Question & Answer
Why is the memory utilization on a QRadar appliance high even while the load is low?
Linux uses most of the free memory as cached memory.
QRadar, in order to improve searches, will use most of the free memory for file cache to improve performance. This helps QRadar return results as quickly as possible. The system is designed to make use of available RAM. If you are using an all-in-one appliance, this is even more the case since all processing is done on one single box.
It is not unusual for administrators to see high RAM allocation on a QRadar appliance.
Where do you find more information?
Was this topic helpful?
21 June 2018