Question & Answer
The /var partition is the partition that contains files to which the system writes data during its operation. Some examples of these files are system and email log files.
By default, the QRadar disk sentry check runs every 60 seconds and looks for high disk usage across the /var partition. If the /var partition fills up, the QRadar disk sentry alerts but does not stop the QRadar core services.
The following are the most common causes of the /var partition filling up:
- Emails queued and not delivered
- OS Kernel crash
Upgrade from 7.2.x to 7.3.x
In QRadar 7.2.8 and older, the /var partition did not exist on its own. Since 7.3.1, QRadar uses LVM and the logical volume /dev/mapper/rootrhel-var was designated for the /var partition alone. Subdirectories such as /var/log and /var/log/audit now use their own logical volume as separate partitions.
[root@qradar ~]# df -Th /var Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/rootrhel-var xfs 5.0G 435M 4.6G 9% /var
Was this topic helpful?
19 October 2022