IBM QRadar

 View Only
Expand all | Collapse all

QRadar /store disk expansion

  • 1.  QRadar /store disk expansion

    Posted Tue April 09, 2024 07:42 PM

    Hello,

    I have a QRadar setup with Master Console, AppHost, couple of EPs running the 7.5 version of the code. On the Event Processor, the disk is running out of space for the /store partition.  This is deployed on a VMware environment.

    Could someone please let me know the procedure to increase the disk partition by attaching another disk?

    Regards,

    Umamaheshwar



    ------------------------------
    Umamaheshwara Manekar
    ------------------------------


  • 2.  RE: QRadar /store disk expansion

    Posted Wed April 10, 2024 02:18 AM

    I suppose the standard LVM extension method still not officially supported by IBM, however this is the standard method for QROC (Qradar On Cloud) and it is working perfectly. So, just google 'Extend LVM' and you'll find the solution at many sites. I have a document somewhere with all the steps required to extend /store by adding new disks, if I'll find it and noone else posting something similar I'll add it here, but again, this is just a Linux, so use standard tools



    ------------------------------
    László Pál
    ------------------------------



  • 3.  RE: QRadar /store disk expansion

    Posted Wed April 10, 2024 07:11 AM

    Hi

    The use of LVM to resize a disk in QRadara is not supported.  This can lead to data loss.

    https://www.ibm.com/support/pages/does-qradar-support-lvm-file-system-storage-expansion

    The methods listed in the above link should be used if additonal space is required

    Thanks



    ------------------------------
    John Dawson
    Qradar Support Architect
    IBM
    ------------------------------