Services involved in a QRadar search

QRadar searches, if not designed well, can lead to performance issues on QRadar. The various symptoms that we can see (not necessarily only because of bad search) are as follows:

• Searches become slow
• Reports take a lot of time to complete (especially reports that are run manually on raw data)
• The QRadar UI becomes slow
• QRadar partition for /transient may become full

Apart from these, however, there could be many more issues that could arise. To resolve such issues, you should know which services need to be restarted (if ever), and this section is intended to make you aware of these very services. Let’s get started!

In Chapter 1, we discussed all the major services in QRadar. Out of those, the following are the services that are involved when running searches:

• Tomcat service: Whenever you want to create or run a search, open the QRadar Console and go to Log Activity. The QRadar UI is controlled by the...