IBM Support

QRadar: PCAP capture can have problems loading new licenses when /extraction1 partition is at 100%

Troubleshooting


Problem

When attempting to start capturing packets on a PCAP device, it might not pass the Ramping Up status.

Cause

It has been seen that having partition /extraction1 at 100% of the capacity may cause problems updating the license.

Resolving The Problem

However, if after attempting to reload the license key the issue persist it has been seen that having partition /extraction1 at 100% capacity prevents the license from being correctly loaded.

Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
50G 3.3G 44G 8% /
tmpfs 64G 56K 64G 1% /dev/shm
/dev/sda1 477M 27M 425M 6% /boot
/dev/mapper/VolGroup-lv_home
73G 281M 69G 1% /home
/dev/sdc 37T 819G 36T 3% /storage0
/dev/sdb1 3.5T 12G 3.3T 1% /extraction1


In that case, make sure you free some space from the /extraction1 partition, move any files older than the ones on the /storage0 partition to an external source.

Once space is available on /extraction1, attempt to update the license key again and start capture.

Should you require help with this maintenance process please contact QRadar Support.

For more information look at this Article IBM PCAP appliance stops capturing after 10 minutes


Where do you find more information?




[{"Product":{"code":"SSMU35","label":"IBM QRadar Network Packet Capture Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Licensing","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 October 2020

UID

swg22002544