000014569 - The default kernel in the grub boot loader configuration is not the latest on an RSA Security Analytics appliance

In order to resolve the issue, a small tool called 'grubby-wrapper' has been written to make changes to grub.conf in the most automated manner possible. This tool can find the most recent kernel available on your system (when invoked with -d) and update grub.conf automatically so that it will be started on the next system boot.

The -i option is suggested if you are uncertain about making this change; this causes the tool to run interactively. In interactive mode, grubby-wrapper will collect all necessary information as usual, then pause just before making any changes and provide you the opportunity to exit the tool early.

To use this tool, first download the attached archive from this article.  It is then necessary to transfer it to the target appliance with the scp or sftp protocol, or your preferred FTP client.

Unpack the containing archive (grubby-wrapper-2.0.1.3.tar.gz) with this command, executed from the directory where you stored it:

tar -zxvf grubby-wrapper-2.0.1.3.tar.gz

Invoke the script with this command, followed by at least one parameter.

./grubby-wrapper-2.0.1.3.sh

The script must either receive -d to operate in default mode or else -k [kernel version]. If it does not receive any parameters or if it receives incorrect parameters, it will refer you to inline help (-h). So, for example, either:

./grubby-wrapper-2.0.1.3.sh -d

...or else -k followed by the desired kernel version:

./grubby-wrapper-2.0.1.3.sh -k 2.6.32-431.29.2.el6.x86_64

Do not invoke the script with both -d and -k flags, or undesired results may occur.

./grubby-wrapper-2.0.1.3.sh -h

Once the changes have been made, a reboot will be required. Please consult the final output from grubby-wrapper for details.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Warning:
Although grubby-wrapper performs exhaustive sanity checks to ensure that all candidate kernel images must exist and be valid; must have accompanying, valid initramfs filesystem images; must be installed via RPM; must match integrity checksums stored in the RPM database; and other considerations, it is still theoretically possible to render your system at least temporarily un-bootable. The tool will encourage you to review the resulting grub.conf visually before rebooting your system. This is strongly encouraged.

If you find that you cannot boot the resulting kernel entry after running grubby-wrapper, you should still be able to boot the previous version. By default, this backup boot entry is simply called Boot.