Configuring a mount point for a secondary HA host

On your existing secondary high-availability (HA) host, you must configure an NFS mount point for the alternative IBM QRadar backup file location.

Before you begin

Ensure that the HA secondary host can connect with the NFS server.

About this task

Warning:

Large backups, such as data backups, can take a long time to complete because the backups are generated directly in the mounted folder over the network. Unless a network interruption occurs, these backups usually complete successfully, but can take 14-19 hours. As an alternative, you could leave your backup directory local and have a script copy the backup to a mounted NFS share.

If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by IBM QRadar.

If you choose to use NFS or a Windows share anyway, they can be used only for daily backup data, such as the /store/backup directory. You cannot use NFS or a Windows share for storing active data, which includes the PostgreSQL and ariel databases. If you do use NFS or a Windows share, they might cause database corruption or performance issues.

Procedure

  1. Using SSH, log in to the QRadar secondary HA host as the root user:
  2. Create a backup file location that matches the backup file location on your primary HA host. The default location for QRadar backups is /store/backup.

    For more information, see Configuring NFS backup on an existing HA cluster.

    Restriction: Do not create your new backup location under the /store file system. Use a different directory, such as /backup or /nfs.
  3. Start the NFS services by typing the following commands:
    systemctl enable rpcbind
    systemctl start rpcbind
  4. Add the following line to the /etc/fstab file:
    <hostname>:<shared_directory> <backup_location> nfs
    rw,soft,intr,clientaddr=<HA_IP_address> 0 0
  5. Mount the new QRadar backup file location by typing the following command:
    mount <backup_location>