IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Discovered out-of-memory error for accumulator_rollup process.

  • 1.  Discovered out-of-memory error for accumulator_rollup process.

    Posted Tue February 23, 2021 05:17 AM

    Hi ALL

    after updating qradar siem 7.4.2 fp2 every hour periodically (hourXX:13minute)get this 2 notifications QID: 38750055 and 38750004 "Discovered out-of-memory error for accumulator_rollup process." Pls, help to resolve this problem,



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Discovered out-of-memory error for accumulator_rollup process.
    Best Answer

    Posted Wed March 03, 2021 11:49 PM

    Hi Vusal,

    The Out-of_memory from accumulator_rollup process is most likely happening by run out of JVM memory which is all used by process. So in this case, you may need to tune on your JVM size.

    JVM tune is most likely trial and error process. and try to increase 1.5 times first, then check it.

    You are able to check your current JVM size for accumulator_rollup process by below output.

    # cat /opt/qradar/systemd/mem/accumulator_rollup

    then you can check any custom tune on below output. This file is the place where you can tune JVM size.

    # cat /opt/qradar/systemd/mem/accumulator_rollup.override

    For heap customization, uncomment the line below in a accumulator_rollup.override file for the process. (The memory size need to update.)

    #export MEM_OPTS="-Xmx768m -Xms768m"

    Regards, Brian



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Discovered out-of-memory error for accumulator_rollup process.
    Best Answer

    Posted Tue April 06, 2021 10:13 AM

    Hi Brian, Thanks for answer. after this solution works fine.



    #QRadar
    #Support
    #SupportMigration


Related Content