IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Data Node Disk Usage Thresholds

    Posted 9 days ago

    Hello,

    we have one event processor which has one Data Node attached, disk occupation is as below (first one is the EP, later the DN):

    [root@bnsqrcp ~]# df -hT /store
    Filesystem                  Type  Size  Used Avail Use% Mounted on
    /dev/mapper/storerhel-store xfs   3.8T  3.4T  404G  90% /store

    [root@bnsqrcpdn1 ~]# /df -hT /store
    Filesystem                  Type  Size  Used Avail Use% Mounted on
    /dev/mapper/storerhel-store xfs   1.0T  938G   87G  92% /store

    Unfortunately we were not able to create DN with a bigger disk, anyway now free space is less than 10%..data balancing should keep free space aligned between DN and EP, but it's not clear to me when services on DN would be stopped as a consequence of lack of disk space..it's already less than 100 MB but services are still running (on the EP this would have caused ecs-ec and ecs-ep to stop), could someone explain me if the service stop happens on DN in the same way as it does on EPs?

    Thanks,



    ------------------------------
    Davide Salardi
    ------------------------------


  • 2.  RE: Data Node Disk Usage Thresholds

    Posted 8 days ago

    Hi Davide,

    On the DN if you run the following it will tell you which services should be running

    grep COMPON /opt/qradar/conf/nva.hostcontext.conf

    The DN will shut down down services when it hits 95%.  As the disk is less than 2TB it does not use the absolute disk levels of 100GB

    Thanks



    ------------------------------
    John Dawson
    Qradar Support Architect
    IBM
    ------------------------------

    Original Message


  • 3.  RE: Data Node Disk Usage Thresholds

    Posted 8 days ago
    Edited by Perf1 8 days ago

    Services will shut down at 95% disk utilization in this case on the DN. Also scattering of data to the DN will stop before that,  at 93% starting from 7.5.0 UP12 and at 90% before that, so the situation of DN filling up to 95% and services shutting down should be very rare and not caused by the data scattering.

    https://www.ibm.com/docs/en/qsip/7.5?topic=nodes-data-rebalancing-after-data-node-is-added



    ------------------------------
    Perf1
    ------------------------------

    Original Message


Related Content