File system options for offboard storage

Use an offboard storage solution to move the /store file system or specific subdirectories, such as the /store/ariel directory.

You can move the /store file system to increase the fault tolerance levels in your IBM QRadar deployment. Each option impacts QRadar performance.

The /store/ariel directory is the most common file system that is moved to an offboard storage solution. By moving the /store/ariel file system, you can move collected log and network activity data to external storage. The local disk remains used for the PostgreSQL database and for temporary search results.

Administrators can move the following types of QRadar® data to offboard storage devices:

• PostgreSQL metadata and configuration information
• Log activity, payloads (raw data), normalized data, and indexes
• Network activity, payloads, normalized data, and indexes
• Time series graphs (global views and aggregates)