Question & Answer
Question
Why is the memory utilization on a QRadar appliance high even while the load is low?
Cause
Linux uses most of the free memory as cached memory.
Answer
QRadar, in order to improve searches, will use most of the free memory for file cache to improve performance. This helps QRadar return results as quickly as possible. The system is designed to make use of available RAM. If you are using an all-in-one appliance, this is even more the case since all processing is done on one single box.
It is not unusual for administrators to see high RAM allocation on a QRadar appliance.
Where do you find more information?
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Operating System","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
21 June 2018
UID
swg21993981