External storage options

You can use iSCSI, Fibre Channel, or Network File System (NFS) to provide an offboard storage solution.

Onboard disks provide a low latency and high throughput storage solution, which is tested and validated with various workloads. When multiple appliances are deployed, performance and capacity scale at the same rate.

Fibre Channel
Fibre Channel provides the fastest offboard performance by using storage area network (SAN) speeds of 200 MBps to 3200 MBps, depending on your network configuration.
Fibre Channel performance might be impacted by factors within the SAN implementation, such as the following factors:
  • Disk or spindle counts per volume
  • Number of concurrent sessions
  • Cache capacity in the SAN controllers
iSCSI
iSCSI uses a dedicated storage channel over standard Ethernet infrastructure, rather than a dedicated SAN network. For this reason, iSCSI can be the easiest to implement, most cost effective, and most readily available.
If you implement an iSCSI solution, then network capacity is shared between external storage access and management interface I/O. In this situation, you can configure a secondary network interface on a separate storage network.
QRadar® supports 1 Gbit and 10 Gbit connectivity out of the box on many appliances.
NFS
Warning:

Large backups, such as data backups, can take a long time to complete because the backups are generated directly in the mounted folder over the network. Unless a network interruption occurs, these backups usually complete successfully, but can take 14-19 hours. As an alternative, you could leave your backup directory local and have a script copy the backup to a mounted NFS share.

If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by IBM® QRadar.

If you choose to use NFS or a Windows share anyway, they can be used only for daily backup data, such as the /store/backup directory. You cannot use NFS or a Windows share for storing active data, which includes the PostgreSQL and ariel databases. If you do use NFS or a Windows share, they might cause database corruption or performance issues.

Use NFS for tasks during off-peak times, tasks that involve batch file writes, and tasks that involve a limited volume of file I/O. For example, use NFS for daily configuration and data backups.
NFS storage operates over existing management Ethernet networks and is limited by networking performance. It is possible to use a dedicated network interface to improve networking performance when compared to sharing a management interface. The NFS protocol might affect performance for file access, locking, and network permissions.
If NFS is used only for backups, the same NFS share can be used for each host. The backup files contain the system host name, which enables the identification of each backup file. If you are storing a long period of data on your NFS shares, consider a separate share or export for each appliance in your deployment.