Troubleshooting
Problem
The dashboard displays a disk storage issue message that the partition on the server is not available.
Symptom
The dashboard displays an error notification that states a partition is not available. The following notification message is displayed in /var/log/qradar.error file:
::ffff:x.x.x.x [hostcontext.hostcontext][94228df2-b970-4a76-ac49-39030ad53d09/SequentialEventDispatcher]com.q1labs.hostcontext.ds.DiskSpaceSentinel: [WARN][NOT:0000004000][x.x.x.x/- -] [-/- -]Partition tester thread did not complete -- attempting to interrupt. The storage mounted at/store/transient did not respond within 30 seconds. If this latency is expected, you can increase this time interval through the System Settings
::ffff:x.x.x.x [hostcontext.hostcontext][94228df2-b970-4a76-ac49-39030ad53d09/SequentialEventDispatcher]com.q1labs.hostcontext.ds.DiskSpaceSentinel: [WARN][NOT:0000004000][x.x.x.x/- -] [-/- -]Partition tester thread did not complete -- attempting to interrupt. The storage mounted at /store/tmp did not respond within 30 seconds. If this latency is expected, you can increase this time interval through the System Settings
::ffff:x.x.x.x [hostcontext.hostcontext][94228df2-b970-4a76-ac49-39030ad53d09/SequentialEventDispatcher]com.q1labs.hostcontext.ds.DiskSpaceSentinel: [ERROR][NOT:0150062100][x.x.x.x/- -] [-/- -]The storage partition(s) /var/log, /store/transient, /store/tmp on QRADAR-MH (x.x.x.x) are not currently accessible. Manual intervention may be required to restore normal operation
Cause
The error can be caused by the following issues:
- Network latency between Managed Hosts and Console
- High writing to disk through Offboard storage
Resolving The Problem
The error occurs because of the default value set in Partition Tester threshold (30 seconds). In certain circumstances, the default value is not enough, and the partition testing fails. However, if you immediately find the following message, then there is no real impact on the device, and you can increase the threshold on the partition tester.
Perform the following steps to increase the threshold on the partition tester:
After you increase the threshold, check the following:
::ffff:x.x.x.x [hostcontext.hostcontext][94228df2-b970-4a76-ac49-39030ad53d09/SequentialEventDispatcher]com.q1labs.hostcontext.ds.DiskSpaceSentinel: [ERROR][NOT:0150066101][x.x.x.x/- -] [-/- -]The storage partition(s) /var/log, /store/transient, /store/tmp on QRADAR-MH(x.x.x.x) are now accessible.
Perform the following steps to increase the threshold on the partition tester:
- Log in to the QRadar user interface
- Click Admin tab > System Settings
- Click Switch to Advanced > System Settings
- Find Partition Tester Timeout (seconds) and change it to 60 seconds.
After you increase the threshold, check the following:
- Network latency between appliances and the console
- Whether /store is mounted to an Offboard storage device such as an ISCSI or a Fibre channel storage
Result
Increasing threshold on the partition tester resolves this issue. If you still see the issue, contact IBM Support.
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
20 June 2023
UID
swg22001602