Description

The STRM system comes with pre-installed software. At times, it is necessary to upgrade or downgrade the appliance to a specific version or to reimage the system to factory defaults. This article provides a procedure to do so.

Symptoms

This article describes how to reinstall from the recovery partition to any major version of code.

Solution

Note :

  • This procedure is to be used to reimage the STRM device. This will wipe out all the data and restore the device to factory defaults. 

  • This procedure should be used on STRM devices that already have the /recovery partition installed.

Run the command # cat /etc/fstab from the CLI of the STRM device and check if you have the /recovery partition present.

Sample output:

[root@strm ~]# cat /etc/fstab
LABEL=/ / ext3 noatime 1 1
LABEL=/recovery /recovery ext3 noauto 1 2
LABEL=/var/log /var/log ext3 noatime 1 2
LABEL=/boot /boot ext3 defaults 1 2
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
LABEL=SWAP-sda7 swap swap defaults 0 0
/dev/sda8 /store ext3 noatime 0 0
LABEL=/store/tmp1 /store/tmp ext3 noatime 1 2
[root@strm ~]#

If you do not have a recovery partition installed (STRM 2009.1 and earlier), perform the procedure in the ADD-RECOVERY-REINSTALLINGSTRM technical note to install the recovery partition, and then continue with the following procedure.

Log in to the STRM Console and perform the following procedure to reimage the STRM device:

  1. Copy the recovery.py script via SCP to the STRM appliance. By default, if you do not specify a location, this will be downloaded to the /root directory.

    1. To reimage or clean install to STRM 2012.1.R1, download the recovery partition from the following link: https://download.juniper.net/software/strm/2012.1/recovery.zip    
    2. To reimage an existing STRM 2013.x installation, the recovery script can be found on the box in /opt/qradar/bin . (It would be easier to perform a factory reset for this scenario, assuming 2013 is already in the recovery partition.)
    3. If you are running a different version from 2013 and are planning to go to 2013, you will need to extract the script from the 2013 ISO and use that:
      1. # mount -o loop <2013 ISO image> /media/cdrom
      2. # cp /media/cdrom/post/recovery.py /tmp/recovery.py
  2. Download the ISO image from the Juniper Download site (either STRM 2009.1 or later).

  3. Copy the new ISO - <iso_file_name> via SCP to the target STRM Appliance.

  4. Log in to the STRM via a serial console connection and run the following commands:
# gunzip recovery.py.gz
# Chmod 755 recovery.py

For versions 2012.1R1 and later where RedHat is running, also run: # ./recovery.py -u

# ./recovery.py -r --default --reboot <iso_file_name>

The following output will be displayed within the command line:

[root@vmb63 ~]# ./recovery.py -r --default --reboot STRM2009.1.iso
INFO :copying CentOS564STRM2009_2_0_148034.iso to /recovery/iso
INFO :Found iso /recovery/iso/CentOS564STRM2009_2_0_148034.iso as Security Threat Response Manager 2009.2.0.148034
INFO :Wrote new grub.cfg
INFO :Shutting down services to enable repartitioning disk
INFO :Converting partition table to required format
INFO :About to reboot
INFO :Press enter when ready
  1. Press Enter when prompted to reboot the system. The system restarts and enters the reinstall menu.

  2. When prompted to flatten the system, type flatten and press Enter .

  3. The normal install process proceeds.

After the installation, the STRM device will have the image.