The upgrade for the managed hosts from 7.5.0 UP9 to 7.5.0 UP11 IF04 fails with the below errors.
Upgrade path: 7.5.0 up11 to 7.5.0 up 11 IF04
Console (1.1.1.2) - Patch Successful - 100% Complete
Host (1.1.1.3) - Patch Successful (with Errors) - 100% Complete
Host (1.1.1.4) - Patch Successful (with Errors) - 100% Complete
Host (1.1.1.5) - Patch Successful (with Errors) - 100% Complete
Below erros can be seen in the /var/log/setup-x.x.x.x/patches.log
After investigating the affected hosts we were able to see that all of them had the 7.5.0 UP11 IF04 version installed, and all services were running:
/opt/qradar/bin/myver -v
Core version is '2021.6.11.20250122185136'
Interim fix number is '04'
Latest version is '2021.6.11.20250122185136'
Release name is '7.5.0 UpdatePackage 11'
/opt/qradar/upgrade/util/setup/upgrades/wait_for_start.sh
+-----------------+-------+-------+
|Process |Seconds|Status |
|scaserver |0 |running|
|accumulator |0 |running|
|ariel |1 |running|
|vis731 |1 |running|
|ecs-ep |1 |running|
|ecs-ec |1 |running|
|ecs-ec-ingress |1 |running|
|offline_forwarder|1 |running|
|hostcontext |1 |running|
All 9 managed processes are running.
Nonetheless, the connection from the managed hosts to the tomcat service on the console was not getting established.
[[email protected] ~]# /opt/qradar/bin/test_tomcat_connection.sh
Starting up...
Unable connect to the tomcat
After further investigation, we noticed this was due to the below error in the /var/log/qradar.log file.
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] Caused by:
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] java.io.EOFException: SSL peer shut down incorrectly
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] at com.ibm.jsse2.ak.a(ak.java:52)
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] at com.ibm.jsse2.ak.g(ak.java:68)
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] at com.ibm.jsse2.ak.b(ak.java:63)
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] at com.ibm.jsse2.a3.a(a3.java:18)
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] at com.ibm.jsse2.bn.b(bn.java:64)
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] ... 14 more
May 29 10:27:49 ::ffff:127.0.0.1 [test_tomcat_connection] [main] com.q1labs.core.shared.jsonrpc.RPC: [ERROR] [NOT:0000003000][1.1.1.2/- -] [-/- -]SSL peer shut down incorrectly
In order to correct the above error, we restarted the HTTPS tunnel between the console and the MH:
[[email protected] tunnels]# cat managed-tunnel@1121095614981527508
BindAddress = "localhost"
Component = "tunnelhttps--SetupTunnel"
Compression = false
CompressionOption = "no"
DestinationHost = "localhost"
DestinationPort = 443
Direction = "remote"
DirectionFlag = "-R"
RemoteHost = "1.1.1.2"
RemoteUser = "root"
SourcePort = 443
Action Taken:
[[email protected] tunnels]# systemctl status managed-tunnel@1121095614981527508
● [email protected] - SSH tunnel created and managed by the Tunnel Manager service
Loaded: loaded (/etc/systemd/system/[email protected]; static; vendor preset: disabled)
Active: active (running) since Wed 2025-05-28 11:32:24 EDT; 23h ago
Main PID: 2655381 (ssh)
Tasks: 1 (limit: 821303)
Memory: 1.4M
CGroup: /system.slice/system-managed\x2dtunnel.slice/[email protected]
└─2655381 /usr/bin/ssh -N -T -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -o Compression=no -R localhost:443:localhost:443 [email protected]
May 29 10:35:05 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:10 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:11 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:15 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:17 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:21 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:31 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:32 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
May 29 10:35:39 1.1.1.1 ssh[2655381]: connect_to localhost port 443: failed.
[[email protected] tunnels]# systemctl restart managed-tunnel@1121095614981527508
Active: active (running) since Thu 2025-05-29 11:14:33 EDT; 11s ago
Main PID: 3662285 (ssh)
Memory: 956.0K
└─3662285 /usr/bin/ssh -N -T -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -o Compression=no -R localhost:443:localhost:443 [email protected]
May 29 11:14:33 1.1.1.1 systemd[1]: Started SSH tunnel created and managed by the Tunnel Manager service.
[[email protected] tunnels]#