Question & Answer
Question
How much space must be assigned to the swap partition in QRadar® 7.3 and later?
Answer
This article is applicable only to QRadar® 7.3 and later versions that use RHEL 7 as a based operating system.
QRadar® can be installed commercially in 2 ways. See the following document to understand each of them: QRadar® Installations
Note: QRadar® Community Edition is not considered in this article.
The explanations given are divided into categories: QRadar® Appliance installation, QRadar® Software installation, and QRadar® High Availability.
QRadar® Appliance installation
On QRadar® appliances (virtual or bare-metal), the administrator cannot change the sizes manually. The size is determined by the QRadar® setup built-in scripts based on the total RAM memory of the host and with the following criteria:
- Memory size is less than ( < ) 4GiB, then the swap size is 4GiB
- Memory size greater or equal than ( >= ) 4GiB and less than ( < ) 8GiB, then the swap size is 8GiB
- Memory size greater than ( > ) 8GiB, then the swap size is a minimum of 8GiB and a maximum of 24GiB. The exact value is calculated by using the formula: Memory size * 0.75
Example: For a 12GiB Memory size, the calculation is: 12 * 0.75 = 9
The swap size is 9GiB.
QRadar® Software installations
On software installations, the administrator must manually configure the size of the partitions including the swap partition during or after RHEL 7 Operating System installation before it attempts to install QRadar®.
See the following document to know the names and sizes of the partitions: Partition properties for QRadar® installations on your own system
QRadar® High Availability
For QRadar® HA (High Availability) deployments, it is recommended that both nodes (primary and secondary) have the same size swap partition. Having both nodes with the same size avoids one of the nodes to struggle with less swap memory available when a failover occurs.
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"}],"ARM Case Number":"TS004265064","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]
Was this topic helpful?
Document Information
Modified date:
27 October 2020
UID
ibm16348712