How To
Summary
IBM QRadar can be configured for multi-tenancy and event/flow data for all the tenants is stored under /store/ariel directory.
Looking at the directory structure under /store/ariel it is difficult to identify data directories for each tenant and following procedure can help.
Objective
Tenant ID doesn’t show up in IBM QRadar UI. It only shows tenant name, event rate and flow rate.
Steps
Tenant ID information is not available in UI. We can use following database query in QRadar console CLI to identify the tenant ID:
Example: UBA-Test tenant data is stored under following directory.
psql -U qradar -c "select id, name from tenant where deleted='f';"
id | name
----+----------
1 | UBA1
2 | UBA2
3 | UBA-Test
(3 rows)
Once, tenant ID is identified, we can locate tenant data in /store/ariel.
Example: UBA-Test tenant data is stored under following directory.
/store/ariel/events/records/aux/3/Year/Month/Day/Hour/Minute
Additional Information
More details on Tenant Data with Event or Flow Retention (FAQ):
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
28 December 2022
UID
ibm16695787