A QRadar administrator needs to quickly check the disk space for all managed hosts. Which command does the administrator use?

The /opt/qradar/support/allservers.sh script is a utility used to execute a command on all managed hosts within an IBM QRadar deployment from the console. To check disk space, the standard Linux command is df. The -T flag displays the file system type, and the -h flag presents the sizes in a human-readable format (e.g., KB, MB, GB). Therefore, executing df -Th via the allservers.sh script is the correct and most efficient method to check the disk space for all managed hosts simultaneously.

A. /opt/qradar/support/allservers.sh 'Is -ltrsh"

The ls command lists directory contents; it does not report on the overall disk space usage of mounted file systems.

B. /opt/qradar/support/allservers.sh "rra -rf /store'

rra is not a standard command. If this is a typo for rm, it would be a destructive command to delete files, not check disk space.

D. /opt/qradar/support/allservers.sh -C -K 'watch Is'

The watch command repeatedly executes another command. This would continuously list files, not provide a one-time report on disk capacity.

1. IBM QRadar Administration Guide (Version 7.5.0): This guide details system maintenance procedures. In the section on "Monitoring disk space," it specifies using the df -h command to check disk usage. The allservers.sh script is documented as the tool for running such commands across the entire deployment.

Reference: IBM Security QRadar SIEM Administration Guide, Version 7.5.0, SC27-8232-00, Chapter 10: "Maintaining your deployment", Section: "Monitoring disk space", Page 168.

2. IBM Support Knowledge Base: An official support article explicitly demonstrates the use of the allservers.sh script for deployment-wide checks. It provides examples of running commands like df -h to assess disk space on all hosts.

Reference: IBM Support, Document Number KB0012053, "QRadar: How to use the allservers.sh script". The document provides the example: /opt/qradar/support/allservers.sh "df -h /store". This confirms the methodology of using the script with the df command.