WinCollect: How to troubleshoot upgrade error "line 70: screen: command not found"

Resolving The Problem

• It is recommended to run the following commands during a maintenance window as the restart of multiple services is required to complete the process.
• For more information about the impact of restarting a service in QRadar, check the following link: 
  QRadar: Core services and the impact of restarting services.

1. SSH to the QRadar console as the root user.
2. Make sure the .sfs file is in the the /storetmp directory.
3. Move to the /storetmp directory with the following command:

   cd /storetmp

4. Mount the SFS file to the /media/updates directory. Type the following command, replace <patch file sfs name> with the .sfs file name:

   mount -o loop -t squashfs <patch file sfs name>.sfs /media/updates

   Command example:

   mount -o loop -t squashfs 750_QRadar_wincollectupdate-7.3.1-43.sfs /media/updates
   

5. Go to the directory where the RPM file are located. Run the following command:

   cd /media/updates/repo

6. Install the RPM file for the WinCollect agent, run the following command:

   yum -y install AGENT*

7. Install the RPM's for the PROTOCOL files, run the following command:

   yum -y install PROTOCOL*

8. Run the following command to restart the tomcat process:
   Notes: 
   • Tomcat provides access to QRadar through the graphical interface, during the restar this access is interrupt.
   • The tomcat process takes a couple minutes before is completely back on.

   systemctl restart tomcat

9. Run a full After the access to QRadar through the graphical interface is restored, go to Admin, then click Advanced and select the option for Deploy Full Configuration:
   
10. Restart the collection services. Go to Admin, then click Advanced and select the option for Restart Event Collection Services:
    
11. Unmount the .sfs file, run the following command:

    umount /media/updates

    
    Result:
    The administrator is able to upgrade the WinCollect version on the console manually.