Troubleshooting
Problem
Administrators can experience an issue where upgrades from QRadar 7.3.2 patch 2 or later fail when the hostname for an appliance contains upper case characters. Uppercase hostnames that are not lowercase can cause issues with the Application Framework failing. This technical note is intended to provide more context and information about APAR IJ30763. It also explains how to identify the issue before opening a case.
Symptom
These symptoms indicate that you might be experiencing this issue.
- The /opt/qradar/bin/upgrade_applications.py script fails during the patch.
- The /opt/qradar/bin/after_services_up.sh script fails during the patch and services do not restart.
- After the reboot, all applications fail to run.
Diagnosing The Problem
Administrators reviewing logs for this issue in /var/log/setup-<QRADAR_BUILD_ID>/patches.log can search for the following terms:
- 'no such host' WARN messages for port 53 in the logs followed by a 'Failed to run after services_up.sh' ERROR message.
- 'Patch Failed' INFO messages where the hostname includes uppercase or a mix of upper and lower case characters.
May 28 16:34:37 2019: May 28 16:34:37 2019: [WARN](patchmode) time="2019-05-28T16:34:37-07:00"
level=fatal msg="Error checking for blob sha256:fbbe1dc3535f2e4cfd3606016df4b075ae74e3bf39f8490cdbc073d93109a817 at
destination: pinging docker registry returned: Get https://5be0da69e439cad7744b.localdeployment:5000/v2/:
dial tcp: lookup 5be0da69e439cad7744b.localdeployment on <DNS-SERVER>:53: no such host"
May 28 16:34:37 2019: [732_patch_192895] [post_deploy:Run] python /opt/qradar/bin/upgrade_applications.py
--run_during_patch
May 28 16:36:09 2019: May 28 16:36:09 2019:[ERROR](patchmode) Failed to run after_services_up.sh.
May 28 16:36:09 2019: May 28 16:36:09 2019:[DEBUG](patchmode) returning code 30
May 28 16:36:09 2019: May 28 16:36:09 2019:[ERROR](patchmode) postPatchRet=30
May 28 16:36:09 2019: May 28 16:36:09 2019:[DEBUG](patchmode) setting for hostId='3' retcode='30',
hostName='<UPPERCASE-CONSOLE-NAME>' isTest=0
May 28 16:36:09 2019: May 28 16:36:09 2019:[DEBUG](patchmode) patchStatusCode=3
May 28 16:36:09 2019: May 28 16:36:09 2019:[DEBUG](patchmode) setting to localhostname
May 28 16:36:09 2019: May 28 16:36:09 2019:[DEBUG](patchmode) Set hostId=3 status to 'Patch Failed';
status=3.
May 28 16:36:09 2019: May 28 16:36:09 2019: [INFO](patchmode) Set <UPPERCASE-CONSOLE-NAME>
status to 'Patch Failed'
May 28 16:36:09 2019: May 28 16:36:09 2019:[DEBUG](patchmode) setting patch failed
Resolving The Problem
If you are experiencing an issue with your applications after patching from 7.3.2 patch 2 or later.
- Log in to the Console as root user.
- Review /var/log/setup-<QRADAR_BUILD_ID>/patches.log for similar errors from diagnosing the problem.
- Collect the entrees from /etc/hosts by using the all_servers command.
/opt/qradar/support/all_servers.sh -C -k 'cat /etc/hosts >> /storetmp/hosts.txt' - Navigate to /storetmp
- Review the hosts.txt files for appliances with hostnames that contains uppercase characters.
- Collect logs from any appliance that matches both similar errors in the patches.log file and has a hostname that contains uppercase characters form the host.txt file you created.
- Open a case with IBM® QRadar® Support.
- Upload the logs and file hosts.txt to the case.
Results
Administrators who experience issues where they cannot upgrade due to a hostname capitalization error must review APAR IJ31239 before you attempt to update hostnames using qchange_netsetup.
Document Location
Worldwide
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.3.2;7.3.3;7.4.0;7.4.1;7.4.2"}]
Was this topic helpful?
Document Information
Modified date:
06 April 2021
UID
ibm16415845