IBM QRadar

 View Only

 Restore archive file on Qradar Console

Hung Duong's profile image
Hung Duong posted Tue June 03, 2025 12:23 PM

Hi Everyone,

During the system restore process, I encountered a warning stating that the file size must be under 512M. I'm not sure why this limitation exists or what cause this requirement. Could you please clarify the reason and assist me in resolving this issue? I have attached a screenshot of the warning for your reference.

Thank you.

Attachment  View in library
Restore archive file.jpg 205 KB
Martin Jaburek's profile image
Martin Jaburek posted Wed June 04, 2025 03:08 AM

Hi, this is a known issue and you have to solve it via CLI.

Tamás Simon's profile image
Tamás Simon posted Wed June 04, 2025 09:09 AM

In a case your backup is bigger than 512Mb there is a workaround. It's not handled by the GUI and you must do it from command line. Just copy your backup file  to /store/backupHost/inbound folder. You can see that soon after, system process the backup, which moves to /store/backup/ and creates an entry in the database. After you will see this backup on GUI and able to restore it. If for some reason backup would not process then QRadar moves it to store/backupHost/invalid.

Related Content