Davin, you can do thin provisioning if your deployment is for lab, testing, poc, development environment. it will work. However AIO is constantly ingesting traffic, and constantly writing to two different databases, QRadar is very picky in IOPS. If you use thin provisioning, your hypervisor needs to allocate CPU clock to expand the disk as events/flows are coming in, thus affecting your performance. I have deployed distributed environment using Thin provisioning in the past, and we deployed thin provisioning to address the lack of space on the storage, but lots of events were being sent directly to the store llc, and the accumulator was also falling behind.
I would personally recommend thick provisioning.
in terms of disk configuration, my preferred method is to use in-box storage for events/flows and external iscsi for the backup.
The above is my personal opinion and may not be documented elsewhere.
------------------------------
Ditmar Tavares
------------------------------
Original Message:
Sent: Fri January 28, 2022 05:33 AM
From: Davin Ardian
Subject: QRadar Virtual Appliance Disk Provisioning Configuration
Hi Everyone,
Hope you all are doing good. I have a question regarding the QRadar console AIO installation on VM. on the disk provisioning configuration, can we set it to thin provisioning? because I check on the documentation for QRadar V7.4 (https://www.ibm.com/docs/en/qsip/7.4?topic=installations-system-requirements-virtual-appliances) and V7.5 (https://www.ibm.com/docs/en/qsip/7.5?topic=installations-system-requirements-virtual-appliances) there is no detailed explanation about the disk provisioning.
Has anyone tried to install the QRadar console AIO on the VM and share the experience regarding the disk provisioning configuration?
Thank you
------------------------------
Davin Ardian
------------------------------