Adding storage to your IBM QRadar Network Packet Capture appliance

New in 7.4.1

Follow these steps to add direct-attached storage (DAS) devices to your IBM® QRadar® Network Packet Capture appliance.

  1. Back up the configuration of your packet capture appliance.
  2. Attach the DAS devices.
  3. Reinstall the QRadar Network Packet Capture software.

    You must install IBM QRadar Network Packet Capture 7.4.1 (Build 1110) or later.

  4. Restore the configuration backup.
  5. Verify that the increased storage appears as expected in QRadar Network Packet Capture.

Failure to follow these procedures might result in the loss of configuration data on the appliance, or the appliance might not be able to use the new DAS devices.

Warning: When you reinstall the software, the existing storage array is destroyed, and all packet capture data is lost. The packet capture data is not included in the configuration backup and cannot be restored.

Procedure

  1. Back up the configuration files for the appliance.
    1. Log in to the QRadar Network Packet Capture appliance.
    2. Click ADMIN.
    3. Click Backup.
      A .json file is created that includes all of the custom configuration changes that were made to the system. The file is automatically downloaded to your local computer.
  2. Connect the DAS devices to the server.
    The following image shows a QRadar Network Packet Capture-C 40 GB appliance with three attached DAS devices.
    Image showing the back panels of the QRadar Network Packet Capture-C appliance with three DAS devices connected.
    The following image shows a QRadar Network Packet Capture 10 GB appliance with eight DAS devices attached. The blue cables are required to connect the devices. The red cables provide cable redundancy, therefore, they are optional.
    The image shows a QRadar Network Packet Capture 10 GB appliance with eight DAS devices connected.
  3. Install the QRadar Network Packet Capture software.
    For more information, see Installing QRadar Network Packet Capture on IBM hardware.

    The installation process automatically includes the DAS storage when it builds the new RAID-5 storage array.

  4. Restore the configuration from the backup file.
    1. Log in to the QRadar Network Packet Capture appliance.
    2. Click ADMIN.
    3. Click Restore and select the configuration backup file.
  5. Log in to the appliance and verify that the increased storage capacity is shown.
    The total storage capacity depends on the number of DAS devices that are connected. The storage capacity in your deployment may be different than what is shown in the following image.
    Figure 1. Increased storage capacity shown on the Network Packet Capture dashboard
    The image shows the Dashboard tab in the Network Packet Capture interface. The Storage information box shows the combined internal and external storage capacity.