IBM Support

QRadar: Determine changes that occurs as a result of deployment changes

Troubleshooting


Problem

How to determine the changes made after a deployment change has been run?

 

Environment

Qradar version 7.4 and 7.5

Resolving The Problem

Important: This procedure works with text files only.
This procedure will help determine the changes to a configuration file within the QRadar Console. For this article, the nva.conf file is used for demonstration purposes only. For example, you might have, a remote.conf, or xforce_feed.txt file that you want to review the changes on. This procedure does not work with every file that is being deployed. Some files including .rpm's does not work with this procedure.
 
Before you begin
Make sure you have the latest configuration backup in place before committing any deployment change.
 
  1. Log in to the QRadar UI.
  2. Click Admin tab.
  3. Expand the undeployed changes window by clicking View Details.
  4. Expand the drop-down menu, you see the directory of any files to be updated during the deployment change.
  5. Review the components that need to be changed. You should find this information in the (yellow) warning message.
    Note: In this example, the file being changed is nva.conf.

    Admin Deploy Change
  6. Note: Most of the original files before a deployment are located in /opt/qradar/conf
  7. Use an SSH session log in to the QRadar console by using the root account.
  8. Type the command locate <File Name> | grep /opt/qradar/conf 
    locate nva.conf | grep /opt/qradar/conf
    Output: 
      /opt/qradar/conf/nva.conf
  /opt/qradar/conf/nva.conf.bak /opt/qradar/conf/nva.configservices.conf/opt/qradar/conf/templates/db_update_7264.nva.confrepl.sql
  /opt/qradar/conf/templates/nva.conf
  /opt/qradar/conf/templates/nva.configservices.conf
  /opt/qradar/patches/backups/7.2.5/opt/qradar/conf/nva.conf.orig
  /opt/qradar/patches/backups/7.2.5/opt/qradar/conf/templates/nva.configservices.conf
  /store/backup/tmp/opt/qradar/conf/nva.configservices.conf
  9. Create a backup directory by using: 
    mkdir -p /store/IBMSupport/
  10. Copy the noted files from /opt/qradar/conf/<File> to /store/IBMSupport/ 
    cp -p /opt/qradar/conf/nva.conf /store/IBMSupport/
  11. Click Deploy Changes.
  12. Wait for the deployment to complete.  Files that are updated by the deployment with the latest timestamp under directory /store/configservices/staging/globalconfig/
  13. Compare the files by using the diff command: 
    diff /store/configservices/staging/globalconfig/nva.conf /store/IBMSupport/nva.conf
Results
The diff command provides the difference between the two files, showing what was changed.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
03 January 2023

UID

ibm10886691

Page Feedback