Resolving limited disk space for backup partitions

A system notification appears because the destination file system has limited disk space. IBM® QRadar® cannot complete a backup with insufficient disk space.

You might receive the following system notification:

Backup: Not enough free disk space to perform backup.

System notifications about limited disk space occur when free space in the /store/backup/ partition is less than double the last backup file size. Limited disk space results from the volume of data and your backup retention period settings. For more information, see the IBM QRadar Administration Guide.

When you configure the retention bucket storage settings, a global impact occurs on the storage across your QRadar deployment.

Disk usage warnings can occur on the QRadar Console or any managed host in your QRadar deployment. To check disk usage levels, review the monitored partitions on your QRadar Console or managed hosts.

Procedure

  1. Verify backup partition disk levels.
    1. Use SSH to log in to QRadar Console or the managed host.
    2. Type the following command:

      df -PTh /store/backup

  2. Review the backup partition to check the disk utilization levels.
    1. If the backup partition is greater than double the last backup file size, identify the location of your backup.
      • If your backup is on the same file system as the /store/ariel directory, move it to another storage system.
      • If your backup is external, check your usage and ensure that your backup retention period does not require more space than you have available.
    2. Reduce disk usage on the /store file system.
      • Consider increasing your external storage size by using an offboard storage solution such as iSCSI or Fibre Channel. For more information, see the Offboard Storage Guide.
      • If your QRadar backup partition is mounted on an NFS share, try lowering the retention period for the backup. The default backup retention period is two days. For more information on configuring backup retention periods, see the IBM QRadar Administration Guide.