Release of the QRadar Incident Forensics 7.3.1 Patch 1 ISO (7.3.1.20180119194650)

Content

About this upgrade

These instructions are intended to assist administrators to update appliances from QRadar Incident Forensics 7.2.8 to 7.3.1 Patch 1 by using an ISO file. These instructions inform administrators how to update their deployment to the latest version. For more information, users can review the QRadar Incident Forensics Installation Guide for more information.

QRadar Incident Forensics 7.3.1 Patch 1 uses an ISO file to update to the latest software version. A minimum of QRadar Incident Forensics 7.2.8 Patch 1 (or later) is required to be able to upgrade to QRadar Incident Forensics 7.3.1 Patch 1.

Administrator notes

1. You must be on QRadar Incident Forensics 7.2.8 Patch 1 or later to upgrade to QRadar Incident Forensics 7.3.1 Patch 1.
2. The upgrade from QRadar Incident Forensics 7.2.8 Patch 1 to QRadar Incident Forensics 7.3.1 Patch 1 will use a .ISO file. In the past, ISOs were for new appliance installations only, but QRadar Incident Forensics 7.3.1 Patch 1 is an exception to this rule because of the Red Hat kernel update requirements.
3. Utilities or custom scripts that power users might have created for their QRadar Incident Forensics deployment should be copied off the system. During the 7.3.1 Patch 1 update, a warning is displayed that only data in /store will be preserved. After the appliance reboots, any scripts, 3rd party accounts, or utilities in /tmp, or /, or /root will be deleted. This does not impact ISO files mounted initially by using /root because this cleanup only occurs later in the installation procedure.
   

Current QRadar Incident Forensics Version	Upgrades to QRadar Incident Forensics 7.3.1 Patch 1?
QRadar Incident Forensics 7.2.6 (any patch level) or earlier	No
QRadar Incident Forensics 7.2.7 (any patch level)	No
QRadar Incident Forensics 7.2.8.0	No
QRadar Incident Forensics 7.2.8 Patch 1 or later	Yes, use these release notes to complete this process.
QRadar Incident Forensics 7.3.0 (any patch version)	See the QRadar 7.3.1 Patch 1 SFS Release Notes for more information. The QRadar SFS file is capable of updating an existing 7.3.0 Incident Forensics install to version 7.3.1 Patch 1.
QRadar Incident Forensics 7.3.1	See the QRadar 7.3.1 Patch 1 SFS Release Notes for more information. The QRadar SFS file is capable of updating an existing 7.3.0 Incident Forensics install to version 7.3.1 Patch 1.

Figure 1: Administrators on QRadar Incident Forensics 7.2.8 version are not required to install each ISO release to update to the latest version.

The QRadar Incident Forensics 7.3.1 Patch 1 ISO (7.3.1.20180119194650) can upgrade QRadar Incident Forensics 7.2.8 Patch 1 (7.2.8.20161207001258) and later to QRadar Incident Forensics 7.3.1 Patch 1. However, this document does not cover all of the installation messages and requirements, such as changes to memory requirements or browser requirements for QRadar Incident Forensics. If you are on a version of QRadar Incident Forensics earlier than QRadar Incident Forensics 7.2.8 Patch 1, you can upgrade to QRadar Incident Forensics 7.2.8 Patch 10 before proceeding to install the QRadar Incident Forensics 7.3.1 Patch 1 ISO.

Before you upgrade

Ensure that you take the following precautions:

• Back up your data before you begin any software upgrade and verify that you have recent configuration backups that match your existing Console version. If required, take an on demand configuration backup before you begin. For more information about backup and recovery, see the QRadar Administration Guide.
• All appliances in the deployment must be at the same software and patch level in the deployment.
• Verify that all changes are deployed on your appliances. The update cannot install on appliances that have changes that are not deployed.
• A QRadar Incident Forensics 7.3.1 ISO is available for administrators who want to upgrade from QRadar Incident Forensics 7.2.8 Patch 1 or install a new appliance or virtual machine. Administrators who want to complete a new install need to review the QRadar Incident Forensics Installation Guide.
• To avoid access errors in your log file, close all open user interface sessions.
• If you are unsure of the IP addresses or hostnames for the appliances in the deployment, run the utility /opt/QRadar/support/deployment_info.sh to get a .CSV file with information about the QRadar deployment. The CSV file will contain a list of IP addresses for every managed host.
• If you are unsure of how to proceed when reading these instructions or the documentation, it is best to ask before starting your upgrade. To ask a question in our forums, see: https://ibm.biz/qradarforums.

Part 1. Staging files and pretesting your appliance

It is important that administrators pretest their deployment to ensure that they will not experience unexpected issues when updating to QRadar Incident Forensics 7.3.1 Patch 1. A pretest is a common precaution that should be taken by all administrators before they install an update to locate potential issues. The pretest does not restart services and can be completed without scheduled downtime. The pretest typically takes between 3 to 5 minutes to complete on each appliance. If for some reason your SSH session is disconnected, you can reconnect to the remote host using screen.

Procedure
The pretest should be completed on all hosts by the administrator before you attempt to upgrade to QRadar Incident Forensics 7.3.1 Patch 1.

1. You must have installed the QRadar Console with 7.3.1 before you begin this procedure.
2. Download the QRadar Incident Forensics 7.3.1 Patch 1 ISO (5.5 GB) from the IBM Fix Central website: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+Incident+Forensics&release=7.3.0&platform=Linux&function=fixId&fixids=7.3.1-QRADAR-QIFFULL-20180119194650&includeSupersedes=0&source=fc
   

3. Using SSH, log in to your Console as the root user.
4. Open an SSH session to the QRadar Incident Forensics appliance.
5. Type the following command: screen
6. To make the directory for the update, type: mkdir -p /media/cdrom
7. To verify you have enough space (5.5 GB) in /root or /var/log for the ISO on all appliances, type:
   df -h /root /var/log | tee diskchecks.txt
   
• Best directory option: /root
  It is available on all appliance types, is the best option to host the ISO file.
• 2nd best directory option: /var/log
  This directory is available on all appliances, but there might not be the required space available.
• DO NOT USE: /tmp, /store/tmp, or /store/transient for your ISO upgrade. These directories are partitioned as part of the upgrade and administrators cannot use them as storage locations or mount points for the ISO file.
  
  If the disk check command fails, retype the quotation marks from your terminal, then re-run the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have at minimum 5.5 GB of space available in a directory to copy the ISO before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less that 5.5 GB available.
  
  Reminder: Utilities or custom scripts that administrators have created for QRadar Incident Forensics should be copied off the system. During the 7.3.1 update, a warning is displayed that only data in /store will be preserved. Therefore, scripts, 3rd party utilities in /tmp, or /, or /root will be deleted during the upgrade.
  

8. If there is not 5.5GB of space in /root or /var/log, the administrator must make directory space for the ISO file.
9. Using WinSCP or SCP, copy the ISO to the /root or /var/log directory on the QRadar Incident Forensics Console with 5.5 GB of disk space for the ISO file.
10. To mount the ISO, type the following command: mount -o loop /root/Rhe764forensics7_3_1_20180119194650.stable-7-3-1.iso /media/dvd"
11. To pretest the Console appliance, type: /media/dvd/setup -t
    The pretest output will be written to the command window. Review this output after the pretest completes.
12. Using SSH, open an SSH session to the other appliances in your deployment. QRadar Incident Forensics Support recommends that all administrators run the pretest to identify issues before the update begins.
13. To pretest the managed host, type: /media/dvd/setup -t
    
    Results
    If an appliance in your deployment fails the pretest, administrators can take the recommended action from the pretest utility. The issue must be resolved before the update to 7.3.1 begins to prevent downtime for specific appliances. If there are messages you do not understand or want to discuss further, you can use our forums: https://ibm.biz/qradarforums.

Part 2. Installing QRadar Incident Forensics 7.3.1 Patch 1 ISO

These instructions guide administrators through the process of upgrading an existing QRadar Incident Forensics install at 7.2.8 Patch 1 or later to QRadar Incident Forensics software version 7.3.1 Patch 1. The update on the Console must be completed first before you attempt to update QRadar Incident Forensics 7.3.1 Patch 1.

Procedure
You must complete: Staging files and pretesting your deployment before you begin the installation steps listed below.

1. Using SSH, log in to the Console as the root user.
   
   NOTE: When you log in, the SSH session should display 7.3.1 as the Console's version. This verifies that the QRadar Console has been updated to 7.3.1, which is required before you update your Incident Forensics appliance.
2. Open an SSH session to the QRadar Incident Forensics appliance.
3. To run the ISO installer, type the following command: /media/dvd/setup
   
   Important: Upgrading from QRadar Incident Forensics 7.2.8 Patch 1 or later to QRadar Incident Forensics 7.3.1 Patch 1 can take 1 to 2 hours to complete on the appliance.
   

4. Wait for the update to complete.

Results
A summary of the ISO installation advises you of any issues. If there are no issues, administrators can now use SSH to log in to managed hosts and start the installer on each host to run the setup in parallel.

Part 3. Installation wrap-up

1. After all hosts are updated, administrators can send an email to their team to inform them that they will need to clear their browser cache before logging in to the QRadar Incident Forensics SIEM interface.
2. To unmount the /media/dvd directory, type: umount /media/dvd
3. Administrators can delete the ISO from the appliance.
4. Review any static routes or customized routing. As mentioned in the administrator notes, all routes were removed and will need to be reconfigured after the upgrade completes.
5. Any iptable rules configured should be reviewed as the interface names have changed in QRadar Incident Forensics 7.3.1 Patch 1 due to the Red Hat Enterprise 7 operating system updates. Any iptables rules that use Red Hat 6 interface naming conventions will need to be updated.

Resolved issues for QRadar Incident Forensics 7.3.1 Patch 1

Some APAR links in the table below might take 24 hours to display properly after a software release is posted to IBM Fix Central.