QRadar SIEM 7.3.0 P6 with IF1 The deployment_info.sh script will not properly execute the commands that return the values for each column header in my deployment. Manually executing each command for each column works just fine individually, but something about the way it's being deployed in a column (function addColumn) or to the csv is catching and failing silently. Is there an updated version of this script out there that I may be able to try? -v returns v0.5 in my environment.
Answer by Chris Fredericks (IBM) (262) | Jun 21, 2018 at 01:18 PM
Hi Tyler,
A recent change to a script it depends on (all_servers.sh) resulted in a temporary file being written to a new directory. A fix is on its way via autoupdates but in the meantime you can fix it on your own system by running:
sed -i -e's/\/tmp\//\/storetmp\//' /opt/qradar/support/deployment_info.sh
That was it! I discovered that issue in a separate investigation but didn't occur to me to correlate the two. Thanks a bunch!