IBM Security QRadar

 View Only

  • 1.  EXTERNAL STORAGE - shared /store All-in-One

    Posted Fri September 23, 2022 10:31 AM


    Hi IBM Team,

    we wanted to know whether above scenario is possible with single shared storage between two VM's on Separate physical host using Fibre Channel with SAN Storage.

    do we need 30 TB shared storage single storage attached with both Physical Server or 2x30 TB storage? 30 TB with Server 1 and another 30 TB with server 2

    we are also using VMware ESXi where we are using below settings

    Virtual Machine - 1(Physical Server - 1)
    HDD1
    Type : Thin Provisioned
    Disk File : QRadar_VM1_1.vmdk
    Shares : Normal
    Limit - IOPs : Unlimited
    Controller location : SCSI Controller 1
    Disk mode : Dependent


    HDD2 (Shared /store by Raw Disk Mapping)
    Disk File : QRadar_VM1_2.vmdk
    Controller location : SCSI Controller 1
    Disk Mode : Independent - persistent
    Disk compatibility : Physical

    Virtual Machine - 2 (Physical Server - 2)
    HDD1
    Type : Thin Provisioned
    Disk File : QRadar_VM2_1.vmdk
    Shares : Normal
    Limit - IOPs : Unlimited
    Controller location : SCSI Controller 1
    Disk mode : Dependent


    HDD2 (Shared /store by Raw Disk Mapping)
    Disk File : QRadar_VM1_2.vmdk
    Controller location : SCSI Controller 1
    Disk Mode : Independent - persistent
    Disk compatibility : Physical

    Output to validate FC
    [root@QRTEST01 ~]# ls -l /dev/disk/by-path/*-fc-*
    ls: cannot access /dev/disk/by-path/*-fc-*: No such file or directory
    [root@QRTEST01 ~]#


    Additionally can we do this on single Physical server with shared storage?
    below issue happened when we was using 2 VM on same Physical host.
    i followed all steps from the storage offboard Guide but after adding Both host to HA. Primary and Secondary QRadar machine shows offline state.
    [root@QRTEST01-primary ~]# /opt/qradar/ha/bin/ha cstate
    Local: R:PRIMARY S:OFFLINE/SYNCHRONIZING CS:NONE P:1.0 HBC:UP RTT:1 I:0 SI:3527750
    Remote: R:SECONDARY S:OFFLINE/INSTALL CS:NONE P:0.0 HBC:UP RTT:1 I:12921 SI:32721246

    Please Help how this issue can be resolve



    ------------------------------
    Jaswinder Singh
    ------------------------------


  • 2.  RE: EXTERNAL STORAGE - shared /store All-in-One

    Posted Sun June 18, 2023 08:03 AM

    Hello Jaswinder,

    Did the above Arch worked with you or not.

    Thanks



    ------------------------------
    M R
    ------------------------------

    Original Message


  • 3.  RE: EXTERNAL STORAGE - shared /store All-in-One

    Posted Sun June 18, 2023 09:05 AM
    Hi Team.

    Below was failed while adding HA to Deployment. but IBM suggested to use SCSI Channel instead of fiber channel (I don't know why IBM suggested SCSI) and make sure both VMs are running on separate physical hosts.

    In my case i was running both Primary and HA VM on same host i believe this was the reason of failing. You can try installing VMs on saparte host and point to shared storage and let us know as well if this works for you.

    Thanks & Regards,
    Jaswinder Singh



    Original Message