IBM Support

QRadar command line displays, "Patch still in progress" messages.

Troubleshooting


Problem

After an administrator applies a patch, the system repeats the message, "Patch still in progress - Do Not Reboot" to any user who logs in to the command line.

Symptom

The SSH session repeats the following message after each command line entry:

+++++++++++++++++++++++++++++++++++++++++++

Patch still in progress - DO NOT REBOOT!

Cause

When a QRadar system is patched, a screen session is opened to ensure that the administrator still has access to the installation menus, just in case the SSH session becomes disconnected.

If an installation is still in process, the command line will repeat the message, "Patch still in progress - Do Not Reboot" to inform other users with active SSH sessions that they should not restart the system. This is a safety feature to ensure that the system is only restarted after the patch has completed the update.

This issue can be caused by administrators who close their SSH session, but the system is waiting on some form of input. The most commonly reported issue for this message is due to administrators closing a window before the patch has completed. Typically, the system is waiting on basic input, such as, 'Press Enter to continue'.

Diagnosing The Problem

None, if you see this patch notification message, you can contact your QRadar system administrator to inquire about the installation status or ensure that they are aware that the system might be waiting for input before the installation can complete.

Resolving The Problem

To resolve this issue, the administrator can either re-run the installation command or reattach their screen session.

  1. Run the command to start the patch installation. For example, type ./media/updates/installer.

    The installer checks to determine if a patch is in progress when it runs and can reattach a disconnected screen session for the administrator.

  2. Alternate: Administrators can use the screen command to attach to an existing install session.
    1. To view the list of screen sessions, the administrator can type screen -list.
      If the installation is disconnected, the status is displayed as Detached.
    2. To reattach to the screen session, type screen -x.
    3. Follow the prompts to complete the patch installation process.

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1;7.0;7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
10 May 2019

UID

swg21669100