IBM Security QRadar

Hi Community,

today i saw in qradar deployment running 7.5.0UP8IF03 an unusual error message related to /etc/cron.hourly/logrotate command.

I realized that the /var/log partition size reached 94% of diskspace. So i followed the ibm technote to investigate starting with 1. Troubleshooting /var/log/ space issues:

https://www.ibm.com/support/pages/qradar-resolving-high-disk-usage-problems-varlog-partition

And during this i tried to run the logrotate command and saw the mentioned output. Finally i solved this issue and were able free up some space.

Any ideas or hints related to this fix this lograte error output?

Regards,

Ralph

Hey Ralph

This is a known issue in UP8

https://www.ibm.com/mysupport/s/defect/aCIKe00000001wf/dt387724?language=en_US

There is a workaround in the above link.

Any questions please let us know.

Thanks

Hi Community,

today i saw in qradar deployment running 7.5.0UP8IF03 an unusual error message related to /etc/cron.hourly/logrotate command.

I realized that the /var/log partition size reached 94% of diskspace. So i followed the ibm technote to investigate starting with 1. Troubleshooting /var/log/ space issues:

https://www.ibm.com/support/pages/qradar-resolving-high-disk-usage-problems-varlog-partition

And during this i tried to run the logrotate command and saw the mentioned output. Finally i solved this issue and were able free up some space.

Any ideas or hints related to this fix this lograte error output?

Regards,

Ralph