IBM QRadar

 View Only

 QRadar storage migration

Vydenis Kucinskas's profile image
Vydenis Kucinskas posted Thu June 26, 2025 07:08 AM

Hi smart QRadar experts,

We have a dilemma.
We are running QRadar on an ESXi virtualization platform. QRadar has two hard disks attached — one is approximately 512 GB (QRadar software is installed on this disk), and later we added a 6 TB disk and expanded the existing /store storage.
So currently, we have sda with ~512 GB and sdb, a 6 TB thin-provisioned volume, mapped to /store.

The issue is that this 6 TB storage comes from a SAN, and we want to detach it from this server and instead attach a 3 TB storage device.

The question is:
Is there any solution to migrate the disks without breaking QRadar?
How can we safely attach the new disk, migrate all the data (logs, reports, etc. from /store) to it, and then detach the old disk?
Or would it be easier to install a fresh QRadar instance as per IBM’s migration instructions, and then restore the configuration and migrate the logs using IBM's scripts?

Best regards,
Vydenis

Dusan VIDOVIC's profile image
Dusan VIDOVIC posted Fri June 27, 2025 07:08 AM

I remember moving data from /store in a small disk to the vdisk added to the VM. I used some pointers from the Offboard storage guide. Have a look. 

Frank Eargle's profile image
Frank Eargle IBM Champion posted Fri June 27, 2025 09:15 AM

There is a fix pack being released with LVM support, so you could wait on that.

I have found that you can pretty much do all the *nix stuff on the file systems.  You could mount the new volume to /store1 or something, replicate the data and change the mount points to use the new mount.  However, doing this stuff on your own is not strictly supported by IBM.  They will help, but you are on your own. So waiting on the LVM support may be best. 

Related Content