Troubleshooting
Problem
Large core files in the /opt/qradar/dca directory result in disk space problems in the / (root) partition.
Cause
When you investigate disk space problems with the / partition, you can find many core files in the
/opt/qradar/dca directory that use excessive disk space. These core files are created by X-Force premium feed updates.Resolving The Problem
These core files are not needed for the operation of QRadar. They are created by the X-Force premium feed update process and exist for diagnostic purposes. If their timestamps are recent, their presence can indicate an ongoing problem with your X-Force premium feed, and it is necessary to investigate why they are created. You can review the timestamps by connecting to your console appliance and listing them.
- SSH in to your QRadar console.
- Go to the
/opt/qradar/dca directorycd /opt/qradar/dca - List the core files.
ls -alh core*
Results
If you see problems with the X-Force premium updates contact support. If the files are old enough not to warrant further investigation, they can be deleted to relieve the space issues on your disk.
Example output:-rw------- 1 root root 542M Aug 4 08:01 core.11655 -rw------- 1 root root 526M Aug 3 08:00 core.11831 -rw------- 1 root root 509M Aug 8 08:01 core.12054 -rw------- 1 root root 456M Aug 2 12:17 core.12569 -rw------- 1 root root 507M Aug 3 18:07 core.16079 -rw------- 1 root root 507M Aug 4 18:07 core.17543 -rw------- 1 root root 506M Aug 2 18:07 core.4012
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
28 October 2022
UID
swg21994799