HA overview

If your hardware or network fails, IBM® QRadar® can continue to collect, store, and process event and flow data by using high-availability (HA) appliances.

To enable HA, QRadar connects a primary HA host with a secondary HA host to create an HA cluster.

If a primary HA host fails, then the secondary HA host maintains access to the same data as the primary by using data synchronization or shared external storage.

The secondary HA host inherits the license from the primary HA host. There is no need to apply a separate license to the secondary host.

For more information about using shared external storage with HA, for example iSCSI, Fibre Channel, or NFS, see the IBM Security QRadar Offboard Storage Guide.

Unless otherwise noted, all references to QRadar refer to QRadar SIEM and IBM QRadar Log Manager.

You can use HA on hardware or virtual appliances, and with either appliance or software installations, if you meet the HA requirements. HA is not supported in cloud environments, such as Amazon Web Services (AWS) or Microsoft Azure. Security Technical Implementation Guide (STIG) is not supported in QRadar high-availability (HA) deployments.