Question & Answer
Question
The QRadar upgrade to V7.4.2 or later requires you to run a migration script on the Console appliance. This script migrates the High Availability (HA) file system from GlusterFS to Distributed Replication Block Device on all Event Collectors in your deployment (irrespective of whether they are currently part of an HA setup or not).
This technical note is a landing page for several articles that document various issues that can be encountered when you run the migration script. If you are planning to migrate OR are at the initial stages of the migration, we suggest you review the checklist provided in this article.
Answer
GlusterFS troubleshooting articles from QRadar Support
- Steps to migrate from GlusterFS to Distibuted Replication Block Device on an Event Collector with the migration script from IBM Fix Central
This article documents the steps required to retrieve the script from IBM Fix Central and to then run it on your Console.
- Migration from GlusterFS to Distibuted Replication Block Device on Event Collector terminates due to insufficient space
Before the migration, the glusterfs_migration_manager script takes a backup of the /store on each Event Collector and stores the backup file on /storetmp/by default. This error occurs due to one or more Event Collector not having enough space in /storetmp.
- Migration from GlusterFS to Distibuted Replication Block Device on Event Collector terminates due to stale PID file
In some scenarios, the script terminates because the /var/run/glusterfs_migration.pid file exists (from a previous execution of the script) and it no longer points to a valid path on the /proc file-system because the older PID is not valid.
- Migration from GlusterFS to Distributed Replication Block Device on Event Collector terminates due to bad hash calculation
How to resolve issues where the script is not reporting the same hash as the Console or is missing on the EC causing the migration script to fail.
- 'Permission denied' error when you run GlusterFS to Distributed Replication Block Device migration script for Event Collectors
Use the instructions provided in this article when the script terminates because of insufficient file system permissions. Permission errors can occur when you download the latest version of the script and do not set permissions before you run the migration utility.
- GlusterFS migration script encounters a "Failed to mount store" error
Use the instructions provided in this article if the migration script fails on one more Event Collectors with a "Failed to mount store" error in the script's log file.
- GlusterFS migration script encounters a "Failed to get store information on the deployment" error
Use the instructions provided in this article when the script fails on Event Collectors where the /store partition is not available in the partition table.
- GlusterFS to Distributed Replication Block Device migration fails when hostname (FQDN) is longer than 54 characters
The script loop and does not successfully run when the hostname(FQDN) of the Event Collector is longer than 54 characters.
If you experience issues with an upgrade or GlusterFS migration, administrators are advised to open a support case with IBM QRadar Support.
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.2;7.4.3"}]
Was this topic helpful?
Document Information
Modified date:
02 December 2021
UID
ibm16436719