Potential Data Loss (Backups) during Upgrade from QRadar 7.0 to Qradar 7.1

Flash (Alert)


Potential data loss: During an upgrade from QRadar 7.0 to 7.1 files can be deleted if they are stored in the /backup directory (the default directory for backups is /store/backup).


An issue occurred during an upgrade from 7.0 to 7.1 where backup archives were deleted from a system on which the configured backup storage directory had been changed from the default /store/backup to the /backup.

During an upgrade, the upgrade process cleans up space that is typically used for interim system backups. Interim backups are stored in the /backup directory. If you use /backup as your backup location, your backup files are at risk of being deleted from your system when you upgrade to 7.1.

If you are currently running version 7.0 MR5 or earlier and you have any files stored in the /backup directory, you must change your backup directory to another directory before upgrading to 7.1. If you use an external mount, such as NFS, for backups, you must change this mount point to avoid losing your backup archives.

Cross reference information
Segment Product Component Platform Version Edition
Security IBM Security QRadar Log Manager Linux 7.1, 7.0

Rate this page:

(0 users)Average rating

Document information

More support for:

IBM Security QRadar SIEM
Admin Console

Software version:

7.0, 7.1

Operating system(s):


Reference #:


Modified date:


Translate my page

Machine Translation

Content navigation