Upgrading QRadar deployments

IBM QRadar releases major version upgrades once a year and minor upgrades every quarter. The minor upgrades are also called Fix Packs or Upgrade Packs, depending on which version of QRadar you are upgrading. Major version upgrades usually arise with changes to operating system kernels, and QRadar may require a reboot after or during the upgrade. If minor upgrades also contain OS updates, a restart may also be required for minor upgrades. If QRadar Support encounters any defects and they need to be backported to an older version, Intermediate Fixes (IFs) are usually released. These IFs are version-dependent. So before installing any updates, always go through the release notes for that version.

Many times, the estimated load on QRadar in terms of events and flows processed may increase. This happens when more devices are boarded in the customer environment – for example, multiple firewalls installed, many web servers added, and networking devices...