IBM QRadar CE required IDE to boot

[Joris L.]

After spending a sickly amount of time trying to figure out why the VM would not boot, i found a reddit post stating switching to IDE would work. It does. Despite not being an expert at LInux or grub or dracut or qemu, i do not see how to explain this.

The software can be found here. https://developer.ibm.com/qradar/ce/

The commands i used after having downloaded the OVA.

tar -xf QRadarCE733GA_V1_0.ova
qm importovf 100 QCE-jan22.ovf local-zfs

 

[wolfgang]

Hi,

I don't know this software appliance, but I know that many software appliance builders assume fixed storage paths.
In Linux ide has default /dev/hb<X>
scsi got /dev/sd<X> and virtio /dev/vd<X>

 

[Joris L.]

hey Wolfgang,

Good point. I will check. The reason this has me posting on the forum is i assume having to select IDE may adversly affect performance.

br

J.

 

[wolfgang]

You are correct IDE emulation mode is not as fast as Virtio or SCSI and only for legacy system support.

 

[Joris L.]

Thanks. I was once being convinced by sales-tech in a VM such does not matter too much since it is all virtual anyway.

 

[malnaim]

Hello Every one my English is not good so bare with me ,
I installed Qradar CE successfully in Proxmox , What I did :

1. Create VM for Exporting Qradar ISO Image *** This VM will be deleted later *** with Intel NIC :
   1. Detach HDD
   2. Delete HDD
   3. Extract Qradar OVA ( Important : one of the extracted files will be an ISO it is regular Cent OS) tar -xvf QRadarCE733GA_v1_0.ova
   4. Import the vmdk to the VM ( qm importdisk <VM ID> QCE-jan22-disk1.vmdk <Storage ID> )
   5. Attach HDD with IDE .
   6. Start VM
   7. Enter the console login to the qradar vm and give the VM an Static IP $ nmtui
   8. Go to qradar ISO file ( cd /opt/ibm/cloud/iso/ ) you will find a ISO image QRadarCE2019_14_0_20191031163225.GA.iso
   9. Copy the ISO image to the proxmox host ( scp QRadarCE2019_14_0_20191031163225.GA.iso root@<Proxmox-IP>:~/ )
   10. Copy the ISO image to you iso template folder .
   11. Delete the VM .
2. Create VM for Qradar This is the one we will use for Qradar With at lease the Minimum requirement for Qradar mine 4 CPU 4 Core 64 GB RAM 250 GB HDD :
   1. Install Centos 7 virto HDD and virto NIC.
   2. Install qemu-guest-agent .
   3. Update everything
   4. Reboot .
   5. Insert the ISO QRadarCE2019_14_0_20191031163225.GA.iso in to the Qradar VM
   6. Now I used this link tutorial http://zrubi.hu/en/2019/qradar-ce-install/ to install Qradar in to Centos 7 you can check the link or continue with me .
   7. check the relese file ( cat /etc/redhat-release) mine was 7.8.2003 .
   8. Now change the release file from your version of centos to 7.5 ( sed -i 's/7\.8\.2003/7\.5\.1804/' /etc/redhat-release && cat /etc/redhat-release)
   9. Disable SELinux ( sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config && cat /etc/selinux/config)
   10. Disable IPv6 (echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf)
   11. reboot
   12. Create a directory cdrom in /media if you dont have it ( mkdir /media/cdrom )
   13. mount Qradar crom VM CDROM (mount /dev/cdrom /media/cdrom)
   14. Go to cdrom dirictory (cd /media/cdrom/ )
   15. Run the setup (./setup --no-screen --accept-eula) it could take up to 30 minutes *** Important must have internet ***
   16. Reset the Qradar Console password ( /opt/qradar/support/changePasswd.sh -a)
   17. Reboot *** Important It could take up to 10~15 Minutes for each reboot in Qradar ***

 

[Max Arya]

HI ,
Check below two links i hope you will get solution;

https://www.ibm.com/community/qradar/ce/

https://kifarunix.com/how-to-install-ibm-qradar-ce-v7-3-1-on-virtualbox/

If you still feel you need some sort of IBM Qradar project support or IBM Qradar Training do reach us.

https://www.maxmunus.com/page/IBM-QRadar-SIEM-Training