Hi,
we have problem with /store/ariel/events/payloads and records data in server event processor.
This server was running out of space on /store/ and the administrator connected the disk to a 2T virtual machine to free up space on /store
Administrator copy
/store/ariel/events/payloads/2020/4/* to /var/backup/store/ariel/events/payloads/2020/4/
/store/ariel/events/payloads/2020/5/* to /var/backup/store/ariel/events/payloads/2020/5/
/store/ariel/events/payloads/aux/3/2020/4/* to /var/backup/store/ariel/store/ariel/events/payloads/aux/3/2020/5/* to /events/payloads/aux/3/2020/4/
/var/backup/store/ariel/events/payloads/aux/3/2020/5/
/store/ariel/events/records/2020/4/* to /var/backup/store/ariel/events/records/2020/4/
/store/ariel/events/records/2020/4/* to /var/backup/store/ariel/events/records/2020/5/
/store/ariel/events/records/aux/3/2020/4/* to /var/backup/store/ariel/events/records/aux/3/2020/4/
/store/ariel/events/records/aux/3/2020/5/* to /var/backup/store/ariel/events/records/aux/3/2020/5/
After copying the data, we freed up space on /store/:
[rootSupport Member]# df -Th
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/rootrhel-root xfs 13G 2.8G 9.8G 22% /
devtmpfs devtmpfs 24G 0 24G 0% /dev
tmpfs tmpfs 24G 8.0K 24G 1% /dev/shm
tmpfs tmpfs 24G 2.4G 22G 10% /run
tmpfs tmpfs 24G 0 24G 0% /sys/fs/cgroup
/dev/sda3 xfs 32G 3.3G 29G 11% /recovery
/dev/sda2 xfs 1014M 210M 805M 21% /boot
/dev/mapper/rootrhel-tmp xfs 3.0G 60M 3.0G 2% /tmp
/dev/mapper/rootrhel-opt xfs 13G 5.2G 7.4G 42% /opt
/dev/mapper/rootrhel-var xfs 5.0G 228M 4.8G 5% /var
/dev/vda ext4 2.0T 716G 1.2T 38% /var/backup
/dev/mapper/rootrhel-home xfs 1014M 33M 982M 4% /home
/dev/mapper/rootrhel-storetmp xfs 15G 36M 15G 1% /storetmp
/dev/mapper/rootrhel-varlog xfs 15G 1.4G 14G 9% /var/log
/dev/mapper/rootrhel-varlogaudit xfs 3.0G 75M 3.0G 3% /var/log/audit
/dev/drbd0 xfs 4.8T 4.0T 780G 84% /store
tmpfs tmpfs 4.8G 0 4.8G 0% /run/user/0
But we wanted to check if the data will appear in the QRadar console if we restore the data.
Administrator copy data from /var/backup to:
/store/ariel/events/payloads/2020/4/1
/store/ariel/events/payloads/aux/3/2020/4/1
and
/store/ariel/events/records/2020/4/1
/store/ariel/events/records/aux/3/2020/4/1
In QRadam Console we can see data from the domain TenantID=3, but only named "Health Metrics-2 :: consola-qradar" and "System Notification-2 :: consola-qradar".
Could you help me with this problem?
#QRadar#Support#SupportMigration