QRadar: Migration from GlusterFS to Distributed Replication Block Device on Event Collector terminates due to bad hash calculation

Troubleshooting

Problem

QRadar® 7.4.2 upgrade requires administrators to run a migration script on the Console. This script migrates the High Availability file system from GlusterFS to Distributed Replication Block Device (DRBD®) on all Event Collectors (EC) in your deployment:

/opt/qradar/ha/bin/glusterfs_migration_manager-<script_version>.bin

In some scenarios, the required copy of the script is missing on the EC causing it to fail.

Symptom

The glusterfs_migration script displays an error:

[CRITICAL] The migration binary on <Event Collector Hostame> has a sha256 hash that does match the console.
[CRITICAL] Found:
[CRITICAL] Expected: ee00f10f8fae5553370d6115fba55f5f6c0138977215dbb94b719b262d4f5a0e
[CRITICAL] The following hosts did not have a binary with the expected hash and will be ignored until the issue is corrected: ['<Event Collector IP>']
[WARNING] There are hosts in the deployment with issues that prevent migration from continuing. Check the logs for more details.

Cause

As part of the script procedure, it checks the sha256 hash between the script in the Console and the EC. This check fails in the following scenarios:

The migration script is not in the /opt/qradar/ha/bin/ directory in the EC.
The migration script in the EC reports a different hash than the Console.

Environment

QRadar® Event Collectors upgrading to 7.4.2

Diagnosing The Problem

Log into the Console as the admin user.
SSH to the Event Collector from the Console.

Look for the file in the EC and verify the hash does not match the Console.

sha256sum /opt/qradar/ha/bin/glusterfs_migration_manager-<script_version>.bin

Resolving The Problem

Download the newest version of the migration script.
1. Navigate to IBM Fix Central.
2. In the script section, type gluster.
3. Create a working directory to save the file.
```
mkdir -p /store/IBM_Support
```
4. Download the file and copy it to the previously created directory in the Console.
5. Navigate to the directory and unzip the file.
```
cd /store/IBM_Support
unzip glusterfs_migration_manager-<script_version>.zip
```

Assign executable permissions to the bin file.

chmod +x glusterfs_migration_manager-<script_version>.bin

Copy the bin file to the /opt/qradar/ha/bin/ directory in the Console.

cp -pfv glusterfs_migration_manager-<script_version>.bin /opt/qradar/ha/bin/

Copy the same file to the /opt/qradar/ha/bin/ directory in the EC.

scp glusterfs_migration_manager-<script_version>.bin <Event Collector IP>:/opt/qradar/ha/bin/

Run the migration script in the Console in precheck mode.

/opt/qradar/ha/bin/glusterfs_migration_manager-<script_version>.bin -p

Run the migration script again.

/opt/qradar/ha/bin/glusterfs_migration_manager-<script_version>.bin -m

Related Information

QRadar® 7.4.2 - Migrating event collectors from GlusterFS to Distributed Repli…

Document Location

Worldwide

The words LINSTOR®, DRBD®, LINBIT®, and the logo LINSTOR®, DRBD®, and LINBIT® are trademarks or registered trademarks of LINBIT in Austria, the United States and other countries.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS005197304","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.2"}]

Tips