Question & Answer
Question
Administrator with an App Host has 4 CPUs and 32 GB of RAM allocated and wants to add more capability and expand to 12 CPUs and 64 GB RAM. Can the administrator expand the current VM without reinstalling QRadar?
Answer
Yes, the administrator can expand the current VM without rebuilding it from scratch. QRadar includes a tool called applied_tunings that runs each time an appliance (physical or virtual) boots that reviews the available CPU and RAM settings to tune the QRadar installation to the available hardware. Administrators who need to add RAM on physical appliances or add CPU cores can restart the appliance and the applied_tunings utility runs to apply the changes.
Important: Administrators with virtual machines are expected to meet or exceed the minimum documented virtual appliance specifications. If you install an Event Processor with less than the documented RAM and CPU cores, you can experience performance issues as the appliance has fewer threads to complete tasks for administrators.
Important: Administrators with virtual machines are expected to meet or exceed the minimum documented virtual appliance specifications. If you install an Event Processor with less than the documented RAM and CPU cores, you can experience performance issues as the appliance has fewer threads to complete tasks for administrators.
What impact does increasing RAM and CPU have on appliances when my host reboots?
The applied tunings utility allows appliances to adjust core parameters within QRadar and allows the software to take advantage of extra threads to complete more tasks simultaneously. For example, the Event Processor specifications are increased from 48GB RAM and 16 cores to 128GB RAM and 40 cores. When this appliance starts, the applied_tunings utility adjusts the threads available to the services that run on the appliance.
| Type | Before | After |
|---|---|---|
| Memory | 64GB | 128GB |
| CPU cores | 16 | 40 |
| CRE threads | 8 | 16 |
| Parser threads | 8 | 16 |
| Ariel writer threads | 4 | 13 |
Table 1: Threads available to core QRadar services after the VM starts and recognizes the added RAM and CPU cores.
Perform the following steps to upgrade the CPU or memory
- Power down the QRadar appliance.
- Log in to the vSphere that hosts the desktop.
- In the inventory view, right-click the desktop from the list of virtual machines (VMs).
- Click Edit Settings.
- In the Hardware tab, update the value for memory or CPUs.
- Power on the QRadar appliance.
- Log in to QRadar as an administrator.
- Click the Admin tab.
- Select Advanced > Deploy Full Configuration.
- Click OK to confirm the deploy.
Results
After the configuration deploy is complete, the new memory and CPU cores are recognized by QRadar.
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
19 June 2023
UID
ibm16998721