Moving the /store/ariel file system to an iSCSI storage solution

You can migrate the IBM QRadar data that is maintained in the /store/ariel file system and mount the /store/ariel file system to an iSCSI device partition.

1. Stop the QRadar services by typing the following commands in the order specified:

   systemctl stop hostcontext
   systemctl stop ecs-ec-ingress
   systemctl stop tomcat
   systemctl stop hostservices
   systemctl stop systemStabMon
   systemctl stop crond

2. Move the existing mount point by typing the following commands:

   cd /store
   mv ariel ariel_old

3. Verify the Universally Unique Identifier (UUID) of the iSCSI device partition by typing the following command:

   blkid /dev/partition

4. Add the mount point for the /store/ariel file system by adding the following text to the /etc/fstab file:
   • If the file system is XFS, copy the following text into a text editor, remove the line break, and paste as a single line:

     UUID=uuid /store/ariel xfs inode64,logbsize=256k,noatime,
     noauto,_netdev 0 0

   • If the file system is ext4, add the following text

     UUID=uuid /store/ariel ext4 noatime,noauto,nobarrier,_netdev 0 0

     Note: The nobarrier option is not supported in Red Hat® Enterprise Linux® (RHEL) Version 8 operating system.
5. Create the ariel directory for the mount point by typing the following command:

   mkdir /store/ariel

6. Mount /store/ariel to the iSCSI device partition by typing the following command:

   mount /store/ariel

7. Verify that /store/ariel is correctly mounted by typing the following command:

   df -h

8. Move the data from the local disk to the iSCSI storage device by typing the following command:

   cp -af /store/ariel_old/* /store/ariel

9. Remove the /store/ariel_old directory by typing the following command:

   rmdir /store/ariel_old

10. Start the QRadar services by typing the following commands in the order specified:

    systemctl start crond
    systemctl start systemStabMon
    systemctl start hostservices
    systemctl start tomcat
    systemctl start ecs-ec-ingress
    systemctl start hostcontext