Technical Tip: FortiSIEM OS update completes successfully but the system continues to boot the previous Rocky Linux kernel

Description

This article describes an issue where, after performing a FortiSIEM OS Update, the upgrade process may complete successfully and install the latest Rocky Linux kernel packages. However, after rebooting, the system may continue running the previous kernel version.

This can result in HA nodes (or single nodes) reporting different kernel versions even though the same FortiSIEM OS update procedure was followed successfully.

Scope

FortiSIEM v7.x+.

Solution

1. Verify the running kernel.

Check the currently running kernel:

uname -r

Verify the installed kernel packages:

rpm -qa | grep kernel | sort

Check the default kernel configured by GRUB:

grubby --default-kernel
grubby --info=ALL

2. Verify the boot partition.

Ensure the boot partition has sufficient space and contains the expected kernel files.

df -h /boot
df -i /boot
ls -lh /boot
ls /boot/initramfs*

3. Determine the boot mode.

Identify whether the system is booting using BIOS or UEFI.

[ -d /sys/firmware/efi ] && echo UEFI || echo BIOS

If the system is using UEFI, also collect:

efibootmgr -v

4. Verify which kernel GRUB intends to boot.

Collect the following information:

grub2-editenv list
journalctl -b | head -20
cat /proc/cmdline

If:

• grubby --default-kernel points to the newer kernel,

• But uname -r and /proc/cmdline still show the previous kernel, then the bootloader is not loading the intended GRUB menu entry.

5. Inspect the GRUB configuration.

Verify the current GRUB configuration:

grubby --default-index
grep "^menuentry" /boot/grub2/grub.cfg
grep "^set default" /boot/grub2/grub.cfg
ls -l /boot/grub2/grub.cfg
grub2-mkconfig --version

Pay particular attention to the order of the menuentry entries.

If the older kernel appears as the first menuentry, the system may continue booting it even though the GRUB saved entry points to the newer kernel.

6. Regenerate the GRUB configuration.

Back up the existing configuration:

cp -a /boot/grub2/grub.cfg /boot/grub2/grub.cfg.bak

Generate a new GRUB configuration:

grub2-mkconfig -o /boot/grub2/grub.cfg

Reboot the server.

7. Confirm the active kernel after reboot.

After rebooting, verify that the system is running the intended kernel.

uname -r
cat /proc/cmdline

The running kernel should now match the latest installed kernel version.