IBM Support

Firmware (v1.0) update for QRadar M3 appliances (1U)

Release notes


Abstract

Update the firmware for your IBM® Security QRadar® appliances to take advantage of additional features and updates for the internal hardware components of the QRadar appliance.

Content


This page outlines important information about the M3 appliance firmware upgrade for administrators who need to update QRadar M3 (1U form factor) appliances. These firmware updates are the only supported method of updating firmware for QRadar appliances. Administrators must use the one of the installation option listed below to install firmware updates for their M3 (1U form factor) appliances.

To update the firmware on an M3 appliance can use the Bootable Media Creator (BoMC) to create a USB drive that is suitable for applying firmware updates.




Supported appliances, types, and model information


This firmware update applies to the following IBM Security QRadar M3 (1U form factor) appliances, server type, or Machine type models:

Hardware Details Size
Appliance IBM Security QRadar 2100
IBM Security QFlow Collector 1201
IBM Security QFlow Collector 1202
IBM Security QFlow Collector 1301
IBM Security QFlow Collector 1302
IBM Security Event Collector 1501
1U
Server Type x3550 M3 1U
Server Machine Type 7944 1U
Machine type models (MTM) 4378-Q21
4378-C21
4378-QC2
4378-QD1
4378-QSR
4378-QLR
1U


Base software files


The table shows the Base System Pack and any additional packages that make up the recommended firmware update:
Package  Name 
Base System Pack  ibm_utl_uxsp_d6sp03p-7.50_rhel6_32-64


Important file changes in this firmware update
The table below lists important updates in the Base System Pack and HDD update.

Component  Pre-requisite version Firmware version  Name 
IMM2  yuooc7f-1.31 or later yuooh1c-1.50 ibm_fw_imm_yuooh1c-1.50_linux_32-64
UEFI/BIOS  None d6e162a-1.20 ibm_fw_uefi_d6e162a-1.20_linux_32-64
DSA  None dsytc5f-9.53 ibm_fw_dsa_dsytc5f-9.53_linux_32-64
Server RAID Controller M1015 None 20.13.1-0245 ibm_fw_sraidmr_1000-20.13.1-0245_linux_32-64
ServerRAID Controller H1110 09.101 / 15.00.00.00 1.20.02 ibm_fw_mpt2sas_h1110-1.20.02_linux_32-64
HDD Update  None sas-1.17.02 ibm_fw_hdd_sas-1.17.02_linux_32-64


Notes:

  • Administrators MUST enable IMM.Over.LAN on the xSeries appliance BEFORE the firmware update is applied. For information on how to enable this setting, see: http://www.ibm.com/support/docview.wss?uid=swg21982944.
  • A number of hard disk drives can be installed in this appliance. The HDD update tool examines the hard disk drives that are present and selects the most current firmware level that is available.
  • The base system pack contains other firmware packages that are not in QRadar appliances. Therefore, these packages appear when the tool runs, but have a status of "undetected" and not selected to be updated.

Summary
This firmware update installs IMM firmware version 1.5. Administrators should be aware that IMM v1.5 requires Java version 8 to function properly. If administrators are not on Java version 8 or are unable to install Java version 8, then they might need to postpone this M3 appliance firmware update.

Full Release Notes from Lenovo for firmware 3.0 updates


Change files (.chg) can be opened by any text editor. These files contain the full release notes provided by Lenovo to IBM for both CVEs and resolved issues that administrators might want to review.
Component File name  CVEs resolved in this package
IMM2  ibm_fw_imm_yuooh1c-1.50_linux_32-64 CVE-2015-3200
UEFI/BIOS  ibm_fw_uefi_d6e162a-1.20_linux_32-64 None
DSA  ibm_fw_dsa_dsytc5f-9.53_linux_32-64 None
Server RAID Controller M1015 ibm_fw_sraidmr_1000-20.13.1-0245_linux_32-64 None
ServerRAID Controller H1110 ibm_fw_mpt2sas_h1110-1.20.02_linux_32-64 None
HDD Update  ibm_fw_hdd_sas-1.17.02_linux_32-64 None

NOTE: The \BootableMediaCreatorv9\workingdir\ directory has a historical list of all files that are packaged with the firmware update.

Qradar_1U_M3_MT7944_Qflow_15xxEC_2100_Firmware_Update_1_0.txtQradar_1U_M3_MT7944_Qflow_15xxEC_2100_Firmware_Update_1_0.txt



Where do I find more information?

If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support:

Installing firmware with the IBM Bootable Media Creator (BoMC)


This installation method uses the IBM Bootable media creator (BOMC) tool on a Windows host to create a bootable USB drive that is capable of installing the M3 firmware update for QRadar 1U appliances. The firmware update can take up to 60 minutes for each host. Use a USB drive of 4GB or larger to ensure enough free space to successfully create the bootable media.

You can use the IBM Bootable Media Creator to update the firmware on the following QRadar appliances:

Hardware Details Size
Appliance IBM Security QRadar 2100
IBM Security QFlow Collector 1201
IBM Security QFlow Collector 1202
IBM Security QFlow Collector 1301
IBM Security QFlow Collector 1302
IBM Security Event Collector 1501
1U
Server Type x3550 M3 1U
Server Machine Type 7944 1U
Machine type models (MTM) 4378-Q21
4378-C21
4378-QC2
4378-QD1
4378-QSR
4378-QLR
1U


Before you begin


Creating your USB flash drive for the firmware update requires a Windows host and the administrator or USB drive must be on-site with the appliance. The firmware update can take up to 60 minutes complete per appliance and the administrator will be required to reboot the appliance after the firmware install completes. The firmware upgrade procedures should only be done during a change window or during maintenance time for your QRadar appliances.

**IMPORTANT**: Administrators MUST enable IMM.Over.LAN on the xSeries appliance BEFORE the firmware update is applied. For information on how to enable this setting, see: http://www.ibm.com/support/docview.wss?uid=swg21982944.


Required files
Download the QRadar M3 appliance firmware update (1U form factor appliances) from IBM Fix Central:
http://www.ibm.com/support/fixcentral/swg/quickorder?product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.2.0&platform=Linux&function=fixId&fixids=7.2.0-QRADAR-FIRMWARE-1U-M3-2100-1501-QFlow-1.0∈cludeRequisites=0∈cludeSupersedes=0&downloadMethod=http&source=fc

Preparing

  1. Copy the M3 appliance firmware EXE to a directory on the Windows host.

  2. Double-click on the Qradar_1U_M3_MT7944_Qflow_15xxEC_2100_Firmware_Update_1_0.exe file.

  3. Select or type a directory path for the M3 firmware update and click Extract.


  4. (Click to enlarge image)

    This will create a folder named Extract to path\Qradar_1U_M3_MT7944_Qflow_15xxEC_2100_Firmware_Update_1_0\BootableMediaCreatorv9_64\


Creating your USB key


  1. Navigate to the directory containing the extracted M3 Firmware files.
    For example: C:\Qradar_M3_MT7377_xx05_xx24_Firmware_Update_1_0\BootableMediaCreatorv9_64\

  2. Right-click ibm_utl_bomc_9.64_windows_i386.exe and select Run As Administrator.


    (Click to enlarge image)
    NOTE: Depending on your current permissions, you might be required to type the username and password for the local administrator account.


  3. On the Welcome page, click Next.

  4. IMPORTANT: Do NOT select the Check for the latest version of this tool check box. These instructions are specific to IBM Bootable Media Creator 9.64, which is packaged with the EXE file.

    (Click to enlarge image)

  5. On the Media Purpose page, select the Updates check box and click Next.


  6. (Click to enlarge image)

  7. Select Look in a local directory.


  8. (Click to enlarge image)

    NOTE: The path to the workingdir should be inserted automatically when you select Look in a local directory.
    If the path is not populated, the local directory should be the "Extract to path" M3_test\Qradar_M3_MT7944_Qflow_15xxEC_2100_Firmware_Update_1_0\BootableMediaCreatorv9_64\workingdir.

  9. Ensure that the USB has at least 4 GB of available space for the media format page and that your USB drive is inserted in to the Windows host.
  10. On the Media Format page, select USB as the Device Type, the Disk, select the Write directly to device option, and click Next.


  11. (Click to enlarge image)

  12. Select Do not use unattended mode option when prompted and click Next.


  13. (Click to enlarge image)

  14. Confirm the configuration for the USB drive and click Next.
  15. Important: Do NOT remove the USB device until the bootable media creation displays a notification that the process is complete. You might be prompted to erase the USB drive before you continue.

    (Click to enlarge image)


    (Click to enlarge image)


    RESULTS


    When complete, you are prompted to safely eject the USB drive, click Next, then click Finish.


    (Click to enlarge image)


    (Click to enlarge image)



Updating your QRadar M3 appliance


The instructions below are intended for M3 appliances that are not configured as HA (high-availability) pairs. If your appliance is in a HA pair, you must use the High-Availability update instructions found here: http://www.ibm.com/support/docview.wss?uid=swg21981555.


    Procedure
  1. Insert the USB drive that has the bootable image into the QRadar appliance.

  2. From the terminal of the KVM switch for the appliance, log in by using the root credentials.

  3. From the command prompt, type: reboot.

  4. As the appliance is rebooting, press the F12 key to select a boot device.

  5. Select the bootable firmware image, for example, USB Storage and Press Enter.


  6. Results The IBM ToolsCenter software is booted.


IMPORTANT: Do not remove the USB flash drive until the IBM ToolsCenter completes the firmware installation.

Applying M3 firmware using the IBM Bootable Media Creator Tool

  1. The IBM ToolsCenter Welcome page is displayed.

  2. When prompted, select the Updates option.


  3. (Click to enlarge image)

  4. Verify that the bootable media shows the correct machine type for the appliance.

  5. Hardware Details
    Server Type x3550 M3
    Server Machine Type 7944

    NOTE: The image below is an example, adminsitrators should ensure that x3550 M3 or Machine Type 7944 are displayed below.

    (Click to enlarge image)

  6. To start the update link, select Click here to start update.

  7. Select your language and click I accept the terms in the license agreement to continue.


  8. (Click to enlarge image)

  9. The IBM UpdateXpress System Pack Installer compares the current package with the installed firmware.


  10. (Click to enlarge image)

  11. From the list of selected firmware items, verify that the selected items match the firmware items to update.
  12. NOTE: The image below is an example and the updates installed will be different for each appliance.

    (Click to enlarge image)

  13. To start applying the updates, click Next on the Update Options page.

  14. The updates begin to update software on the M3 appliance.

    (Click to enlarge image)

  15. Verify that all the firmware updates are applied, and click Next to complete the update.


  16. (Click to enlarge image)

  17. After the update is complete, click Save Log to save the installation log to the USB flash drive. This file can be provided to support in case any issues occurred during the update.


  18. (Click to enlarge image)

  19. Select the USB flash drive and click OK.


  20. (Click to enlarge image)

  21. When all updates are complete, click Finish to reboot the appliance.

  22. The appliance reboots and starts up normally.



Where do I find more information?

If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support:

Original publication date

2015/12/14

Document information

More support for: IBM QRadar SIEM
Hardware

Software version: 7.2

Operating system(s): Linux

Reference #: 7047910

Modified date: 20 December 2016