LVM procedure for Azure non-HA systems

You can extend the storage capacity of Azure non-High Availability (HA) systems by using Logical Volume Manager (LVM) procedure.

Before you begin

Warning: Changing LVM configuration on a QRadar system might result in data loss and data corruption. Always take a full back up of the system before you start LVM procedure.

Procedure

  1. Create and attach an extra data disk to an Azure Linux® VM with QRadar installed. For more information, see Use the portal to attach a data disk to a Linux VM.
  2. Connect QRadar instance by using SSH and find the hard disk name (For example sdc1) by entering the following command:
    lsblk
  3. Create a partition table on the new hard disk by entering the following command:
    parted /dev/<HD name> mktable gpt
  4. Create a partition for the whole disk by entering the following command:
    parted /dev/<HD Name> mkpart xfs 1.00Mib 100%
  5. Search for the name of the new partition by entering the following command:
    lsblk
    Typically, the device name with the number 1 at the end is the partition name.
    For example, sdc1
  6. Create the physical volume (PV) for this hard disk (sdc1) by entering the following command:
    pvcreate /dev/<Partition name>
  7. To add the storage, locate the volume group (VG). For example, storerhel is the VG for the /store and /transient directories. Locate VG by entering the following command:
    vgs
  8. Extend the VG to include the space from the new partition by entering the following command:
    vgextend <Volume Group Name> /dev/<Partition name>
  9. Note: This step is only required for all-in-one consoles and console devices.
    It is recommended that all-in-one consoles and consoles devices have more storage on the transient and store volume. The transient volume occupies 20% of the available space and the store volume occupies 80% of the remaining space. This step is not required for any other type of appliances.
    Warning: If you are extending the transient logical volume, you must complete this step before you extend the store logical volume.

    Extend the transient logical volume by using 20% of the free space in the VG by entering the following command:

    lvextend -l +20%FREE /dev/<VG Name>/transient
  10. For all-in-one consoles and console devices it is advised to increase the amount of storage on the transient volume along with the store volume. 20% of the free space must go to the transient volume while the other 80% must be applied to the store volume. This step is not required for any other appliance type. Extend the space for store by 97% of the free space by entering the following command.
    lvextend -l +97%FREE /dev/<VG Name>/store
    Note: This step is only required for all-in-one consoles and console devices
    Warning: If you are extending the transient logical volume, this step must be completed before you extend the store logical volume.
  11. This step extends the amount of free space for the store logical volume. To use this system in a high availability environment, enough space must be available for the Distributed Replicated Block Device (DRBD) metadata in the logical volume. Hence, extend the space for store by 97% of the free space by entering the following command:
    lvextend -l +97%FREE /dev/<VG Name>/store
  12. You can search for the path for the store file system. Generally, the path is /dev/mapper/<VG name>-<LV Name>.

    For example, the path for the store file system is /dev/mapper/storerhel-store.

    To find the file system name of the /store directory, enter the following command:
    xfs_info /store | grep meta-data | sed "s/meta-data=//" | cut -d " " -f1
  13. Grow the file system to fill the free space on the store LV by entering the following command:
    xfs_growfs /dev/mapper/<VG Name>-<LV Name>
    Note: If storage was extended on the transient volume, you must grow the file system on the transient LV as well.
  14. The file system is expanded to fill the remaining free space in the LV. Type the following command to extend the store logical volume by 100% of the remaining space in the volume group, reserving space for DRBD metadata:
    lvextend -l +100%FREE /dev/<VG Name>/store