Performance impact of offboard storage solutions

Moving the /store file system to an external device might affect QRadar performance.

After the migration, all data I/O to the /store file system is no longer performed on the local disk. Before you move your QRadar data to an external storage device you must consider the following information:

• Maintain your log and network activity searches on your local disk by mounting the /store/transient file system to the unused /store file partition.
• Searches that are marked as saved are also in the /store/transient directory. If you experience a local disk failure, these searches are not saved.