page-brochureware.php

QRadar Support – Disk Space 101

QRadar Support Team technical resolutions to common problems with high and full disk space usage, troubleshooting articles, and defects encountered on QRadar partitions.


High disk usage or disk is full?

QRadar has two different partition tables based on the QRadar version, 7.2.x vs 7.3.x, that would determine the starting point for the troubleshooting process. By default, the QRadar disk sentry check runs every 60 seconds and looks for high disk usage across the QRadar partitions. If any of these partitions exceed 90% usage, a warning notification is sent to the UI. For the partitions critical to system functionality, if the partition usage grows above 95%, system services will be stopped to avoid the partition becoming completely full and possibly causing further issues. For more information on how to find files that take the most space, see below technote.

 

Partition requirements and recommendations

The partition requirements and recommendations revolve around two main topics that affect the partition sizing; installing QRadar on your own hardware (so called “software install”) and upgrades from 7.2.x to 7.3.x which repartitions the system. For a QRadar installation on a QRadar appliance, the installation script automatically partitions the space and no user input is required.

 

How to resolve disk space usage problems for…

“/opt” partition

The /opt partition houses add-on application data, such as tomcat, QRM, QVM, and so on. The most common issues for this partition are centered around partition resizing during upgrade, logrotate failing to run, core files, and other vary files that can be removed.

“/var/log” partition

The /var/log partition is a storage area for QRadar and system log files. Some of the logs on this partition are qradar.log, qradar.error, qradar-ha.log, messages, and httpd.log. The most common issues are caused by unrotated files in /var/log/qradar.old/ directory and the failure of logrotate to run

“/transient” or “/store/transient” partition

The /transient (in 7.3.x) or /store/transient (in 7.2.8) partition is the location that stores ariel cursors for searches and generated reports data. The most common issue is the /transient/ariel_proxy.ariel_proxy_server/data/ directory filling up due to several large, or lots of small, search_id.data files

“/storetmp” or “/store/tmp” partition

The /storetmp (in 7.3.x) or /store/tmp (in 7.2.8) partition is a temporary location used to store configuration files, used by the various processes in QRadar. This partition is the first option recommended to be used when copying an upgrade SFS file to a QRadar system.

“/” partition

By far, the most common cause for the “/” partition filling up, is when a particular file system (e.g. remote nfs partition that is full or unavailable) is not available when a file (e.g. backup file) is needing to be written to, it may end up being written to “/” directory which could lead to partition space exceeding the threshold of 95% and stopping critical services.

“/store” partition

The /store partition holds all the events and flow data on the system, as well as the default location for backups. The most common issues for /store revolve around backup files or retention policies

Watch the Maintaining QRadar 101 Open Mic

During this session we talk Maintaining QRadar overall, system notifications, troubleshooting tips, and starting with minute 5 of the presentation, the host is discussing the daily review of space usage, troubleshooting and tips around this topic. For a list of previous open mic sessions, see the full open mic list here.

IBM prides itself on delivering world class software support with highly skilled, customer-focused people. QRadar Support is available 24×7 for all high severity issues. For QRadar resources, technical help, guidance, and information see our QRadar Support 101 pages.