Appliance-installed systems

When you install a QRadar system by using the Appliance Install method, the install process creates and manipulates the partitions on the hard disk to a specific format while installing the Red Hat® operating system.

The specific format is used to give the ability to reset the system back to factory settings without requiring an ISO (factory reinstall). If Logical Volume Manager (LVM) or hard disk configuration is changed after an appliance is installed, the factory reinstall process might not revert the system back to the original factory settings.

The procedures for expanding storage on a system by using the LVM feature are as follows:

Applying LVM support to appliance-installed systems

LVM support is available on any system that is installed by using the Appliance Install method with the QRadar 7.5.0 UP14 ISO. LVM support is not available automatically for existing systems that are installed at a version earlier to 7.5.0 UP14, even when applying the QRadar 7.5.0 UP14 patch. To enable the LVM support feature on an existing system, the factory reinstall ISO needs to be replaced on the recovery partition.

To know more about replacing the factory reinstall ISO on the recovery partition, see QRadar®: How to upgrade the factory reinstall image from the recovery partition.

Appliance-installed scenarios

When you install a QRadar system by using the Appliance Install method, the following two scenarios are available.

Single hard disk scenario: When a system has just one hard disk available during the installation, the process creates all of the required partitions on that hard disk drive as per IBM® QRadar partition guidelines. The remaining space is used for the store and transient logical volumes depending on appliance type.

Multiple hard drive scenario: When a system has multiple hard disks available during installation, the first two hard disks are used for installing QRadar and the remaining hard disk are wiped out. The process creates all the required partitions except the store and transient logical volumes on the first hard disk with all remaining space being added to the root logical volume. The second hard disk is a single partition disk that is divided between store and transient logical volumes depending on the appliance type.

Appliance-installed features

The following features are available for appliance-installed systems:

Factory reinstall: The factory reinstall feature is the ability to reinstall the appliance with the original ISO in which it was created. It reinstalls QRadar and resets the appliance back to its original state if the LVM or hard disk configuration is not changed.
Warning: : If any LVM and hard disk configuration changes take place, you are not able to use the retain option during the factory reinstall. If LVM or hard disk configuration were changed, it is advised to revert all LVM and hard disk changes before you complete a factory reinstall.

High availability: The High Availability feature on appliance-installed systems requires the secondary host to have at least the same amount of space in the store logical volume as the primary host. The HA recovery restore process involves a factory reinstall and therefore works properly if the LVM or hard disk configuration is not changed.
Warning: Changing the configuration can result in the inability to perform an HA recovery restore of the system.