NFS offboard storage device
You can back up the IBM® QRadar® data to an external Network File System (NFS).
Large backups, such as data backups, can take a long time to complete because the backups are generated directly in the mounted folder over the network. Unless a network interruption occurs, these backups usually complete successfully, but can take 14-19 hours. As an alternative, you could leave your backup directory local and have a script copy the backup to a mounted NFS share.
If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by IBM QRadar.
If you choose to use NFS or a Windows share anyway, they can be used only for daily backup data, such as the /store/backup directory. You cannot use NFS or a Windows share for storing active data, which includes the PostgreSQL and ariel databases. If you do use NFS or a Windows share, they might cause database corruption or performance issues.
NFS storage with a stand-alone QRadar Console
To move backup files to NFS from a stand-alone QRadar Console, follow the instructions in Moving backups to an NFS.
NFS storage with a new HA deployment
To move backup files to NFS for a new HA deployment:
Follow the instructions in Moving backups to an NFS for your
primary HA appliance.- Follow the instructions in Configuring a mount point for a secondary HA host for your
secondary HA appliance.
- Create an HA cluster. For more information, see IBM
QRadar High Availability Guide.
NFS storage with an existing HA deployment
To move backup files from an existing HA deployment, follow the instructions in Configuring NFS backup on an existing HA cluster.