IBM Support

Hostnames that have mixed case letters may cause problems when upgrading from QRadar version 7.3.x to 7.4.x

Troubleshooting


Problem

During the running of the QRadar SFS upgrade installer with the -t test option. If the test reports a problem with the domain name not matching between what is in /etc/hostname to what is in the QRadar config files, the upgrade installation will not proceed.
This is due to tighter restrictions for hostnames starting in QRadar version 7.4.x where hostnames have to match according to case in order for QRadar to operate.

Symptom

The following Error is displayed after launching the upgrade: 
At least one invalid hostname entry was found in one or more deployment settings.

Resolving The Problem

  1. Use SSH to log in to the QRadar Console as root user.
  2. If the appliance is not the Console use SSH to connect to the Managed Host.
  3. Confirm the hostname of the console with the following two commands: 
    # hostname -f
# cat /etc/hostname
  4. Check the following config files, and confirm that the case sensitivity of the hostname matches the output from the two commands above: 
    # grep CONSOLE_FQDN /opt/qradar/conf/nva.conf/nva.conf
# grep CONSOLE_FQDN /store/configservices/deployed/globalconfig/nva.conf
# grep CONSOLE_FQDN /store/configservices/staging/globalconfig/nva.conf
# grep CONSOLE_FQDN /opt/qradar/conf/nva.hostcontext.conf
    For example, if the grep commands above returned HOSTNAME.DOMAIN.TLD in the output,
  5. Create a backup of nva.conf and nva.hostcontext.conf to /storetmp
  6. Use a text editor such as vi to edit the files for the variable CONSOLE_FQDN=
    Before:
    CONSOLE_FQDN=HOSTNAME.DOMAIN.TLD
    After:
    CONSOLE_FQDN=hostname.domain.tld
Results:
After the change, run the installer with the -t test option again to confirm you can get past the issue and have the upgrade proceed.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"}],"ARM Case Number":"TS004967309","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
22 September 2021

UID

ibm16490403

Page Feedback