Question & Answer
Question
Administrators might notice QRadar places most of it's available memory in cache. Why is this the case and when might it be a problem?
Cause
Placing available memory in cache is expected behavior on a Red Hat system and generally does not indicate an issue.
Red Hat is borrowing unused memory for disk caching, this might make it appear that the host is running low on memory, when it is in fact in a healthy state.
Caching increases system performance. There are no downsides, except for the confusion that it can cause.
Answer
When applications/processes are in need of more memory, they can utilize the memory cache. It can also be given back to applications immediately.
The key column to watch while monitoring memory with the free command is the "Available" column. If this value runs close to 0, then the system may be encountering performance problems.
10:59:50 up 101 days, 18:47, 1 user, load average: 0.40, 1.31, 2.03
------------------------------------------------------------------------
total used free shared buff/cache available
Mem: 62G 16G 1.1G 5.1G 44G 39G
Swap: 11G 204M 11G
What the command output shown means is that you have 39G free out of the available 62G RAM, so there is no lack of available RAM on this appliance, even if most of the memory is buff/cached.
Was this topic helpful?
Document Information
Modified date:
08 March 2024
UID
ibm17085042