Before you add a secondary appliance to your IBM® QRadar® host, you must review the hardware configuration differences between your primary and secondary appliances.
Appliances that you order as primary and secondary HA pairs are matched to ensure compatibility. However, replacing an appliance or adding HA to an older host with a different hardware configuration can lead to data replication issues. Data replication issues can occur when you replace end of life hardware or create primary and secondary HA pairs that have appliances from different manufacturers.
Partition requirements for /store
The combined size of the /store and /transient partitions on the secondary host must be equal to or larger than the /store partition on the primary host.
For example, do not pair a primary host that uses a 4 TB /store partition to a secondary host that has a 2 TB /store partition and a 1 TB /transient partition.
Follow these storage requirements when you replace an appliance:
- Ensure that the replacement appliance includes storage capacity that is equal to or greater than the original hardware you replace, and be at least 130 gigabytes (GB).
- Secondary replacement appliances can have larger storage capacity than the primary appliance. If so, partitions on the secondary are resized to match the storage capacity on the primary appliance when you configure the HA pair.
- Primary replacement appliances can have larger storage capacity than the secondary appliance. If so, partitions on the primary are resized to match the storage capacity on the secondary appliance when you configure the HA pair.
- If you replace both primary and secondary appliances, then the system resizes the storage partition that is based on the appliance with the smallest capacity.
- The primary host cannot contain more physical interfaces than the secondary.
During a failover, the network configuration of the primary is replicated to the secondary host. If the primary is configured with more interfaces, any additional interfaces cannot be replicated to the secondary during a failover.
- The secondary host must use the same management interface as the primary HA host.
If the primary HA host uses ens192, for example, as the management interface, the secondary HA host must also use ens192.
- The management interface supports one cluster virtual IP address.
- TCP port 7789 must be open and allow communication between the primary and secondary for
Distributed Replicated Block Device traffic.
Distributed Replicated Block Device traffic is responsible for disk replication and is bidirectional between the primary and secondary host.
- The QRadar software version must be identical between
the primary and secondary host before you pair a primary to a secondary appliance for the first
If the QRadar version between your primary and secondary differ, you must patch either the primary or secondary appliance to ensure both appliances use the same software version.
After the primary and secondary appliances are paired together, disk replication ensures that any additional software updates are also applied to the secondary.
- Ensure that the secondary host has a valid HA activation key.