IBM Support

IJ06526: SAR SENTINEL NOTIFICATIONS MESSAGES 'AVERAGE TIME IN MS FOR I/O REQUESTS...' AFTER UPGRADING TO QRADAR 7.3.X

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that after upgrading to QRadar 7.3.X, an
    increased occurence of QRadar 'SAR Sentinel' System
    Notifications referring to 'Average time in ms for I/O requests
    for device...' can sometimes be observed.
    Messages similar to the following can be visible in
    /var/log/qradar.log when this issue is occurring:
    [hostcontext.hostcontext] [Thread-112]
    com.q1labs.hostcontext.sar.SarSentinel: [WARN]
    [NOT:0150124100][127.0.0.1/- -] [-/- -]Average time in ms for
    I/O requests for device storerhel-store has an average of
    2284.9 over the past 5 intervals, and has exceeded the
    configured threshold of 500.0.  To resolve: If your system
    continues to exhibit this behavior, please contact Customer
    Support.
    [hostcontext.hostcontext] [Thread-112]
    com.q1labs.hostcontext.sar.SarSentinel: [WARN]
    [NOT:0150124100][127.0.0.1/- -] [-/- -]Average time in ms for
    I/O requests for device rootrhel-varlog has an average of
    1649.8 over the past 5 intervals, and has exceeded the
    configured threshold of 500.0.  To resolve: If your system
    continues to exhibit this behavior, please contact Customer
    Support.
    [hostcontext.hostcontext] [Thread-112]
    com.q1labs.hostcontext.sar.SarSentinel: [WARN]
    [NOT:0150124100][127.0.0.1/- -] [-/- -]Average time in ms for
    I/O requests for device storerhel-store has an average of
    1719.4 over the past 5 intervals, and has exceeded the
    configured threshold of 500.0.  To resolve: If your system
    continues to exhibit this behavior, please contact Customer
    Support.
    

Local fix

  • SAR Sentinel messages, generated as detailed in the examples
    above, have been determined to be caused by changes in code
    that are included within versions 7.3.X+ of QRadar and/or the
    underlying Operating System.  SAR Sentinel messages generated
    as above and containing 'Average time in ms for I/O requests
    for device...' are deemed to be benign and can be safely
    ignored.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.3.2 Patch 3.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.3.2 Patch 3.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ06526

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    730

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-05-18

  • Closed date

    2019-07-26

  • Last modified date

    2019-07-26

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"730","Edition":""}]

Document Information

Modified date:
26 July 2019