IBM Support

QRadar: Update failure "Input/output error"

Troubleshooting


Problem

QRadar Update failed due to a bad download.

Cause

Sometimes a QRadar update fails with an error message similar to this:
[ERROR] (patchmode) stderr=cp: reading `/media/updates/tmp/patch_qidmap/qidmap-master.tgz': Input/output error
[ERROR] (patchmode) Could not copy "/media/updates/tmp/patch_qidmap/qidmap-master.tgz" to "/tmp/patch_qidmap/qidmap-master.tgz"


This error message is indicative of a bad download. Run the md5sum command against the .sfs build. Compare the output to the md5sum on Fix Central. They should match exactly. If not, the download was corrupted and the file must be downloaded again.




Resolving The Problem

  1. Log in to the Support Portal > Fix Central Downloads. Download the QRadar_version_patchupdate-QRadar_build.sfs package.
     
  2. Transfer the QRadar_version_patchupdate-QRadar_build.sfs package to the QRadar Console using WinSCP or similar SCP tool.
     
  3. Run from the Console(CLI) this command
    md5sum QRadar_version_patchupdate-QRadar_build.sfs
     
  4. Verify that the md5sum hash matches the build from Fix Central for that build.
    Example

     
  5. Re-Run the patch.

Results: The patch now runs without errors.


[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Upgrade","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 January 2021

UID

swg21973996