PudgyDragon dragon head logo PUDGYDRAGON Build Secure Systems. Share Knowledge.

QRadar · Troubleshooting

Update Package 7 Interim Fix 6 Deployment Issues

Resolve deployment failures encountered while installing IBM QRadar 7.5 Update Package 7 Interim Fix 6.

Introduction

While preparing to install IBM QRadar 7.5 Update Package 7 Interim Fix 6 (UP7 IF6), deployment changes repeatedly failed through the QRadar web interface. Investigation revealed multiple contributing issues, including a full /var/log/httpd filesystem and stale deployment status files.

This guide documents the troubleshooting steps used to resolve the deployment failures and successfully continue the update.

Applies To

IBM QRadar 7.5 Update Package 7 Interim Fix 6 (UP7 IF6)

Symptoms

  • Deploy Changes fails from the QRadar web interface.
  • Undeployed changes remain after repeated deployment attempts.
  • Interim Fix installation cannot proceed.
  • The QRadar Console reports deployment failures without identifying a clear cause.

Cause

In this environment, deployment failures were caused by two separate issues:

  • The /var/log/httpd filesystem had reached 100% utilization.
  • Stale deployment status files prevented deployments from completing successfully.

Both issues had to be addressed before the interim fix could be installed.

Resolution

Verify Disk Utilization

Begin by checking filesystem usage.

df -Th

If /var/log/httpd is full, identify archived log files that can be safely moved.

Create a temporary directory to store the archived logs.

mkdir -pv /store/IBM_Support

Move archived or compressed log files from /var/log/httpd to the temporary directory.

Field Note

One archived log file was consuming the majority of the available space. After moving the file, truncating the original file released the disk space immediately without requiring a reboot.

Release the space occupied by the file.

truncate -s0 /var/log/httpd/<log_file>

Verify that sufficient free space is now available.

df -Th

Review Deployment Status Files

Check the deployment status for each managed host.

ls -latr /store/tmp/status | grep deployment

Review the deployment status file.

cat /store/tmp/status/deployment.<IP_Address>

If stale deployment status files are present, move them from the status directory.

mv /store/tmp/status/deployment.<IP_Address> /tmp

Restart the Hostcontext service.

systemctl restart hostcontext

Deploy Changes from the Command Line

If deployment continues to fail through the QRadar web interface, perform a manual deployment.

Navigate to the deployment utilities.

cd /opt/qradar/upgrade/util/setup/upgrades

Run the deployment utility.

./do_deploy.pl

This manually deploys any pending configuration changes that could not be completed through the graphical interface.

Verification

Verify the following before attempting the interim fix again:

  • /var/log/httpd is no longer full.
  • Deployment status files have been cleared.
  • hostcontext is running normally.
  • do_deploy.pl completes successfully.
  • Deploy Changes succeeds from the QRadar web interface.
  • The Update Package 7 Interim Fix 6 installation proceeds without deployment errors.

If the Problem Persists

If deployments continue to fail:

  • Verify that no other filesystems have reached capacity.
  • Review the deployment status files for additional errors.
  • Check the hostcontext service status.
  • Review the QRadar deployment logs for any remaining deployment failures.
  • Resolve all pending deployment issues before attempting to install the interim fix.

Additional Resources

  • IBM QRadar Deployment Troubleshooting Documentation
  • IBM QRadar Update Package Documentation
  • IBM QRadar Hostcontext Documentation