IBM Support

Release of QRadar 7.2 MR1 Patch 3 (7.2.1.794843)

Release Notes


Abstract

A list of the installation instructions and fixes for IBM Security QRadar 7.2 MR1 Patch 3 (7.2.1.794843).

Content

If your deployment is installed with QRadar 7.1 MR2 or later, you can install fix pack 7.2.1-QRADAR-QRSIEM-794843.

Note: The 7.2.1-QRADAR-QRSIEM-794843 fix pack can upgrade QRadar 7.1 MR2 and above to the latest software version. However, this document does not cover all of the installation messages and requirements. For information on upgrading from QRadar 7.1 MR2 to QRadar 7.2, see http://www.ibm.com/support/docview.wss?uid=swg27038439.


Before you begin

Ensure that you take the following precautions:

  • Back up your data before you begin any software upgrade. For more information about backup and recovery, see the IBM Security QRadar Administration Guide.
  • To avoid access errors in your log file, close all open QRadar sessions.
  • The fix pack for QRadar cannot be installed on a managed host that is at a different software version from the Console. All appliances in the deployment must be at the same software revision to patch the entire deployment.
  • Verify that all changes are deployed on your appliances.
  • The patch cannot install on appliances that have changes that are not deployed.

About this task

Fix packs are cumulative software updates to fix known software issues in your QRadar deployment. QRadar fix packs are installed by using an SFS file. The fix pack can update any appliance that is attached to the QRadar Console that is at the same software version as the Console.


Procedure

    1. Download the fix pack 7.2.1-QRADAR-QRSIEM-794843 from the IBM Fix Central website: https://ibm.biz/BdRKuF (IBM shortened link to the download this Fix Pack)
    2. Using SSH, log in to your system as the root user.
    3. Copy the fix pack to the /tmp directory on the QRadar Console.
      Note: If space in the /tmp directory is limited, copy the fix pack to another location that has sufficient space.
    4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
    5. Change to the directory where you copied the patch file. For example, cd /tmp
    6. To mount the patch file to the /media/updates directory, type the following command:
      mount -o loop -t squashfs 721_QRadar_patchupdate-7.2.1.794843.sfs /media/updates
    7. To run the patch installer, type the following command:
      /media/updates/installer
      The first time that you run the fix pack, there might be a delay before the fix pack installation menu is displayed.
    8. Using the patch installer, select all.
      The all option updates the software on all systems in your deployment. In HA deployments, primary HA appliances are patched and replicate the patch update to the secondary HA appliance.

      If you do not select the all option, you copy the fix to each appliance in your deployment and install the fix pack. If you manually install fix packs in your deployment, you must update your appliances in the following order:

      1. Console
      2. Event Processors
      3. Event Collectors
      4. Flow Processors
      5. Flow Collectors
      If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes.
Results

A summary of the fix pack installation advises you of any managed host that were not updated. If the fix pack fails to update a managed host, you can copy the fix pack to the host and run the installation locally.



Issues resolved in QRadar 7.2 MR1 Patch 3 (7.2.1.794843)
Number Description
IV50619ASSET PROFILES MIGHT BE CREATED WITH AN IP ADDRESS OF 0.0.0.0 FROM DHCP REQUESTS EVENTS
IV51788SEARCH RESULTS GRAPHS MAY DISPLAY A DIFFERENT TIMEZONE THAN THE SEARCH RESULT TABLE DATA
IV53804HOURLY REPORTS MAY INDICATE AN INCORRECT NEXT RUN TIME IN THE REPORTS TAB.
IV54028REPORTS THAT CONTAIN TABLES MIGHT RETURN "NONE" IN TABLE COLUMNS WHEN THE REPORT DATA EXISTS ON THE SYSTEM.
IV54175REPORTS WILL DISPLAY "MULTIPLE(1)" WHEN THERE IS ONLY ONE RESULT
IV54263THE 'INTERNET THREAT INFORMATION CENTER' DASHBOARD ITEM DOES NOT LOAD PROPERLY
IV54271AFTER AN UPGRADE TO QRADAR 7.2MR1, ROUTING RULES MIGHT GENERATE AN ERROR AND NOT SELECTIVELY FORWARD DATA AS INTENDED.
IV54477DURING THE REBOOT PHASE OF AN UPGRADE TO QRADAR 7.2MR1, THE SYSTEM MIGHT HANG DUE TO MULTIPLE SSH SESSIONS.
IV54633EVENTS AND FLOWS STOP COMING IN WHEN THE SNMP DAEMON IS ENABLED
IV54656MODIFYING OR DELETING A CUSTOM PROPERTIES AFFECTS ALL CUSTOM PROPERTIES THAT SHARE THE SAME NAME.
IV54688DISK MAINTENANCE MIGHT NOT RUN AS EXPECTED AFTER AN INTERMITTENTERROR
IV54702AN UPGRADE TO QRADAR 7.2 MR1 MIGHT INCORRECTLY DISPLAY, "PATCH SUCCESSFUL WITH ERRORS" ON MANAGED HOSTS.
IV54720MANAGED HOSTS WITH AN HA SECONDARY MIGHT EXPERIENCE A POSTGRES RPM OR DISKMAINT ERROR AFTER A HOSTSERVICES RESTART.
IV54733THE RULES WIZARD AND VA SCANNERS WINDOWS MIGHT TAKE A SIGNIFICANT AMOUNT OF TIME TO START IN THE USER INTERFACE
IV55035MULTIPLE VULNERABILITIES IN IBM QRADAR SIEM (CVE-2014-0838, CVE-2014-0835, CVE-2014-0836)
IV55222SEARCHES THAT INCLUDE SPECIAL CHARACTERS IN A CUSTOM PROPERTY THAT HAVE BEEN INDEXED MIGHT DISPLAY AN APPLICATION ERROR.
IV55226LOG SOURCES THAT GENERATE IDENTITY EVENTS MIGHT NOT CREATE OR UPDATE ASSET INFORMATION PROPERLY IN THE SYSTEM.
IV56005TIME SYNC IS NOT WORKING FOR MANAGED HOSTS
IV54748QRADAR VULNERABILITY MANAGER GENERATES EXCESSIVE LOG MESSAGES WHEN ASSETS ARE MOVED OR MERGED IN THE ASSET MODEL

I have other questions. Where do I find more information?


If you experience issues during an upgrade or have additional questions, you can see the QRadar forum or contact customer support:

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Documentation","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
10 May 2019

UID

swg27041545

Page Feedback