IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  Thread closed by the administrator, not accepting new replies.

  • 1.  1–2 Months Log Retention: Data Node vs Other Options

    Posted 01/08/26 08:07 AM
    No replies, thread closed.
    Hi,
     
    I would like to understand and validate some information about the Data Node and how it works.
     
    Let's assume we have a console that serves as the primary location where logs are collected, stored, and normalized. If we want to store, for example, the last one to two months of logs on a Data Node purely for redundancy in case the main console fails, is a Data Node suitable for this purpose? Or should we consider alternative solutions?
    I am aware of the Console HA options. For this discussion, let's focus on using a Data Node or other solutions, excluding Console HA.
    The main objective is simply to store one to two months of logs.
     
    BR
    Vydenis


    ------------------------------
    Vydenis Kucinskas
    ------------------------------


  • 2.  RE: 1–2 Months Log Retention: Data Node vs Other Options

    Posted 01/09/26 04:41 AM
    No replies, thread closed.

    Hi

    I know you aware of HA alternative but it is the best option. 

    You can use DN to store all logs with attaching to a console and turning console's EP part to Process Only mode. So all log are stored on DN now.  If console fail you can rebuild with new console with restoring backup and you can continue to work. 



    ------------------------------
    Hasan Erhan Aydinoglu
    ------------------------------



  • 3.  RE: 1–2 Months Log Retention: Data Node vs Other Options

    Posted 01/09/26 05:13 AM
    No replies, thread closed.

    Hi Hasan,

    Thanks for your reply.

    I understand that, in your described case, all logs are stored on the DN.
    However, what if we want to store all logs on the console as before, while also keeping a 1–2 month copy of those logs on the DN as a backup?

    For example, logs would be retained on the console for 12 months, and only the last 1–2 months would be stored on the DN as a backup. Is this possible, or should we consider other solutions?



    BR



    ------------------------------
    Vydenis Kucinskas
    ------------------------------

    Original Message


  • 4.  RE: 1–2 Months Log Retention: Data Node vs Other Options

    Posted 01/09/26 05:44 AM
    Edited by Hasan Erhan Aydinoglu 01/09/26 05:44 AM
    No replies, thread closed.

    Hi Vydenis

    To store just latest 1-2 months of data backup (offline), you can consider to mount /store/backup folder to any NFS, ISCI or Fiber Storage. You can easily manage how much time should data backup can be stored with using external basic bash scripting. But if you need that data should be online, in my knowledge there is no option on DN mechanism to hold data for selected period. Data distributed btw. Console and DN when it reaches with using balancing mechanism.



    ------------------------------
    Hasan Erhan Aydinoglu
    ------------------------------

    Original Message


  • 5.  RE: 1–2 Months Log Retention: Data Node vs Other Options

    Posted 01/09/26 05:54 AM
    No replies, thread closed.

    You say that you want to store 1-2 months of data somewhere "in case the main console fails".

    How do you expect to access the 1-2 month copy of the data (wherever you have stored it) if you don't have a Console?  The Console is the only way to access Ariel Data in QRadar, either through the GUI or through the REST-API.  If the Console is gone - you have no access, no matter how many copies of the data you have.

    Paul



    ------------------------------
    Paul Ford-Hutchinson
    ------------------------------



Related Content