6
Product Component Number Description
QRADAR DATA IJ07162 CONFIGURED DATA RETENTION DELETE SETTINGS ARE NOT HONORED FOR MULTI-TENANCY
QRADAR USER INTERFACE IJ05649 'DEPLOY CHANGES' CAN SOMETIMES CAUSE A DROP IN CONNECTION BETWEEN ECS-EC AND ECS-EP LEADING TO EVENTS BEING DROPPED
QRADAR RULES IV98895 RULE RESPONSE LIMITER FOR ANOMALY (THRESHOLD) RULES IS NOT FUNCTIONING AS EXPECTED
QRADAR UPGRADES IJ09572 PATCH/UPGRADE TO QRADAR 7.3.1 PATCH 6 CAN HANG FOR AN EXTENDED PERIOD OF TIME (HOURS) WITH "VULN_MAP_ASSET_MV DOES NOT EXIST"
QRADAR DOMAINS IJ07713 QRADAR DOES NOT ALLOW ALL TOP LEVEL DOMAINS IN EMAIL ADDRESS DATA VALIDATION, CAN RETURN 'EMAIL ADDRESS IS NOT VALID'
QRADAR USER INTERFACE IJ06980 DASHBOARDS AND/OR QUICK SEARCHES CAN DISAPPEAR AFTER MODIFICATIONS HAVE BEEN MADE TO USER SETTINGS
QRADAR SEARCHES IV54692 EVENT SEARCHES THAT FILTER BY THE EVENT PROCESSOR MIGHT DISPLAY UNEXPECTED GRAPH RESULTS
QRADAR REPORTS IJ07276 RTF FORMATTED REPORTS CAN FAIL TO GENERATE WITH A NULLPOINTEREXCEPTION DISPLAYED IN THE LOGS
QRADAR SEARCHES IJ07123 INCONSISTENT RESULTS FOR ASSET SEARCHES 'ASSETS WITH OPEN SERVICE = DNS' VS 'ASSETS WITH OPEN SERVICE = DOMAIN'
QRADAR REPORTS IJ06862 REPORT RUNNER OUT OF MEMORY CAN OCCUR WHILE ATTEMPTING TO GENERATE VERY LARGE TABLE CHART PDF REPORTS
QRADAR SEARCHES IJ06807 MODIFYING THE START TIME FOR A LOG ACTIVITY SEARCH CAUSES A BLANK UI WINDOW FOR SOME QRADAR USER LOCALES
QRADAR ASSETS IJ05767 WHEN AN ASSET'S 'GIVEN NAME' IS SET ON THE 'EDIT ASSET PROFILE' WINDOW, IT CAN NO LONGER BE EDITED SUCCESSFULLY
QRADAR ASSETS IJ05756 WHEN AN ASSET HAS A 'GIVEN NAME' ASSIGNED, ANY SUBSEQUENT ASSET NAME CHANGES DO NOT OCCUR IN 'EDIT ASSET PROFILE' WINDOW
QRADAR SEARCHES IJ00800 "HTTP ERROR 400" ERROR WHEN DRILLING DOWN INTO SEARCH RESULTS USING INTERNET EXPLORER 11 AND EDGE WEB BROWSER
QRADAR OFFENSES IV90797 DISPLAYING OFFENSE COUNT BY CATEGORY AND/OR NETWORK DOES NOT RESPECT USER ACCOUNT DOMAIN CONFIGURATION
QRADAR EVENTS IJ07456 EVENT DATA FROM SPILLOVER QUEUE CAN SOMETIMES FAIL TO PARSE WHEN PROCESSED BY THE REGULAR QRADAR PIPELINE
QRADAR HOSTS IJ07127 QRADAR HOSTS CAN TAKE A LONGER THAN EXPECTED TIME TO RECONNECT AFTER A VPN CONNECTION RESET OR INTERRUPTION HAS OCCURRED
QRADAR QUERIES IJ06633 SNMPD DAEMON CRASH OCCURS WHEN PERFORMING A WIDE QUERY
QRADAR DATA IJ02816 APPLICATION DATA CONTINUES TO BE SENT TO THE ASSET MODEL AFTER DISABLING 'CLIENT APPLICATION PROFILING'
QRADAR DASHBOARD IJ05151 DASHBOARD WIDGETS AND REPORTS CAN BE EMPTY AFTER A COMPLETED UPGRADE FROM 7.2.8P1+ TO 7.3.0+ OR 7.3.1+
QRADAR DATA IJ03225 DATA BACKUPS CAN TAKE LONGER THAN EXPECTED OR FAIL TO COMPLETE
QRADAR EVENTS IJ02598 MISSING THE FILE /STORE/PERSISTENT_QUEUE/ECS-EC.ECS-EC CAUSES EVENT PROCESSING/STORAGE TO FAIL
QRADAR INCIDENT FORENSICS SERVICES IJ07138 PACKET CAPTURE FAILS DUE TO NAPATECH3 SERVICE FAILING TO START
QRADAR FLOWS IJ08089 QFLOW PROCESS CAN FAIL ON A MANAGED HOST WHILE APPENDING MESSAGE TEXT SEQUENCE NUMBERS WHEN RECEIVING NETFLOW
QRADAR RULES IJ04902 GEOGRAPHIC RULE TESTS CONTAINING COUNTRIES WITH SPACES IN THEIR NAMES (MULTIPLE WORDS) ARE NOT BEING MATCHED
QRADAR USER INTERFACE IJ04174 APPS TABS CAN BE SLOW TO LOAD AND/OR OR FAIL TO LOAD IN THE USER INTERFACE DUE TO DOCKER FREE SPACE PROVISIONING
QRADAR NETWORK INSIGHTS LOG SOURCES IV87195 SOME QRADAR CONFIGURATIONS CONTAINING A LARGE NUMBER OF LOG SOURCES CAN SOMETIMES EXPERIENCE PERFORMANCE DEGRADATION
QRADAR DATA IJ06757 IMPORTED REFERENCE DATA DOES NOT EXPIRE AT ITS TIME TO LIVE WHEN THE REFERENCE DATA STRUCTURE IS IMPORTED USING CMT
QRADAR DATABASE IJ04182 CONTENT MANAGEMENT TOOL CAN FAIL DURING THE IMPORT OF CUSTOM_ACTION TABLES
QRADAR UPGRADES IV99773 QRADAR DEPLOY FUNCTION REQUIRED AFTER UPGRADE CAN FAIL IF THERE IS NOT ENOUGH FREE SPACE IN /TMP
QRADAR UPGRADES IJ07254 BUILD OR REBUILD OF A DISCONNECTED HIGH AVAILABILITY (HA) SECONDARY APPLIANCE (500) FROM QRADAR 7.2.8P1 TO 7.3.1 CAN FAIL
QRADAR LOGS IJ06866 LOG ROTATE NEEDS TO RUN MORE FREQUENTLY
QRADAR QUERIES IJ06633 SNMPD DAEMON CRASH OCCURS WHEN PERFORMING A WIDE QUERY
QRADAR APPLIANCES IJ06268 DBUS COMPONENT OF SYSTEMD CAN SOMETIMES ENTER A HUNG STATE CAUSING SOME RHEL COMMANDS TO FAIL TO RUN AS EXPECTED
QRADAR UPGRADES IJ06082 QRADAR UPGRADE TO 7.3.1.X CAN FAIL DURING THE INSTALLATION PROCESSES INCLUDED WITHIN "34-POSTGRESQL-UPGRADE.SH"
QRADAR SEARCHES IJ06148 'THERE WAS AN ERROR DOWNLOADING THIS ITEM' MESSAGE WHEN USING AN AQL SEARCH WITH TABLE, BAR, OR PIE CHARTS FOR A DASHBOARD
QRADAR APPLIANCES IJ02752 RUNNING THE QFLOW_DTLS_CERT_SETUP.PY AS PART OF A QNI APPLIANCE SETUP CAN FAIL
QRADAR RISK MANAGER BACKUP IJ06480 QRADAR UPGRADE TO 7.3.0.X CAN FAIL "...GENERATE_ENVIRONMENT.SH: OPTION REQUIRES AN ARGUMENT -- N"
QRADAR RISK MANAGER SIMULATIONS IJ06008 QRADAR RISK MANAGER SIMULATION CAN FAIL WITH 'NO RESULTS' IN THE SIMULATIONS SCREEN
QRADAR SEARCHES IJ06914 LEFT AND RIGHT KEYBOARD ARROW KEYS DO NOT RESPOND APPROPRIATELY WHILE BEING USED WITHIN SOME QRADAR SEARCH FIELDS
QRADAR VULNERABILITY MANAGER DEVICES IJ03313 'APPLICATION ERROR' WHEN PERFORMING A NORMALIZED DEVICE COMPARISON FOR A PALO ALTO DEVICE
QRADAR VULNERABILITY MANAGER LICENSES IJ01180 VULNERABILITY MANAGER 'TRY IT OUT' ICON IS STILL PRESENT AFTER APPLYING A PROPER VULNERABILITY MANAGER LICENSE
QRADAR OFFENSES IV90797 DISPLAYING OFFENSE COUNT BY CATEGORY AND/OR NETWORK DOES NOT RESPECT USER ACCOUNT DOMAIN CONFIGURATION
QRADAR EVENTS IJ07174 "(1026) INVALID DATA" WHEN ADDING COMMA SEPARATED IP ADDRESSES TO AN EVENT RULE
QRADAR OFFENSES IJ06833 OFFENSES CAN HAVE AN INCORRECT START TIME THAT IS PRIOR TO THE OFFENSE CREATION TIME WHEN USING "MATCH COUNT" RULES
QRADAR EVENTS IJ05592 NETWORK NAME AND EVENT 'DIRECTION' CAN BE DISPLAYED INCORRECTLY WHEN EVENTS CONTAIN IPV6 ADDRESSES
QRADAR USER INTERFACE IJ04928 HOVERING OVER AN IP ADDRESS DOES NOT SHOW THE NETWORK NAME IF THE COUNTRY FIELD IS NOT POPULATED IN NETWORK HIERARCHY
QRADAR OFFENSES IJ08032 QRADAR USERS WITHOUT THE 'MANAGE OFFENSE CLOSING' USER ROLE OPTION SELECTED CAN CLOSE OFFENSES
QRADAR AUTHENTICATION IJ07975 LDAP LOGIN CAN FAIL FOR USERS WITH INTERNAL OR OPERATIONAL ATTRIBUTES
QRADAR SERVICES IJ08436 PROCESS RUNNING OUT OF MEMORY DOES NOT CREATE SYSTEM.DMP FILE
QRADAR SEARCHES IJ08828 NON-ADMIN USERS ARE UNABLE TO USE SEARCH FILTER 'LOG SOURCE GROUP', THE LIST DOES NOT LOAD
QRADAR RULES IJ08845 /VAR/LOG/ FILLING WITH 'COM.Q1LABS.CORE.AQL.XFORCEFUNCTIONS: [ERROR]' MESSAGES


Where do I find more information?


[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Component":"Release Notes","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1","Edition":"All Editions"}]

Document Information

Modified date:
18 January 2019

UID

ibm10728895