IBM Support

QRadar: Ariel reindexing when migrating data from one appliance to another

Troubleshooting


Problem

Each QRadar appliance that stores event or flow data creates local index files on the appliance to improve search speed. When you move /store/ariel data manually between appliances, reindexing is necessary to ensure old indexes are removed and updated. Indexes allow QRadar running on the host to determine where on disk the data resides so results return quickly. When indexes are not available, a direct scan of the raw data is performed, which can create unnecessary disk (I/O) and CPU load and degrade search speed.

Reindexing your data is required in the following scenarios:

  1. If data migrated for a timeframe that already has data on the destination host.
  2. If data migrated from multiple hosts to a single host where the data has an overlapping time frame.

    NOTE: Depending on the amount of data on the host, reindexing data might take a considerable amount of time. It is recommended to use the "screen" command as noted in previous steps to avoid interruptions related to network issues.

Resolving The Problem

The time period in the example procedure updates the last two days of data to ensure recent searches are quick for recently migrated data. Administrators must update the date and time in the example commands to ensure the offline indexer utility re-creates indexes.

  1. Use SSH to log in to the QRadar Console as the root user.
  2. Open an SSH session to the host containing your migrated data.
  3. To start a screen session, type: 
    screen -S indexer
    Important: Update the date and time in the following example commands. QRadar Support typically recommends that administrators re-create indexes for the latest two days of data migrated to estimate the time to complete. Administrators can reindex all of the data, but reindexing can take significant amount of time to complete. Starting with two days can provide a baseline for the administrator. 
  4. Remove any 1-minute indexes. 
    /opt/qradar/bin/ariel_offline_indexer.sh -n events -v -t '2021/10/25 00:00' -d 2880 -a -r
  5. To rebuild 1-minute indexes for your events, type: 
    /opt/qradar/bin/ariel_offline_indexer.sh -n events -v -t '2021/10/25 00:00' -d 2880 -a
  6. Remove the super indexes for the same period:
    /opt/qradar/bin/ariel_offline_indexer.sh -n events -v -t '2021/10/25 00:00' -d 2880 -s -r
  7. To rebuild your super indexes, type:
    /opt/qradar/bin/ariel_offline_indexer.sh -n events -v -t '2021/08/09 00:00' -d 2880 -s
    Results
    After the indexes are rebuilt, the data migration is complete. 

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt8AAA","label":"Ariel"},{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
03 July 2023

UID

ibm17005503

Page Feedback