QRadar: Unable to patch due to corrupted patch file

Created by Curt Wolfson on Sat, 12/03/2016 - 19:23

Published URL:

https://www.ibm.com/support/pages/node/286713

286713

Troubleshooting

Problem

If the patch file that is downloaded from IBM® Fix Central is corrupted, you will not be able to use it.

Symptom

When you attempt to mount the file during the installation, you can receive errors such as:

mount: /dev/loop2: can't read superblock

Diagnosing The Problem

To verify that the problem is with the downloaded file, you can compare the md5sum of the file that you downloaded with the sha256 value that is provided by IBM.

When downloading patch file from IBM Fix Central, look for the associated sha256 file as shown below.

To calculate the sha256sum of the file after it is downloaded, run the sha256sum command on your QRadar® appliance:

[root@example ~]# sha256sum 742_QRadar_patchupdate-<Fixpack_version>.sfs

If the calculated value does not match the value from Fix Central, the downloaded file is not the same as the file posted on Fix Central.

Resolving The Problem

To resolve the problem, download the file again. If you are consistently receiving md5sum mismatches, you can try the following options to attempt to work around the issue:

Attempt to download the file with antivirus temporarily disabled. Issues have been reported where some antivirus software types have modified files while inspecting them during the download process.
Attempt to download the file while using a different connection.
Wait some time before trying to download the file again.

[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]