IBM Support

QRadar: How to keep a heap dump file from hanging a system patch or upgrade (APAR IJ31074)

How To


Heap files are created when an out of memory issue occurs. These files can be large and take up valuable disk space. If there are too many core dump files, the check for heap dumps during the patch or upgrade can take an extended amount of time. The result is a patch or upgrade can appear as if it is hung. When this happens a similar message is displayed (patchmode) Updating: systemd-219-78.el7.x86_64.

This article addresses steps to resolve this issue.


Refer to: APAR IJ31074 for information on QRADAR PATCHING PROCESS CAN HANG AT MESSAGE "UPDATING : SYSTEMD-219-78.EL7.X86_64"
  1. Use SSH to log in to the QRadar Console as root user.
  2. If the out of memory issue occurred on a manage host, use an SSH session to connect to that host.
  3. Type the command:
    ls -lath /store/jheap/*
  4. Look for files that are larger than 6 kb and contains the extensions .core, .dmp, or tar.gz
  5. If the heap is not current, you can either remove the file or move it. To move the file:
    1. Create a backup folder:
      mkdir -p /store/IBM_Support
    2. Move the all heap dump file to /store/IBM_Support, for example:
      ​mv /store/jheap/accumulator.accumulator/*.tar.gz /store/IBM_Support
      mv /store/jheap/accumulator.accumulator/*.dmp /store/IBM_Support
      mv /store/jheap/accumulator.accumulator/*.core /store/IBM_Support
Results The patch or upgrade can proceed without the system hang issue from heap dump files.

Document Location


[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
30 November 2021