Summary

QRadar uses a PostgreSQL database as a data store. Vacuuming and reindexing are automatic database maintenance activities that help QRadar function optimally. However, there are times where this activity would be helpful. Such as an upgrade on a managed host failed due to store space, but you need to recover a little space. You can run these procedures to recover the space and continue the upgrade. There are some other situations where a database vacuum would be needed and a support representative indicates this document as a solution.

Vacuuming reclaims storage occupied by dead tuples. In PostgreSQL, tuples that are deleted, or obsoleted by an update, are not physically removed from their table and remain present until vacuuming is done. Vacuuming also updates data statistics used by the PostgreSQL query planner and updates the visibility map, which speeds up index-only scans. Periodic vacuuming is recommended for tables that are frequently updated.

However, PostgreSQL database on Managed Host (MH) is read-only. Therefore, vacuum its database is slightly different than vacuum PostgreSQL database on the Console.