IBM Support

QRadar: Techniques to Reduce Used Storage

Question & Answer


Question

How can I reduce the amount of storage used?

Answer

The following are items that can be taken into consideration when attempting to reduce the amount of storage used:
 

Forced Deletion of Data Outside Retention Requirements:


As data is collected on QRadar, it is stored on disk. If you can enable the option on your retention requirements, to delete data that is outside your retention window.

 

Use Retention Buckets to Partition Data:


Using multiple Retention Buckets, will allow you to partition, or segregate data into multiple containers. These containers can then be configured with specific retention, deletion options. For example, if you have a number of log sources that generate a lot of data, but you only need to keep them for short periods of time, you could put them into a retention bucket with a force-delete option of the time you need. Proxy logs are examples of this, that some users may decide to force-delete after a period of 1 week, allowing other data to remain on disk for a longer period of time.  
Conversely, you may want to keep a particular set of data for a longer period of time, such as compliance systems, for up to a year. If the rest of your data could be deleted after a month, this would allow you more space to keep that longer term data, thus again, using less space overall.

 

Disable Unused Indexes:


Data on disk is indexed across multiple properties, approximately 15 which are enabled by default. If you are not using those indexes often for searches, you may want to disable them in Index Management, to reduce both disk space utilization, and IO cycles used to write them as data is collected.

 

Adjust Quick Search Index:


The Quick Search Index is a full text index of all data received by QRadar, and is kept for 30 days by default. If during your use of this index, you are often limited to searching only the last weeks worth of information, you may want to reduce the retention of this index. The size depends on the variety of data, but on average, will increase usage by about 40% for the time period kept. For example, if your data collected in a day was 100GB in size (raw records), the Quick Search Index for that would be approximately 40GB per day, in addition to the 100GB collected.

Related Information:

QRadar: The Impacts of Storage Hardware Speed

[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Hardware","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
20 October 2022

UID

swg21993401