IBM Security QRadar

 View Only
  • 1.  Partition Information Required

    Posted Wed February 24, 2021 02:48 AM
    /dev/mapper/storerhel-store 

    The above mentioned folder is getting filled up and we need to check the space utilization , also please let us know the procedure to free-up the space.

    ------------------------------
    Ather Mobeen
    ------------------------------


  • 2.  RE: Partition Information Required

    IBM Champion
    Posted Wed February 24, 2021 06:16 AM
    Hi,
    this may become tricky. You are based on RHEL. My guess is your partition is mapped to "/" like "/dev/mapper/storerhel-store ... 80% /" - pls double check.
    Partition mapping is specific to your individual installation. If situation above is the case you need to identify growing dirs and files 1st in your mapped ptn 1st.
    Use command #du -h to achieve that. Look for all entries > 1.0 G. What is your actual Use% in #df -h ?
    Under normal circumstances / ptn should not grow. If it does somethings probably wrong.
    All your event data are getting stored in /store/ariel. Other /store/<dirs> may grow as well but at a slower rate. free-up space requires in-depth knowledge.
    You better contact support for getting this done.
    ​​

    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------