External storage limitations

Multiple systems cannot access the same block device in an IBM QRadar deployment.

If you configure iSCSI in an HA environment, do not mount the iSCSI or Fibre Channel volumes on the secondary host while the primary host is accessing the volumes.

An external storage device must be able to provide consistent read and write capacity of 100 MBps to 200 MBps. When consistent read and write capacity is not available, the following issues might occur:

• Data write performance is impacted.
• Search performance is impacted.

If performance continues to degrade, then the processing pipeline can become blocked and QRadar might display warning messages and drop events and flows.