IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  /store/ariel

    Posted Fri July 30, 2021 07:48 PM

    Hi All,

    in /store/ariel/events we have 3 files (Payloads, Records, UncompressedCache)

    Q1-> Where the actually data stores in for tenants?

    Q2-> What data is in Daily Backup (Payloads, Records, UncompressedCache)?

    Q3-> in /store/backup we have config and data.tgz. if we have a scenario for 1 -July to 10-July Day Daily backup on NFS Storage. now we want to restore the data(events) of First day i.e. 1-July. That day data(events) can be seen in 10-July Backup?

    • Night Backups are incremental?
      • Is Daily config.tgz backup is incremental?
      • Is Daily Data.tgz backup is incremental?

    Q4->What is difference in below paths means what is actual data for the backup?

    • /store/ariel/events/records/2021/
    • /store/ariel/events/records/aux/
    • /store/ariel/events/payloads/2021/
    • /store/ariel/events/payloads/aux/

    reason- we need to take one time backup of old Data e.g. our Daily Backup is started from 1 MAY and we need to copy the data for 1-JAN to 30-July (Entire Backup) which path is used for best practice.

    Please Help to Understand the above Query



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: /store/ariel

    Posted Mon August 02, 2021 04:18 AM

    A1 - Check Question-2 on this FAQ - https://www.ibm.com/support/pages/qradar-tenant-data-event-retention-or-flow-retention-faq

    A2 - Information about the backup data can be found here - https://www.ibm.com/docs/en/qsip/7.4?topic=administration-backup-recovery

    Suggestion - In stead of putting too many question on a single thread, try opening multiple question please.



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: /store/ariel

    Posted 7 days ago

    Instead of answering 4 questions, you are demanding that the man open a new thread. No wonder no one wants to work with IBM Qradar



    ------------------------------
    Or Mizrahi
    ------------------------------

    Original Message


  • 4.  RE: /store/ariel

    Posted 6 days ago

    Funny you should say that.  Our SOC monitors/uses many different SIEMS.  Splunk, Sentinel, FortiSiem, Datadog, LogRythym, and others.  Our Analysts (30+) say they can do twice as much in 1/2 the time with QRadar.  Yes I'm a champion and biased.  But it amazes me the analysts saying that even with the age of the the QR UI.  



    ------------------------------
    Frank Eargle
    Senior Information Security Architect
    GlassHouse Systems
    Columbia SC
    ------------------------------

    Original Message


  • 5.  RE: /store/ariel

    Posted 6 days ago

    1. All questions where already answered by the 2 documentation links provided... 
    2. The suggestion of creating specific and focused question is absolutely correct as it allows to have an efficient and focused conversation.

    Consider focusing on the subject matter and have a nice day!



    ------------------------------
    Perf1
    ------------------------------

    Original Message


  • 6.  RE: /store/ariel

    Posted 6 days ago

    All questions where already answered by the 2 documentation links provided, but to clarify a couple of points specifically:

    The data backup is Daily - specifically the last full day of data. To restore 1 day of data you restore the specific backup file for the desired day.

    Neither backups are incremental:
    - The config backup is a full backup, representing the configuration snapshot when taken.
    - The data backup is a host-specific daily backup of the last full calendar day of Ariel data on the host. It does not reflect any changes that might have occurred in the data older than the last calendar day.  



    ------------------------------
    Perf1
    ------------------------------

    Original Message


Related Content