NetWitness Upgrade Precheck - Multiple Kernel Package problems during the OS-Migration checklist

Issue

The NetWitness Upgrade Precheck probe will give multiple versions of kernel-devel packages are found and output as below

Multiple kernel-devel Package Check Failed KB-TBD Multiple kernel-devel packages found at ['< node-id's >'].Please remove the older versions

Cause

The issue occurs when there are multiple versions or old kernel-devel packages installed in a Network Decoder and/or Network Hybrid

Resolution

Using the Node-ID from the probe output run the following steps:

1. Run the following command (from Admin node) to manually check for all kernel-devel packages installed in the node-x mentioned in the output:

  # salt <node-ID> cmd.run 'rpm -qa kernel-devel'
 

where is the node-ID mentioned in the precheck tool probe output within [''] .

Screenshot below:

2. Run the following command (from Admin node) to display the latest version of kernel-devel package in the node-x mentioned in the output:

 # salt <node-ID> cmd.run 'rpm -qa kernel-devel | sort -V | tail -n 1'

Screenshot below:

NetWitness Upgrade Precheck - Multiple Kernel Package problems during the OS-Migration checklist

3. SSH to the Node-X from the probe output using its IP or FQDN.

If you are unsure what is the IP of the Node-X from the probe, run the following command from NwAdmin Node.

  # salt <node-ID> network.ip_addrs em1
 

4. Run the following command to remove all versions of kernel-devel EXCEPT the latest version from the node-x mentioned in the output:

 # yum remove $(rpm -qa kernel-devel | sort -V | sed '$d')
 

Press ‘y’ after checking the list of packages that are about to be removed.
Screenshot below with a portion of the output:

NOTE: This step (4) MUST be done from the Node-X from the probe output, NOT from the Admin node.

Product Details

Product Set: NetWitness Platform
Product/Service Type: Network Decoder and Network Hybrid
Version/Condition: 12.4 or later
Platform: Alma Linux

Summary

This document outlines the procedure to fix multiple versions of kernel-devel package issue

Approval Reviewer Queue

Technical approval queue