Accumulator issues are caused by searches that are not properly tuned or too many global views in the system. By default, we allow a maximum of 300 Global Views in 7.3.x and later versions.
The reason No reference entries occur is because when a GV ID is missing the references list inside its VirtualView section, or when the VirtualView is corrupted during the mapping process. At times, when you are working with accumulator-related issues, you might need to clear GV IDs with No Reference entries, this help QRadar function optimally.
IMPORTANT: Based on diagnostics, QRadar Support advises you when to clear GV IDs entries associated with No Reference in your environment. The steps are performed on the QRadar console. When these activities are done, services such as hostcontext and tomcat need to be stopped on the QRadar console. Due to service stoppage, the QRadar GUI might not be available, offense generation stops, report generation stops, and other services managed by hostcontext might stop. A maintenance window is advised to perform this activity.
You can find these No reference entries in AccumulatorMapping.YYYYMMDD.txt collected by using get_logs or by using the command /opt/qradar/support/collectGvStats.sh -M
An example of the such GV ID is as follows:
view No references were found.
These GV IDs with No reference entries are not in use. So, you can remove these entries safely.
This command must be run on console only, which also run these commands on your manage hosts (MHs).
Perform the following steps on the console only.
1) Stop hostcontext and tomcat services
systemctl stop hostcontext
And when you see the command with full path run the command with complete path to ensure all managed services are stopped (except ecs-ec-ingress).
/opt/qradar/upgrade/util/setup/upgrades/wait_for_start.sh systemctl stop tomcat
systemctl status tomcat systemctl status httpd
/opt/qradar/support/all_servers.sh -V -C "/opt/qradar/bin/runjava.sh -Xmx2048m -Xms2048m -Xss2048k com.q1labs.cve.utils.GlobalViewCleanup" | tee /root/GVcleanUp_DATE.txt
systemctl start tomcat
systemctl status tomcat systemctl status httpd systemctl start hostcontext
And when you see the command with full path, run the command with complete path to ensure all managed services are started.
systemctl restart accumulator
Was this topic helpful?
02 November 2022