LVM support

Logical Volume Manager (LVM) is a tool for managing disk storage space in Linux®. It provides a layer of abstraction between physical storage and the file system, allowing for flexible and dynamic storage allocation. LVM enables administrators to manage partitions, create logical volumes, and extend or reduce storage capacity without downtime.

Prerequisites

Warning:
  • Changing LVM configuration on a QRadar system might result in data loss and data corruption. Always perform a full back up of the system before you follow any LVM procedures.
  • Changing LVM and hard disk configuration on an appliance-installed system removes the ability to retain the data during a factory reinstall.
  • Extending storage on the /store directory in a high availability pair triggers a full synchronization. This can take a significant amount of time depending on the size of the /store and network configuration of the HA pair. During this time the high availability feature is not available.
  • To support LVM procedures on existing appliance-installed systems at QRadar 7.5.0 UP14 or earlier, the factory reinstall ISO needs to be replaced. For more information, see Applying LVM support to appliance-installed systems.
  • When rebuilding a system during an HA recovery restore, any LVM procedures applied to the rebuilt HA system previously needs to be applied again before adding the system back into the deployment.
  • When adding multiple disks into a volume group, the relative performance of each disk is significant. As much as possible, disk sizes within a volume group should be the same or similar. Each of the disks added to a volume group should have the same performance characteristics in terms of throughput and IOPS. If this consistency is not maintained, system performance is variable and unpredictable.
  • LVM expansion on systems by using LUKS encryption are only supported with logical volume encryption. Do not perform LVM procedures on systems with partition or hard disk level encryption.

Identifying installation type for QRadar

QRadar is installed by using either Software Install or Appliance Install method. To identify the installation type for QRadar, type the following command:
/opt/qradar/bin/myver -it
software
This command displays the installation type, which can be either software or appliance.
The following command provides another method of identifying Appliance Install. This file exists only on systems that are installed by using the Appliance Install method,
ls /etc/.is_appliance_install

An extra validation is to make sure that there is no /recovery partition in the server.

df -h | grep /recovery

Systems that are installed by using the Software Install method do not have a /recovery partition.

Identifying encryption level

The following command helps to identify the encryption level on the system for the /store logical volume:
xfs_info /store | grep meta-data | sed "s/meta-data=//" | cut -d " " -f1
Logical volume encryption gives an output similar to the following:
This type of encryption is supported: /dev/mapper/luks-86ceb52c-d656-42f3-b2a3-6157a4ffa7cd
Partition or disk level encryption gives an output similar to the following:
This type of encryption is supported: /dev/mapper/rhel-store