IBM Support

QRadar: Installs and server rebuild case policies

Question & Answer


Question

This article informs administrators about QRadar® Support policies and out-of-scope work for installations, reinstalls, or rebuilding appliances and the responsibilities of the QRadar administrator. 

Answer

Responsibilities for appliance installations or rebuild issues

QRadar® installs refer to the installation of the operating system (OS) and QRadar software on a server, as a Console or a Managed Host. Rebuild scenarios can occur on existing appliances that encounter severe problems that cannot be recovered from, without the need of rebuilding the server.

Support type Description Responsibility
Installation and appliance rebuild support policy
QRadar® Support can assist with error messages, discuss issues with administrators, or confirm processes for software installations and appliance rebuilds. For example, QRadar Support can: 
  1. Investigate failures and review logs when an appliance installations or appliance rebuild cannot complete successfully.
  2. Explain errors and discuss why a software rebuild is required and highlight important steps.
  3. Assist with configuration backup and restore issues when rebuilding or reinstalling QRadar.
  4. Assist with deploy changes errors or problems when administrators cannot add or remove managed hosts when rebuilding or installing QRadar.
  5. Answer questions about documented procedures, such as:
    • Installations or appliance rebuild procedures
    • System requirements
    • Documented features, like offboard storage or high availability.
    • Discuss or explain known issues that impact appliance installs or rebuilds.
    • Discuss customizations an administrator might need to back up separately, such as previously applied support fixes or static routes as mentioned in the QRadar upgrade checklist.
  6. Confirm automatic updates run and diagnose RPM installation failures.
  7. Review installation error messages or data collection issues after a rebuild or install.
  8. Confirm or explain xClarity or IMM errors in configuration preventing remote management of the appliance.
 QRadar technical support

To open a case or report an error regarding an installation or an appliance rebuild, contact QRadar technical support.
Out-of-scope for QRadar Support
The following topics are considered out-of-scope for technical support. QRadar Support reserves the right to close cases related to the following issues:
 
  • Planning initial deployment sizing and overall deployment of QRadar. Scoping and sizing questions are typically handled by IBM Sales engineers.
  • Requests to install, customize, or configure QRadar or Red Hat operating system before the QRadar software is installed. Including requests to harden appliances or modify default users required for system operation.
  • Requests to remain on Webex conferences during the setup process, when technical support is not required.
  • Complete health checks for QRadar after a rebuild or install.
  • Requests to downgrade QRadar installations. QRadar software cannot be downgraded and must be reinstalled by the administrator.
  • Advise on license increases or providing license keys to users. Administrators are expected to contact the Q1PD team when administrators need request new or replace licenses.
  • Troubleshooting third-party software issues that impact remote management functionality. For example, downloading, installing, or updating Java™ or ActiveX™ software on workstations for IMM or xClarity for remote management.
  • Assist with performance tuning after administrators rebuild or install QRadar. For more information, see QRadar: Performance issues and support policies.

Resources:
  • Administrators who need assistance with special storage considerations, appliance migrations, or advice on unique network issues can contact the IBM Security­® Expert Labs.
  • Clients can contact their account manager or IBM Sales team for advice about designing a QRadar deployment or sizing and license requirements or their deployment.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
21 June 2021

UID

ibm16428207

Page Feedback