QRadar 7.5.0 UP15 introduces major enhancements to Tiered Storage, including concurrent re-indexing, per-cluster migration policies, real-time notifications, and improved Hot Tier safeguards. These updates address key operational challenges such as re-indexing reliability, migration visibility, and policy granularity.
Here's what's new, why it matters, and how it changes day-to-day administration.
Key Enhancements in UP15
| Enhancement Area |
Change |
Status |
| Re-indexing engine |
Hour folders processed concurrently in groups; failed folders retried up to 3 times |
Improved |
| Migration policies |
Separate policy per cluster, auto-managed via deploy, minimum 6-hour period. |
New |
| Bulk policy management |
Edit multiple policies simultaneously. |
New |
| Status banners |
Persistent dismissible banners showing last failed rebalance error details |
New |
| System notifications |
Real-time notifications for migration start, completion, and failure events |
New |
| Hot Tier protection |
Additional safeguards prevent accidental disk space exhaustion on hot nodes |
Improved |
1. Concurrent Re-indexing with Automatic Retry
UP15 improves tiered storage migration by introducing concurrent processing of hour folders, replacing the previous sequential re-indexing model.
- Hour folders are processed in parallel, improving overall migration throughput
- Failed folders are automatically retried up to three times
- Failures in individual folders do not block the overall migration process
- Only folders that fail all retry attempts are flagged for administrative review
- Detailed error logs are generated for troubleshooting after retry exhaustion
The following screenshot illustrates a re-indexing failure scenario during Tiered Storage migration in a QRadar 7.5.0 UP15 environment.
2. Per-Cluster Migration Policies
UP15 introduces independently configurable migration policies for each data node cluster, replacing the previous single global policy model.
- Each cluster is assigned a dedicated migration policy
- Policies are automatically created upon cluster deployment and removed upon decommissioning
- Migration schedules can be configured independently per cluster
- A minimum policy interval of 6 hours is enforced system-wide
- Supports improved workload isolation between high-volume and low-volume clusters
Bulk Policy Management
To support environments with multiple clusters, UP15 also introduces bulk policy management capabilities, reducing administrative overhead and the risk of configuration drift.
- Multiple migration policies can be selected and modified simultaneously via the Admin UI
- REST API support is provided for programmatic bulk updates
- Ensures consistent configuration across clusters
- Reduces administrative overhead and configuration drift
The following screenshots demonstrate per-cluster migration behavior in UP15.
3. Migration Status Visibility and Notifications
UP15 enhances operational visibility by introducing proactive monitoring mechanisms for migration activities. Administrators no longer need to manually review logs to identify migration issues — the system surfaces problems in real time.
- Status banners are displayed in the Admin Console upon migration failure
- Banners persist until explicitly acknowledged by an administrator
- Detailed failure information is provided, including affected hour folders
- System notifications are generated for migration start, success, and failure events
- Enables faster detection of migration issues without manual log review
The following screenshot illustrates the Admin Console behavior when a Tiered Storage migration completes with errors.
4. Hot Tier Protection
UP15 introduces additional safeguards to prevent storage-related failures during migration operations.
By validating disk capacity before migrations begin, the system reduces the risk of ingestion disruptions caused by hot node exhaustion
- Pre-migration validation of available disk capacity on hot nodes
- Prevents staging of warm-tier data when insufficient storage is available
- Reduces the risk of ingestion failures due to disk space exhaustion
- Enhances stability of migration workflows under constrained storage conditions
The dashboard below illustrates storage distribution behavior for Hot Tier Protection safeguards.
Summary of Behavioral Changes (Before vs After UP15)
| Area |
Before UP15 |
After UP15 |
| Re-indexing |
Sequential processing |
Concurrent processing with retries |
| Failure Handling |
Single failure blocks process (no retries) |
Automatic retry (up to 3 attempts) |
| Policy Model |
Global policy across clusters |
Per-cluster independent policies |
| Bulk Management |
Not supported |
Bulk policy updates supported |
| Visibility |
Log-based only |
Status banners and notifications |
| Error Persistence |
Overwritten by new runs |
Persistent until acknowledged |
| Hot Tier Safety |
No pre-check validation |
Pre-migration capacity checks enforced |
| Minimum Migration Interval |
No enforcement |
Minimum 6-hour interval enforced |
Key Takeaways for Administrators
Administrators should consider the following when adopting UP15:
- Plan Warm Tier assignments carefully — Reassigning a host from a warm tier requires removing the host from QRadar deployment and adding it back.
- Review the New per-Event Processor policies created with a default 2 weeks threshold and set the desired threshold as needed.
- Monitor system notifications for real-time migration status updates.
- Utilize bulk policy management for consistent configuration across clusters.
- Monitor the Security Data Distribution disk chart to ensure disk capacity is sufficient.
- Investigate error banners before dismissing them to ensure affected hourly folders are addressed.
If you're running QRadar 7.5.0 UP10 through UP14, you can upgrade directly to UP15 using the SFS package available on IBM Fix Central.
References
Special thanks to Ashish Kothekar (ashish.kothekar@in.ibm.com) for taking the time to review this blog.