NFS offboard storage device

You can back up the IBM® QRadar® data to an external Network File System (NFS).


Large backups, such as data backups, can take a long time to complete because the backups are generated directly in the mounted folder over the network. Unless a network interruption occurs, these backups usually complete successfully, but can take 14-19 hours. As an alternative, you could leave your backup directory local and have a script copy the backup to a mounted NFS share.

If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by IBM QRadar.

If you choose to use NFS or a Windows share anyway, they can be used only for daily backup data, such as the /store/backup directory. You cannot use NFS or a Windows share for storing active data, which includes the PostgreSQL and ariel databases. If you do use NFS or a Windows share, they might cause database corruption or performance issues.

NFS storage with a stand-alone QRadar Console

To move backup files to NFS from a stand-alone QRadar Console, follow the instructions in Moving backups to an NFS.

NFS storage with a new HA deployment

To move backup files to NFS for a new HA deployment:

NFS storage with an existing HA deployment

To move backup files from an existing HA deployment, follow the instructions in Configuring NFS backup on an existing HA cluster.