Important: A critical issue has been identified in /opt/qradar/bin/qchange_netsetup (IJ31239)

Administrators upgrading QRadar are advised to run a pretest check to verify you do not experience an upgrade issue where a non-compliant hostname can halt the setup. This procedure can help administrators prevent upgrade issues where a deployment is partially upgraded or you experience invalid hostname errors.  If your managed host requires a hostname change, you must remove the appliance from the deployment or break the high availability (HA) pair before you can run qchange_netsetup to update your hostname.

A pretest is required as the following versions validate hostnames and can block QRadar upgrades on appliances:

• QRadar 7.4.2 Fix Pack 2
• QRadar 7.3.3 Fix Pack 6
• QRadar 7.3.3 Fix Pack 7

Procedure
Mount the QRadar sfs image and pretest your upgrade before you start a Console upgrade. QRadar Support recommends that you pretest appliances several days in advance of your change window to identify appliances with incorrect hostnames. If a pretest identifies a hostname issue, you must update your network configuration with qchange_netsetup to ensure that the hostnames are lowercase or RFC4343 compliant. Administrators must monitor the qradar_netsetup.log when you update your network settings.

1. Create the /media/updates directory by typing the following command: mkdir /media/updates
2. Mount the QRadar sfs image by typing the following command: mount -o loop <path_to_the_QRadar_SFS> /media/updates
3. To pretest your appliance, type: /media/updates/installer -t
4. If an invalid hostname is detected, the following error is displayed:

   ==============================================================
   Patch: 2072
   --------------------------------------------------------------
   At least one invalid hostname entry was found in one or more deployment settings.
   Contact support to evaluate the required changes to your deployment.
   See patch log file /var/log/setup-2020.3.2.20201116214411/patches.log for more details.
    
   Abort the software update to fix the invalid hostname entries found.
   Choices:
   1) Yes, abort the software update.
5. Type 1 to exit the pretest.
6. Select one of the following options to remove the appliance from the deployment:
   • Remove the managed host from the deployment
   • Disconnect your high availability (HA) cluster from the deployment
7. Open an SSH session to the QRadar appliance.
8. Navigate to /var/log/setup-<your version>.
   Note: If you have multiple setup folders, navigate to the folder with the newest date in the folder name.
9. To tail the qradar_netsetup.log, type: tail -f qradar_netsetup.log | grep -i 'run by'
10. Connect to the appliance from your console keyboard, remote management interface (IMM), or crash cart.
11. Type the following command: /opt/qradar/bin/qchange_netsetup
12. When qchange_netsetup starts, wait at the Internet Protocol Setup screen. Do NOT continue.
    
    Figure 2: Administrators must wait at this screen and verify the qradar_netsetup.log output from the tail command.
13. In your SSH session, review the output and confirm the Run by field displayed qchange_netsetup logs.
    • Correct:  Mar 10 12:03:13 qradar_netsetup.py[8823]: qradar_netsetup getParentName [INFO] Run by qchange_netsetup
    • Incorrect:   Mar 10 12:03:13 qradar_netsetup.py[8823]: qradar_netsetup getParentName [INFO] Run by -bash
      Important: Any value displayed in the Run by field that does not list qchange_netsetup is considered an error and can lead to configuration issues on the managed host.
14. If you experience an incorrect output in the logs, use the arrow keys to select Cancel from the qchange_netsetup. Exiting qchange_netsetup restarts services on the QRadar appliance.
15. After services restart, you might be required to reconnect your SSH session.
16. From the console keyboard, VM console, or IMM interface, run the qchange_netsetup command again to confirm the Run by log output.
    Note: When you run qchange again, the Run by should display the correct output as [INFO] Run by qchange_netsetup.
17. Update the hostname on your appliance. 
    Note: A valid hostname is a string up to 24 characters that only include [a-z][0-9], period (.), and minus sign (-).
18. Select one of the following options to readd and reassign the appliance from the deployment:
    • Add the managed host to your QRadar deployment
      Note: Reassign all components that are not your QRadar Console to your managed hosts from Deployment Actions > Edit Host Connection.
    • Create a high availability (HA) cluster
    
    Results
    After the host or high availability (HA) pair is added to the deployment, the procedure is complete. Repeat these steps to pretest other appliances in your deployment before you attempt to upgrade.  If you continue to experience an incorrect output in the qradar_netsetup.log, contact QRadar Support for assistance.