Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[STRM] How to free up some space when the hard disk (HDD) is full: Disk Sentry: Disk Usage Exceeded Max Threshold

0

0

Article ID: KB15029 KB Last Updated: 17 Jun 2011Version: 4.0
Summary:
Depending on data retention period the events and flows can fill the hard disk (HDD) space.
Symptoms:
As STRM collects events and flows from different sources, depending on the data retention period, the /store partition on the hard disk (HDD) can become full and cause STRM to stop collecting information.

The following message could appear in the 'qradar.error' log:

DiskSpaceSentinel: [WARN] [NOT:0150064102][000.000.000.000/- -] [-/- -]System disk resources above warning threshold

OR

The following message could appear In the System Notifications:
Disk Sentry: Disk Usage Exceeded Max Threshold


Solution:
To check free hard disk (HDD) space, enter:
# df -h

Events, Flows, and payloads are stored in the /store directory of the STRM event collector(s)
/store/ariel/events/
/store/ariel/flows/
To free up some space:
  1. Login to STRM WebUI, Admin System Settings

  2. Modify the value of: Flow Data Retention Period and/or Log Source Data Retention Period to a shorter period value

  3. Save changes.

  4. Perform: CONFIG > Deploy
    (At this point during the nightly disk maintenance, the new data retention configuration will be applied - and disk space will be freed).

  5. From the Linux shell, as root, run the following command:
    # /opt/qradar/bin/diskmaintd.pl -qtmp -flowlogs -reports -ariel -hostprofile -mpc -perf -cv
    (this command will run the disk maintenance immediately and free up some space).

  6. Double check the free space after the procedure:
    # df -h

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search