IBM Support

QRadar: Unable to run patch installer and update exits with screen is terminating message



While attempting to patch your QRadar installation, the installer terminates immediately.


Starting the patch installer as described in the relevant Release Notes by running the command:

The screen session starts and stops immediately. You will see the following message:
Starting patch session in screen

Shortly followed with:

[screen is terminating]


This might be caused by an automatic update is running in the background.

Diagnosing The Problem

To verify that an automatic update was the reason why the patch installer did not proceed, please check the log file for the patch installer that is found in the following path: /var/log/setup-#####/patches.log

If you find the following log entry towards the end of the file, your patch installation failed due to an AutoUpdate being in progress:
ERROR: AutoUpdate is currently running. Please try again later.

Resolving The Problem

It is not possible to run the patch installer while an AutoUpdate is in progress in QRadar. You need to wait for the AutoUpdate to complete, then attempt to run the patch installer again. To verify whether auto updates are currently in progress, you can type the following command:
ps -ef | grep UpdateConfs | grep -v grep

If an AutoUpdate is running, you see an output line similar to the following:
root 19385 19379 0 13:54 ? 00:00:06 /usr/bin/perl /opt/qradar/bin/

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Upgrade","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
03 April 2020