Administrators might need to increase or decrease the buffer size from the default 50GB depending on the disk space available. For example, if the administrator set the minimum space of the root partition to 52GB and the buffer size is set to 50GB, disk space can reach 100% usage.
- SSH into the QRadar Console.
- Stop the DLC service
systemctls stop dlc
- In the
/opt/ibm/si/services/dlc/conf/spilloverqueue.propertiesfile there are 2 parameters that guide the default buffer size that can be edited:
For this example, 477 files multiplied by the maximum file size of 100MB is approximately 50GB. We edit the file and increase the max.files parameter to 715, which equates to approximately 75GB.
- After you edit and save the properties file, start the DLC service.
systemctl start dlc
This change allows max buffer to be reached without causing disk space issues.
Was this topic helpful?
12 December 2022