IBM Support

Can we reduce the SOAR database size?

Question & Answer


Question

A customer can have a large size of database due to there are a huge number of  incidents created. How can we reduce the database size?

Cause

The backend database cannot be compressed even if the incidents are deleted.

Answer

The backend database cannot be compressed. However, the customer can close off the old incidents, then delete them. Once the incidents are removed, the space created by the deleted incidents would be used first.
The detailed steps are below:
-check the current space usage.
df -h
-check the space usage in the "/crypt" directory
cd /crypt
[root@resilient crypt]#‌ du -k | sort -n
-return the space back to OS by running "VACCUM FULL"
sudo -u postgres psql -c "vacuum (verbose,full)" co3

Related Information

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z000000cw4bAAA","label":"Resilient Core"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cwI4AAI","label":"Resilient Core-\u003EDatabase"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
13 May 2024

UID

ibm17054596