IBM Support

QRadar: What is data scattering?

Question & Answer


What is data scattering in QRadar Data Nodes?


The scattering process distributes incoming data from the parent node to all other nodes of the cluster based on the free space of each node, for instance:

The parent node has 25% free space and the data node has 40% free space. The data node receives 40 events, while the parent node receives 25 events until both appliances have approximately the same amount of free space.

If a data node goes offline, scattering tries to move the data to the next member of the cluster. If it is unsuccessful, it stores data locally on the parent node so that no data is lost.

For more information about data nodes, see QRadar: About Data Nodes.

Related Information

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Hardware and Firmware","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
31 May 2023