IBM Support

QRadar Patch Fails for MD5 Checksum

Troubleshooting


Problem

During remote_copy_file the patch fail because of md5sum mismatch. Administrators can see an error displayed in the screen session Md5sums did not match.

Symptom

When the patch fails look similar messages are displayed in the screen session.
Thu Mar 18 21:59:38 GMT 2021 [HA] remote_copy_file - localMd5sum=34b0dec2da2771532c924459b576163b

Thu Mar 18 21:59:38 GMT 2021 [HA] remote_copy_file - remoteMd5sum=

Thu Mar 18 21:59:38 GMT 2021 [HA] remote_copy_file - Md5sums did not match,

Cause

The issue can be caused by a previous sfs file having been mounted to /media/updates and then deleting the file without umounting it.

Diagnosing The Problem

You can check to see if a deleted file is still mounted by running the command "mount | grep media".

# mount | grep media
/storetmp/733_QRadar_FixPack5-2019.14.5.20200929154613.sfs (deleted) on /media/updates type squashfs (ro,relatime)
/storetmp/733_QRadar_FixPack5-2019.14.5.20200929154613.sfs on /media/updates type squashfs (ro,relatime)

You can see that there are more than one mount listed for /media/updates. The first file has been removed. This is causing confusion with the script.

Resolving The Problem

To resolve this continue to enter "umount /media/updates" until there is nothing listed as mounted on /media/updates.

umount /media/updates
mount | grep media

Now you are able to remount the sfs file and run the patch.

Document Location

Worldwide

[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS005178848","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.3.3;7.4.2"}]

Document Information

Modified date:
28 April 2021

UID

ibm16433805