IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  disk space consideration in executing soarMoveAttachments or soarSystemBackup

    Posted Sun October 22, 2023 11:19 PM

    To SOAR development team

    May I have answers for the following questions:

    1. Does soarMoveAttachments command requires some "Free PE(Physical Extent)" in the volume group?

       "Free PE(Physical Extent)" can be seen by "vgdisplay | grep Free".

    2. If (1) is so, how can we roughly estimate the required space?

        I suppose "du -sm /crypt/attachments" may be the one. 

    3. Does soarSystemBackup command requires some "Free Physical Extent" in the volume group? 

    4. If (3) is so, how can we roughly estimate the required space?

    ===
    I once failed to execute soarMoveAttachment command due to insufficient space on my standalone V50.1 environments.

    Then I could recover with the following steps:
      - create a new LVM partition
      - create PV
      - add PV to the existing VG

    Since we need to specify a disk size at configuration,  it would be appreciated if someone can tell how we estimate the size beforehand.

    (Then I picked a relatively big size 20GB as disk size without any reasons.)

    Anyway I felt that we may need to consider more on the standalone environments unlike OVA development.



    ------------------------------
    Yohji Amano
    ------------------------------


  • 2.  RE: disk space consideration in executing soarMoveAttachments or soarSystemBackup

    Posted Mon October 23, 2023 04:50 AM
    Edited by VINCENT DENG Mon October 23, 2023 04:57 AM

    That's correct. Just a reminder that for attachment, please allocate more space to accommodate new attachments added in the future.

    For soarSystemBackup, 5GB free space in volume group should be enough in most cases

    ------------------------------
    VINCENT DENG
    ------------------------------



  • 3.  RE: disk space consideration in executing soarMoveAttachments or soarSystemBackup

    Posted Mon October 23, 2023 09:44 AM

    Hi Vincent

    Thank you for your quick answers.

    I understand that both soarMoveAttachment and soarSystemBackup requires free space in volume group.

    Possible sizes: 

      5GB would be mostly enough for soarSystemBackup

       the size caluculated from du -sm for soarMoveAttachment. (may need more space for future attachments)

    ---



    ------------------------------
    Yohji Amano
    ------------------------------