WinCollect: Mounting SFS displays "wrong fs type, bad option, bad superblock on /dev/loop2"

Created by Francisco Javi… on Tue, 01/26/2021 - 16:19

Published URL:

https://www.ibm.com/support/pages/node/6408706

6408706

Troubleshooting

Problem

An error is displayed when trying to mount .sfs file during WinCollect upgrade in the Console similar to:
wrong fs type, bad option, bad superblock on /dev/loop2

Symptom

When performing the WinCollect upgrade in the console, one of the steps is to mount the .sfs file to /media/updates by using the command:
mount -o loop -t squashfs <path_file_name>.sfs /media/updates
Example: mount -t squashfs -o loop 730_QRadar_wincollectupdate-7.3.0-41.sfs /media/updates

Results

The administrator cannot continue as they keep displaying the "wrong fs type" error.

mount -o loop -t squashfs 740_QRadar_wmount: 
       wrong fs type, bad option, bad superblock on /dev/loop2,
       missing codepage or helper program, or other error

       In some cases useful info is found in syslog - try
       dmesg | tail or so.

Note: The issue seen with WinCollect can occur with any .sfs file including Fix packs.

Cause

The error is related to either the file you are trying to mount is corrupted or is not a real .sfs file.

Resolving The Problem

Use the file command to confirm that the downloaded file is a .sfs, for example:

file 740_QRadar_wincollectupdate-7.3.0-41.sfs
740_QRadar_wincollectupdate-7.3.0-41.sfs: HTML document text

Verify that the file is a .sfs, but it is corrupted. A .sfs file uses the squashfs filesystem,

#file 740_QRadar_wincollectupdate-7.3.0-41.sfs
740_QRadar_wincollectupdate-7.3.0-41.sfs: Squashfs filesystem, little endian, 
version 4.0, 23969043 bytes, 94 inodes, blocksize: 131072 bytes, 
created: Thu Sep 24 10:44:30 2020

Download the sha256 file from Fix Central.

To calculate the sha256 of the file after it is downloaded, run the sha256 command on your QRadar appliance.

# sha256sum 740_QRadar_wincollectupdate-7.3.0-41.sfs
8ff8b43b6ad47ce11b3e4b4a73f23b6df3fc82bf35d4e39a990015d438ab089b  740_QRadar_wincollectupdate-7.3.0-41.sfs

Use the cat command open the sha256 file from Fix Central.

 cat 740_QRadar_wincollectupdate-7.3.0-41.sha256
Algorithm       Hash
---------       ----
SHA256          8ff8b43b6ad47ce11b3e4b4a73f23b6df3fc82bf35d4e39a990015d438ab089b

If the calculated value does not match the value from Fix Central, the downloaded file is not the same as the file posted on Fix Central.
Download the .sfs file again from Fix Central.

If the file is an HTML or file other than a .sfs, download the file again from Fix Central.

Related Information

Release of WinCollect Agent V7.3.0 patch 1

QRadar: Unable to patch due to corrupted patch file

Document Location

Worldwide

[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"TS004863250","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]