Question & Answer
The /storetmp partition is used as a temporary location for storing configuration files used by the various processes in QRadar. This partition is the best location to copy SFS files to a QRadar system.
By default, the QRadar disk sentry check runs every 60 seconds and looks for high disk usage across the /storetmp partition. If the /storetmp partition fills up, the QRadar disk sentry stops the QRadar core services.
Upgrade from 7.2.x to 7.3.x
In QRadar 7.2.8 and older, the /storetmp partition did not exist on its own, and it was presented as /store/tmp. Since 7.3.1, QRadar uses LVM and the logical volume /dev/mapper/rootrhel-storetmp was designated for /storetmp partition, which is now a partition with a linked to /store/tmp.
[root@qradar ~]# ll /store | grep tmp lrwxrwxrwx 1 nobody nobody 10 Jun 28 2019 tmp -> /storetmp/
Disk maintenance in /storetmp
Since QRadar 7.3.2, the diskmaintd.pl utility runs every 24 hours and removes data in /storetmp that is not related to QRadar. For more information about this procedure, see: QRadar: Files in /storetmp are removed daily by disk maintenance.
[INFO](testmode) Checking Disk Space... [ERROR](testmode) /storetmp has 1571635.2 Kb needed and only 996688 Kb available [ERROR](testmode) Usage Report: =-= DiskSpace Report for Mountpoint '/storetmp' =-= =-= Available: 996688 Kb, Required: 1571635.2 KB =-= =-= Directories over 1G on mountpoint /storetmp to a depth of 3: /storetmp =-= Size (MB) Directory 14339 /storetmp 14337 /storetmp/test =-= Files on mountpoint /storetmp over 1G =-= 15G /storetmp/test/14GBfile =-= Disk Space Report Complete for '/storetmp' [ERROR](testmode) - Mountpoint: /storetmp has 996688 Kb available and requires 1571635.2 Kb [ERROR](testmode) Pretest had 1 failed checks for free space; - Mountpoint: /storetmp has 996688 Kb available and requires 1571635.2 Kb [ERROR](testmode) sql pretest errored, halting.- Mountpoint: /storetmp has 996688 Kb available and requires 1571635.2 Kb [INFO](testmode) Set <Hostname> status to 'Patch Test Failed' [ERROR](testmode) Patching can not continue
Was this topic helpful?
30 September 2022