Memory and Backup Notifications for JSA Appliances

Explanation

Disk Sentry is responsible for monitoring system disk and storage issues. Before a backup begins, Disk Sentry checks the available disk space to determine whether the backup can complete successfully. If the free disk space is less than two times the size of the last backup, the backup is canceled. By default, backups are stored in /store/backup.

User Response

To resolve this issue, select one of the following options:

• Free up disk space on your appliance to allow enough space for a backup to complete in /store/backup.

• Configure your existing backups to use a partition with free disk space.

• Configure more storage for your appliance. For more information, see the Juniper Secure Anaytics Configuring Offboard Storage Guide.

Explanation

A backup cannot start or cannot complete for one of the following reasons:

• The system is unable to clean the backup replication synchronization table.

• The system is unable to run a delete request.

• The system is unable to synchronize backup with the files that are on the disk.

• The NFS-mounted backup directory is not available or has incorrect NFS export options (no_root_squash).

• The system cannot initialize on-demand backup.

• The system cannot retrieve configuration for the type of backup that is selected.

• Cannot initialize a scheduled backup.

User Response

Manually start a backup to determine whether the failure reoccurs. If multiple backups fail to start, contact Juniper Customer Support.

Explanation

The error is commonly caused by configuration errors in the configuration source management (CSM) or if a backup is canceled by a user.

User Response

Select one of the following options:

• Review the credentials and address sets in CSM to ensure that the appliance can log in.

• Verify the protocol that is configured to connect to your network device is valid.

• Ensure that your network device and version is supported.

• Verify that your network device connects to the appliance.

• Verify that the most current adapters are installed.

Explanation

The time limit is determined by the backup priority that you assign during configuration.

User Response

Select one of the following options:

• Edit the backup configuration to extend the time limit that is configured to complete the backup. Do not extend over 24 hours.

• Edit the failed backup and change the priority level to a higher priority. Higher priority levels allocate more system resources to completing the backup.

Explanation

The Backup Repository Path determines where backups are stored. By default, backups are stored in /store/ backup. Administrators can configure the Backup Repository Path parameter on the Backup Recovery Configuration page on the Admin tab. If the system can't detect the Backup Repository Path, the backup can't complete successfully. For example, the path might not be found if there is an external storage mount failure.

User Response

To resolve this issue, select one of the following options:

• On the Backup Recovery Configuration page, change the value for the Backup Repository Path to a file path that exists and has enough storage space for a backup. Deploy your changes, and then run the backup again.

• If the Backup Repository Path is pointing to external storage, verify that the mounted storage failed. If so, resolve the storage mount issue, and then run the backup again.

Explanation

When JSA components attempt to use more than the amount allocated for memory, the application or service can stop working. Out of memory issues are caused by software, or user-defined queries and operations that exhaust the available memory.

User Response

Review the following resolutions:

• Review the error message that is written to the /var/log/qradar.log file to determine which component failed.

• If the Ariel proxy server is searching through large amounts of data or is using a grouping option that generates unique values in the search results, reduce the number of unique values or reduce the time frame of the search.

• If the accumulator is generating a time series graph with many aggregated unique values, reduce the size of the query.

• If a protocol-based log source is recently enabled, decrease the polling period to reduce the data queried. If multiple protocol-based log sources are running at the same time, stagger the start times.

• If a rule recently changed to track unique properties over long periods of time, reduce the time frame by half or reduce the number of matching events by adding another filter.

Explanation

An application or service ran out of memory and was restarted. Out of memory issues are commonly caused by software issues or user-defined queries.

User Response

Review the following resolutions:

• Review the error message that is written to the /var/log/qradar.log file to determine which component failed.

• If the Ariel proxy server is searching through large amounts of data or is using a grouping option that generates unique values in the search results, reduce the number of unique values or reduce the time frame of the search.

• If the accumulator is generating a time series graph with many aggregated unique values, reduce the size of the query.

• If a protocol-based log source is recently enabled, decrease the polling period to reduce the data queried. If multiple protocol-based log sources are running at the same time, stagger the start times.

• If a rule recently changed to track unique properties over long periods of time, reduce the time frame by half or reduce the number of matching events by adding another filter.