Description

On the STRM dashboard and through email, receiving notices alerting that the threshold is exceeded.

Email message received: Percentage of swap used has an average of 63.6 over the past 5 intervals, and still exceeds the configured threshold of 60.0.

Symptoms

This error message is found in the in /var/log/qradar.error log file.

Error received:

Mar 25 04:08:03 129.171.37.56 [hostcontext.hostcontext] [Thread-95] com.q1labs.hostcontext.sar.SarSentinel: [WARN] [NOT:0150124100][129.171.37.56/- -] [-/- -]Percentage of swap used has an average of 63.6 over the past 5 intervals, and still exceeds the configured threshold of 60.0. To resolve: If your system continues to exhibit this behavior, please contact Customer Support.

Solution

This is a configuration setting under Admin > Global System Notifications .

alt
 

You can change this setting as well as change the message you receive when the maximum threshold is hit for swap space.

alt

Note: There are several other system notifications you will want to look at and maybe change the message you receive when the maximum threshold is hit for that item. This will help you know which threshold you hit making troubleshooting any email error messages easier and quicker.

Options for (STRM 2009.1 --- v2009.1.0 Build (6.3.0.1255908):

User CPU usage:
Nice CPU usage:
System CPU usage:
Idle CPU usage:
Percent idle time:
Run queue length:
Number of processes in the process list:
System load over 1 minute:
System load over 5 minutes:
System load over 15 minutes:
Kilobytes of memory free:
Kilobytes of memory used:
Percentage of memory used:
Kilobytes of cached swap memory:
Kilobytes of buffered memory:
Kilobytes of memory used for disc cache:
Kilobytes of swap memory free:
Kilobytes of swap memory used:
Percentage of swap used:
Number of interrupts per second:
Received packets per second:
Transmitted packets per second:
Received bytes per second:
Transmitted bytes per second:
Received compressed packets:
Transmitted compressed packets:
Received multicast packets:
Receive errors:
Transmit errors:
Packet collisions:
Dropped receive packets:
Dropped transmit packets:
Transmit carrier errors:
Receive frame errors:
Receive fifo overruns:
Transmit fifo overruns:
Transactions per second:
Sectors written per second:

Modification History

2020-09-26: Minor, non-technical edits.