Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?

Question

Options

• A/var/log/qradar.audit
• B/var/log/qradar.log
• C/var/log/setup-*/patches.log
• D/var/log/upgrade.log

• A
  9% (4)
• B
  7% (3)
• C
  80% (36)
• D
  4% (2)

Explanation

During a QRadar upgrade, patch installers write their execution details - including prerequisite checks, failures, and skip reasons - to /var/log/setup-*/patches.log, where the wildcard represents the specific upgrade session directory; this is the purpose-built location for patch-level installer diagnostics. Option A (qradar.audit) records user and system activity for compliance/auditing purposes, not installer mechanics. Option B (qradar.log) is the general application log for runtime events, not upgrade patch behavior. Option D (upgrade.log) sounds plausible but is not a standard QRadar log path - it's a common distractor leveraging the word "upgrade."

Memory tip: Think "patches need a setup directory" - the setup-* glob is your clue that QRadar creates a timestamped setup folder per upgrade run, and patches.log inside it is where each patch installer records why it proceeded or stopped.

No community discussion yet for this question.