IBM Support

QRadar: Core files using disk space



Large core files in the /opt/qradar/dca directory result in disk space problems in the / (root) partition.


When you investigate disk space problems with the / partition, you can find many core files in the /opt/qradar/dca directory that use excessive disk space. These core files are created by X-Force premium feed updates.

Resolving The Problem

These core files are not needed for the operation of QRadar. They are created by the X-Force premium feed update process and exist for diagnostic purposes. If their timestamps are recent, their presence can indicate an ongoing problem with your X-Force premium feed, and it is necessary to investigate why they are created. You can review the timestamps by connecting to your console appliance and listing them.
  1. SSH in to your QRadar console.
  2. Go to the /opt/qradar/dca directory
    cd /opt/qradar/dca
  3. List the core files.
    ls -alh core*

    If you see problems with the X-Force premium updates contact support. If the files are old enough not to warrant further investigation, they can be deleted to relieve the space issues on your disk.
    Example output:
    -rw------- 1 root root 542M Aug  4 08:01 core.11655
    -rw------- 1 root root 526M Aug  3 08:00 core.11831
    -rw------- 1 root root 509M Aug  8 08:01 core.12054
    -rw------- 1 root root 456M Aug  2 12:17 core.12569
    -rw------- 1 root root 507M Aug  3 18:07 core.16079
    -rw------- 1 root root 507M Aug  4 18:07 core.17543
    -rw------- 1 root root 506M Aug  2 18:07 core.4012

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
28 October 2022