IBM QRadar

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Hello Karl,

Thank you for this beautiful piece of information.

So the storage size on both VMs doesn't necessary need to match. I want to confirm the storage space on the primary and use it as my storage requirement.

Is that okay?

Again, i ran the df -h command to know the disk size on my VM , but i see a lot of partitions. see attachment.

Though i plan getting the size from the virtualized environment (ESXI).

Regards,

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Benjamin,

thanks for the screenshot. Go ahead with your plan to use primary disk size as template for your secondary, i.e. setup your 2nd VM using same disk size. This will result in the same disk partitioning during install as your primary has. You got /store and /transient with plenty of space left on primary.

BR,

Karl

Hello Karl,

Thank you for this beautiful piece of information.

So the storage size on both VMs doesn't necessary need to match. I want to confirm the storage space on the primary and use it as my storage requirement.

Is that okay?

Again, i ran the df -h command to know the disk size on my VM , but i see a lot of partitions. see attachment.

Though i plan getting the size from the virtualized environment (ESXI).

Regards,

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Hello Karl,

Thank you for your response. The primary has a size of 4.8 TB , but i recommended 5 TB for the secondary node. Hope this is fine.

Regards,

Benjamin,

thanks for the screenshot. Go ahead with your plan to use primary disk size as template for your secondary, i.e. setup your 2nd VM using same disk size. This will result in the same disk partitioning during install as your primary has. You got /store and /transient with plenty of space left on primary.

BR,

Karl

Hello Karl,

Thank you for this beautiful piece of information.

So the storage size on both VMs doesn't necessary need to match. I want to confirm the storage space on the primary and use it as my storage requirement.

Is that okay?

Again, i ran the df -h command to know the disk size on my VM , but i see a lot of partitions. see attachment.

Though i plan getting the size from the virtualized environment (ESXI).

Regards,

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Hi Benjamin,

as I wrote in my other post, normally you do an Appliance Install for VMWare and HyperV VMs during the installation. The installation type "Software" is only intended for the case when you use unsupported hardware, i.e. your own hardware or other hypervisors.

With the Appliance Install, QRadar takes care of the partitioning.

However, you do not need HA on virtual machines! HA only covers hardware failures, if the QRadar software has a failure, this is usually not covered by HA. Taking a Snapshot will be much more efficient than adding complexity by adding a secondary HA host.

The only reason I can think of to set up an HA cluster on VMs is to test something.

Hello Karl,

Thank you for your response. The primary has a size of 4.8 TB , but i recommended 5 TB for the secondary node. Hope this is fine.

Regards,

Benjamin,

thanks for the screenshot. Go ahead with your plan to use primary disk size as template for your secondary, i.e. setup your 2nd VM using same disk size. This will result in the same disk partitioning during install as your primary has. You got /store and /transient with plenty of space left on primary.

BR,

Karl

Hello Karl,

Thank you for this beautiful piece of information.

So the storage size on both VMs doesn't necessary need to match. I want to confirm the storage space on the primary and use it as my storage requirement.

Is that okay?

Again, i ran the df -h command to know the disk size on my VM , but i see a lot of partitions. see attachment.

Though i plan getting the size from the virtualized environment (ESXI).

Regards,

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Hello Oliver,

Thank you for the feedback.

I want to achieve the below on my QRadar VMs, are you saying with VMs i can't.

When a primary or secondary high-availability (HA) host fails, IBM QRadar maintains data consistency.
The following scenarios cause failover:
• A power supply failure.
• A network failure that is detected by network connectivity tests.
• An operating system malfunction that delays or stops the heartbeat ping tests.
• A complete Redundant Array of Independent Disks (RAID) failure on the primary HA host.
• A manual failover.

Regards

Hi Benjamin,

as I wrote in my other post, normally you do an Appliance Install for VMWare and HyperV VMs during the installation. The installation type "Software" is only intended for the case when you use unsupported hardware, i.e. your own hardware or other hypervisors.

With the Appliance Install, QRadar takes care of the partitioning.

However, you do not need HA on virtual machines! HA only covers hardware failures, if the QRadar software has a failure, this is usually not covered by HA. Taking a Snapshot will be much more efficient than adding complexity by adding a secondary HA host.

The only reason I can think of to set up an HA cluster on VMs is to test something.

Hello Karl,

Thank you for your response. The primary has a size of 4.8 TB , but i recommended 5 TB for the secondary node. Hope this is fine.

Regards,

Benjamin,

thanks for the screenshot. Go ahead with your plan to use primary disk size as template for your secondary, i.e. setup your 2nd VM using same disk size. This will result in the same disk partitioning during install as your primary has. You got /store and /transient with plenty of space left on primary.

BR,

Karl

Hello Karl,

Thank you for this beautiful piece of information.

So the storage size on both VMs doesn't necessary need to match. I want to confirm the storage space on the primary and use it as my storage requirement.

Is that okay?

Again, i ran the df -h command to know the disk size on my VM , but i see a lot of partitions. see attachment.

Though i plan getting the size from the virtualized environment (ESXI).

Regards,

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks

Benjamin,

thanks for the screenshot. Go ahead with your plan to use primary disk size as template for your secondary, i.e. setup your 2nd VM using same disk size. This will result in the same disk partitioning during install as your primary has. You got /store and /transient with plenty of space left on primary.

BR,

Karl

Hello Karl,

Thank you for this beautiful piece of information.

So the storage size on both VMs doesn't necessary need to match. I want to confirm the storage space on the primary and use it as my storage requirement.

Is that okay?

Again, i ran the df -h command to know the disk size on my VM , but i see a lot of partitions. see attachment.

Though i plan getting the size from the virtualized environment (ESXI).

Regards,

Benjamin,

you are referring to the requirements for a physical appliance based HA setup. The scenario described is just an example. Generally appliances should have the same partition layout and fulfill the storage requirements listed. When you are using virtual appliances please look at HA: system requirements for virtual appliances

Your virtual appliance must have at least 256 GB of storage available. After HA config is completed primary and secondary will get replicated (synced) and partitioning will be  setup automatically for the two hosts to meet HA requirements.

BR

Karl

Hello Experts,

I want to set up a secondary QRadar for HA implementation. 

One of the HA requirements is that the /store on the primary has to be equal or larger than the combined size of the /store and /transient.

I want to know how do I achieve this size match? I am using a Virtual QRadar appliance.

Thank You. I await feedbacks