IBM Support

QRadar: Mounting SFS displays "wrong fs type, bad option, bad superblock on /dev/loop2"

Troubleshooting


Problem

An error is displayed when mounting SFS file during installs or upgrades similar to:
"wrong fs type, bad option, bad superblock on /dev/loop2"

Symptom

The administrator cannot continue as they keep displaying the "wrong fs type" error. 
mount -o loop -t squashfs 740_QRadar_wmount: 
       wrong fs type, bad option, bad superblock on /dev/loop2,
       missing codepage or helper program, or other error

       In some cases useful info is found in syslog - try
       dmesg | tail or so.

Cause

The error is related to either the file that you are trying to mount is corrupted or is not a real SFS file. If administrators download the file by using wget on networks with high latency, the file is likely corrupted.  The recommendation is to use SFTP or Direct Download instead.

Diagnosing The Problem

  1. SSH on to the QRadar console.
  2. Use the file command to confirm that the downloaded file is an SFS. 
    file <FILE_NAME>.sfs
    Example output:
    image-20230424083723-1
  3. Download the sha256 file from Fix Central.
    image-20230424083907-2
  4. To calculate the sha256 of the file after it is downloaded, run the sha256sum command on your QRadar appliance against the downloaded SFS file. 
    sha256sum <FILE_NAME>.sfs
    Example output:
    image-20230424084315-3
  5. Use the cat command open the sha256 file. 
    cat <FILE_NAME>.sfs
    Example output:image-20230424084406-4

    Result
    If the calculated value does not match the value from Fix Central, the downloaded file is not the same as the file posted on Fix Central. It was likely corrupted during download.

Resolving The Problem

Download the SFS file from Fix Central again. Do not use wget, instead use SFTP or Direct Download. For more information on using SFTP, see the download section of this technical note.

Related Information

IBM Fix Central

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"},{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
25 April 2023

UID

ibm16985315

Page Feedback