IBM Support

QRadar: How QRadar utilizes available free memory

Question & Answer


Why is the memory utilization on a QRadar appliance high even while the load is low?


Linux uses most of the free memory as cached memory.


QRadar, in order to improve searches, will use most of the free memory for file cache to improve performance. This helps QRadar return results as quickly as possible. The system is designed to make use of available RAM. If you are using an all-in-one appliance, this is even more the case since all processing is done on one single box.

It is not unusual for administrators to see high RAM allocation on a QRadar appliance.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Operating System","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
21 June 2018