Troubleshooting
Problem
When you try to run a command in the Command Line Interface (CLI), you get the error: "QRadar requires 4092M of swap space but was only able to find 0M"
Symptom
After you finished the installation of QRadar and you log into Command Line Interface (CLI), all commands ran reply with the same exact warning:
WARNING:*******************************************************************
WARNING: QRadar requires 4092M of swap space but was only able to find
WARNING: 0M, please increase swap space by at least 4092M. Without this
WARNING: additional swap space, some components of QRadar will not function
WARNING: properly (such as complex queries or reports). Please contact
WARNING: Customer Support for further details and assistance in resolving
WARNING: this issue.
WARNING:*******************************************************************
Cause
This warning means that the Red Hat Enterprise Linux (RHEL) instance has no swap space correctly allocated during the installation and QRadar internal monitoring scripts detected this problem.
Environment
All QRadar instances that have no swap allocated correctly are affected by it. A range of versions are from QRADAR SIEM 72x - 75x but specifically on Software Installations.
For more about Software Installations, check out our IBM QRadar 7.5 Installation Guide.
Diagnosing The Problem
To discover and list the memory distribution on your environment, you can run:
free -h
The expected result is something like:
total used free shared buff/cache available
Mem: 31G 1.7G 24G 17M 4.9G 29G
Swap: 15G 0B 15G
In the previous example, we can clearly see Swap has 15 GB of RAM allocated. If you are getting "QRadar requires 4092M of swap space" error, you must review the amount of space allocated to this important partition. Depending on your results there might be several issues in your instance, the first action to check is to review the /swap partition entry inside:
cat /etc/fstab
If a swap partition exists, an entry similar to this one is listed:
UUID=9a6d9db6-2bf6-49f0-9d45-03b43c91b6b5 swap swap defaults 0 0
If the entry is listed, then this fits scenario A. If it's no there, then it is scenario B, and you must create the swap partition manually. If you are facing scenario B, you have to check whether the partition exists in the system with either of these commands:
lsblk
blkid
If anything related to swap is listed, then you are facing scenario B, else you are in scenario C.
Resolving The Problem
Scenario A:
We got a swap partition but it is either not configured properly or not sufficient. Remember the rule specified in our r IBM QRadar 7.5 Installation Guide specifies you need to allocate at least 4GB of Swap. For further information about this topic read QRadar: Size allocation to the swap partition in QRadar 7.3 and later.
You can disable and enable swap with the next commands:
swapon -a
swapoff -a
If more space for swap partition is needed, the recommended action is to rebuild the system. Before the installation of QRadar, but after RHEL installation the creation and configuration of swap partition needs to be in place.
Scenario B:
If you got any results inside blkid/lsblk and you have a Swap partition created there its just a matter of creating the entry inside /etc/fstab. It has to match the format:
UUID=xxxxxxxxxxxxx swap swap defaults 0 0
Where UUID is specified by blkid/lsblk commands. When the entry is added correctly, enable it with:
swapon -a
You can see that the modification reflected inside the memory allocation with:
free -h
Scenario C:
If no entry is found inside fstab, lsblk, blkid then the recommended action is to rebuild the system. Before the installation of QRadar, but after RHEL installation the creation and configuration of Swap partition needs to take place.
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
30 June 2023
UID
ibm17001041