Troubleshooting
Problem
As utility is required to install QRadar 7.5.0 versions on Microsoft Azure where the /store partition is greater than 2TB. An issue is reported as APAR IJ45954 where Azure QRadar 7.5.0 installations fail as the partition cannot be created correctly for disks that are 2TB or larger. A script is available to resolve this issue on IBM Fix Central.
Environment
QRadar 7.5.0 installs on Microsoft Azure where the /store partition is greater than 2TB.
Diagnosing The Problem
When this issue occurs, the QRadar installation exits after disk space checks complete. For example,
Checking for minimum disk space on each mount point...
- Require 4000 MiB on /store adding to requirements for mount point '/store'
- Require 500 MiB on /tmp - adding to requirements for mount point '/tmp'
- Require 1000 MiB on /storetmp - adding to requirements for mount point '/storetmp'
- Require 1 MiB on /home - adding to requirements for mount point '/home'
- Require 1000 MiB on /var/log/audit adding to requirements for mount point '/var/log/audit'
- Require 1000 MiB on /var/log - adding to requirements for mount point '/var/log'
- Require 500 MiB on /var - adding to requirements for mount point '/var'
- Require 6000 MiB on /opt - adding to requirements for mount point '/opt'
- Require 1000 MiB on adding to requirements for mount point '/'
- Require 0 MiB on /transient adding to requirements for mount point '/transient'
- Checking that we have at least 500 MiB on /tmp...
- Checking that we have at least 4000 MiB on /store...
- Checking that we have at least 1000 MiB on /storetmp...
- Checking that we have at least 1 MiB on /home...
- Checking that we have at least 1000 MiB on /var/log...
- Checking that we have at least 1000 MiB on /var/log/audit...
- Checking that we have at least 500 MiB on /var...
- Checking that we have at least 6000 MiB on /opt...
- Checking that we have at least 1000 MiB on ...
- Checking that we have at least 0 MiB on /transient...
OK: Free space checks passed.
OK: Red Hat Enterprise Linux Server release 7.9 (Maipo) is a supported Operating System.
OK: Community Edition not detected. Skipping RAM check.
Installing new kernel RPM
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
Package kernel-3.10.0-1160.45.1.el7.x86_64 already installed and latest version
Checking that SELinux is disabled...
OK: SELinux is disabled.
OK: AUTO_INSTALL_INSTRUCTIONS file not required.
Press enter to exit installer
Resolving The Problem
To resolve this issue, administrators must set up their Azure host, run the azure_2tb_fix.sh utility, then complete the QRadar software installation. For more information, see Configuring a 7.5.0 virtual appliance on Microsoft Azure.
Note: You must run the azure_2tb_fix.sh script prior to running the setup script otherwise the build will fail!
Procedure
- Configure your Microsoft Azure appliance in the Azure Marketplace with a disk at 2TB or larger.
- Download the Azure 750 Image Storage Fix utility from IBM Fix Central: azure_2tb_fix.sh
- Upload the script to the Azure home directory on the instance.
- To set permissions, type:
sudo chmod +x azure_2tb_fix.sh - To run the utility, type:
sudo ./azure_2tb_fix.sh - Install QRadar.
Results
The installation is expected to complete successfully and not fail to configure large /store partition. After the QRadar installation completes, you can install the latest upgrade package to apply the latest software updates. If you continue to experience installation errors related to your Microsoft Azure Marketplace image, contact QRadar Support.
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]
Was this topic helpful?
Document Information
Modified date:
09 June 2023
UID
ibm16964830