Question & Answer
The /tmp partition is used for programs that require temporary files.
By default, the QRadar disk sentry check runs every 60 seconds and looks for high disk usage across the /home partition. If the /tmp partition fills up, the QRadar disk sentry alerts but does not stop the QRadar core services, however it can create other symptoms such as configuration deployment changes due to critical disk space.
User leftover files and mlocate_db temporary files are the most common causes of the /tmp partition filling up. Instead of /tmp, administrators can create a location for important data, such as /store/IBM_Support/, /store/save/, /store/important/, or /store/keep/ for exports, utilities, or important files.
Was this topic helpful?
19 October 2022