QRadar: Upgrades to V7.5.0 UP2 can reduce available SCA search threads (IJ40606)

Resolving The Problem

1. Use SSH to log in to the Console as the root user.
2. Create a new file named IJ40606.sh with the command:

   touch /root/IJ40606.sh

3. Using an editor such as vi add the following to the IJ40606.sh file:

   #!/bin/bash
   SERVER_CPUS=$(lscpu | grep "^CPU(s)" | sed "s/.* //")
   if [[ $SERVER_CPUS == +([0-9]) ]] 
     then 
     SCA_THREADS=$(((299 + 22*SERVER_CPUS) / 30)) 
     SERVER_INI=/store/dca/server.ini
     sed -i "/\[threads\]/{n;s/.*/$SCA_THREADS/}" $SERVER_INI
     grep -A1 "\[threads\]" $SERVER_INI
     if systemctl -q is-active scaserver
     then 
       systemctl restart scaserver
     fi 
   fi  
   

4. Make the script executable with the command:

   chmod +x /root/IJ40606.sh

5. Transfer the script to all managed hosts with the command:

   /opt/qradar/support/all_servers.sh -C -p /root/IJ40606.sh

6. run the script on all hosts with the command (this will restart the scaserver service on all hosts):

   /opt/qradar/support/all_servers.sh -C "/storetmp/IJ40606.sh; rm -f /storetmp/IJ40606.sh"

7. Wait for the command prompt to return.
   
   Results
   All appliances in the deployment are updated with new values. To verify the SCA server thread value is updated, administrators can SSH to an appliance and type the following command to confirm the value shows greater than 15 assigned threads:

   cat /store/dca/server.ini

   If you are unsure of any steps outlined in this technical note or need assistance with the workaround, contact QRadar Support.