IBM Support

QRadar: Steps to migrate from GlusterFS to Distibuted Replication Block Device on Event Collector(s) using the migration script

How To


Summary

If the QRadar® 7.4.2 upgrade detects Event Collectors (in HA or standalone) in your deployment, the upgrade fails. You must run on the Console a migration script for QRadar 7.3.2 Fix Pack 3 or later before you upgrade to QRadar 7.4.2.

This article documents the steps required to:

A. Download the script from IBM Fix Central.
B. Extract and copy the script on the Console and Event Collectors.
C. Run the script to get the file system migrated.

Steps

NOTE: The migration script has to be run on the Console. Documentation about the script can be found at this location.
  1. Download the newest version of the migration script.
    1. Navigate to IBM Fix Central.
    2. In the script section, type gluster.
    3. Create a working directory to save the file.
        
      mkdir -p /store/IBM_Support
    4. Download the file and copy it to the previously created directory in the Console.
    5. Navigate to the directory and unzip the file.
       
  2. Use SCP to move glusterfs_migration_manager-<version>.zip to /storetmp on your Console as root user:
      
    scp glusterfs_migration_manager-<version>.zip <Console_IPaddress:/storetmp
  3. Extract glusterfs_migtration_manager-<version>.zip :
      
    unzip /storetmp/glusterfs_migration_manager-<version>.zip
  4. Move glusterfs_migration_manager-<version>.bin to /opt/qradar/ha/bin/ :
      
    mv /storetmp/glusterfs_migration_manager-<version>.bin /opt/qradar/ha/bin/
  5. Set permissions on the script and verify:
      
    chmod 755 glusterfs_migration_manager-<version>.bin
    ls -ltrh glusterfs_migration_manager-<version>.bin
-rwxr-xr-x 1 root root 9.8M Feb  9 12:14 glusterfs_migration_manager-<version>.bin
  6. Copy the same file to the /opt/qradar/ha/bin/ directory on all Event Collectors:
      
    scp glusterfs_migration_manager-<script_version>.bin <Event Collector IP>:/opt/qradar/ha/bin/
  7. On the Console, run the script to initiate migration of GlusterFS to Distributed Replication Block Device:
      
    /opt/qradar/ha/bin/glusterfs_migration_manager-<version>.bin -m
  8. The script will print a few warnings, take note of those, and type yes if you want to continue:

[WARNING] During migration to DRBD, event collection does not occur.
[WARNING] QRadar uses /store during the migration to DRBD. All other processes that use /store are terminated during migration.
[WARNING] The migration to DRBD restricts software updates to 7.4.2 or higher.
Do you want to continue [yes/no]? yes
Results:
After running the script, the Event Collectors are migrated from GlusterFS to Distributed Replication Block Devices. Those Event Collectors can then be successfully upgraded to 7.4.2.

Document Location

Worldwide

The words LINSTOR®, DRBD®, LINBIT®, and the logo LINSTOR®, DRBD®, and LINBIT® are trademarks or registered trademarks of LINBIT in Austria, the United States and other countries.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.4.2"}]

Document Information

Modified date:
05 April 2021

UID

ibm16413639

Page Feedback