QRadar: Common issues and troubleshooting for auto update version 9.11

Administrators on auto update version 9.9 or earlier can experience connection issues due to deprecated GPG keys. When older versions of auto update software attempt to connect to IBM Cloud, a 'Could not retrieve signature for manifest file'. To resolve this error, administrators can run the QRadar-AUProxyFP utility from IBM Fix Central.

Error log example

Fri Nov 5 10:30:06 2021 [DEVEL] Downloading "dau/dau.manifest.xml.asc" and placing in "/store/autoupdates/". 
Fri Nov 5 10:30:06 2021 [DEVEL] Attempting to retrieve https://auto-update.qradar.ibmcloud.com
/dau/dau.manifest.xml.asc?version=7.4.3&customer=Example%20ExampleCorp.&lastau=0&lastpatch=0
&vendor=Q1%20Labs 
Fri Nov 5 10:30:06 2021 [INFO] Could not retrieve "dau/dau.manifest.xml.asc": 404 Not Found 
Fri Nov 5 10:30:06 2021 [ERROR] Could not retrieve signature for the manifest file.

1. Use SSH to log in to the QRadar Console as the root user.
2. Navigate to the /var/log/autoupdates directory.
3. To locate the latest auto update log, type:

   ls -lart

   The output displays the auto update logs by date. For example,

   [root@qradar-lab]# ls -lart
   drwxr-xr-x   2 root root   66 Nov 11 15:40 AU-1636662807
   drwxr-xr-x   2 root root   66 Nov 10 15:40 AU-1631778909
   drwxr-xr-x   2 root root   66 Nov 09 15:40 AU-1636490007

4. Navigate to the directory with the most recent auto update log by date.
5. Review the log for error messages. For example,

   less AU-1636662807.log | grep 'Could not retrieve signature'
   

   Important: If the auto update version is 9.9 or earlier and the signature error is present in your auto update log, run the AUProxyFP-9.11 update.
6. Download the Auto Update Fix Pack utility from IBM Fix Central to your laptop or workstation: AUProxyFP-9.11.tgz.
7. Copy the file to a directory of the QRadar Console, such as /root, /tmp, or /storetmp.
8. Navigate to the directory with the AUProxyFP-9.11.tgz file.
9. Type the following command to extract the file:

   tar -zxvf AUProxyFP-9.11.tgz

   If you experience an issue extracting the file with tar command, type:

   gunzip -c AUProxyFP-9.11.tgz | tar zxvf -

10. Type the following command to install the proxy fix pack:

    ./install.sh

11. In the Admin tab, click the Auto Update icon and click Get New Updates.
12. Optional. After you start the auto update request, you can confirm your auto update version is updated.

    [root@qradar-lab]# /opt/qradar/bin/UpdateConfs.pl -v
    9.10
    

    Results
    Wait for the auto update to run and confirm the update is successful. If you continue to experience errors, contact QRadar Support.

Administrators on auto update version 9.10 or later can experience an issue where the au-cert.pem file is an old version, which can cause the IBM Cloud server to return a 'Bad signature' error. If you experience this error, you can delete the au-cert.pem file from your Console and run a manual auto update.

Error log example

Mon Nov 8 03:08:11 2021 [DEVEL] Running: openssl x509 -in /tmp/au_cert -pubkey -noout > /tmp/au_pub 
Mon Nov 8 03:08:11 2021 [DEVEL] openssl dgst -sha256 -verify /tmp/au_pub -signature /store/autoupdates/scripts
/AUScripts.tgz.sig /store/autoupdates/scripts/AUScripts.tgz /var/log/autoupdates/AU-1636358882/AU-1636358882.log 
>> /var/log/autoupdates/AU-1636358882/AU-1636358882.log 2>&1 
Mon Nov 8 03:08:11 2021 [DEVEL] Output of verification command above: Verification Failure 
Mon Nov 8 03:08:11 2021 [ERROR] Bad signature! Rejecting the manifest, aborting 
Mon Nov 8 03:08:11 2021 [ERROR] Could not verify the authenticity of scripts/AUScripts.tgz. 

1. Use SSH to log in to the QRadar Console as the root user.
2. Navigate to the /store/autoupdates directory.
3. Remove the file au-cert.pem file. For example,

   rm au-cert.pm

4. Run an auto update to receive an updated au-cert-chain.pem file.
   1. In the Admin tab, click the Auto Update icon and click Get New Updates.
      Or
   2. To start an auto update from the command line, type:

      /opt/qradar/bin/UpdateConfs.pl -ds runnow 1