IBM Support

What is a QRadar Data Node Appliance?

Question & Answer


Question

What is a QRadar Data Node appliance? How is it installed and deployed? Can you give me an example of how this appliance fits in the QRadar architecture?

Answer

What is a data node?

A data node appliance is offered as an appliance, software install on your own hardware, or offered as a VM license. Data node in essence is a dedicated storage and search appliance that allows Event Processors(EP)/Flow Processors(FP) to scale up capability by adding snap-in storage and search performance. These appliances can be added to event or flow processors at any time. As data comes in, the EP/FP distributes the data across however many nodes are available to the EP/FP, which provides a significant search improvement and storage improvement.  As data nodes are added, the systems automatically balances incoming event or flow data across the EP or FP that they are attach to.

What QRadar software version is required?

Data Node appliances were released with QRadar 7.2.2. If your Console is installed with QRadar 7.2.2 or above, then you have the option to purchase and add data node appliances or data node virtual appliances to your Event Processors or Flow Processors.

If you are at QRadar 7.2.1 or below, then data nodes are not supported in your deployment. To install data nodes, your QRadar deployment needs to be installed with QRadar 7.2.2.820171 or above.

Can you give me an example of what data nodes do?

For example, a deployment has an event processor is receiving 20,000 events per second. As you start adding data nodes (appliances or VMs) the EP is going to look for available data nodes and start to automatically start distributing events across each available node. If the deployment has an EP and three data nodes, the 20,000 EPS is going to be broken down to 5,000 EPS across each device. This means that 5,000 EPS going to the storage on the EP appliance and 5,000 EPS going to each of the three attached data nodes. The EP is still processing all of the events, but data nodes provide the existing EP with additional storage, indexing, and search functionality to improve overall performance.

I am reaching the storage limit and my data is compressed making my searches slow. How does data node help?

Data nodes when added to an EP/FP will start to uncompress and move the existing data to distribute is across any nodes that are attached to the EP/FP. Data node is an easy way to add storage and also improve search performance at the same time as compared to just adding storage through a SAN. Data Node appliances ship with 48TB of storage (40TB usable for event and flow storage). For more information on Data Node appliances, administrators can review the QRadar Hardware Guide.

How many data nodes can I have?

There is no limit to the number of data nodes that you can have in your deployment.

What happens when a node drops offline?

When a data node drops offline, then the system rebalances and redistributes the incoming events to any available data nodes.

How to I size a virtual data node appliance?

The QRadar Hardware Guide provides some info on default storage capabilities of the Data Node Appliance. As always, if you are installing a virtual version of an appliance we recommend that administrators review the hardware specification to ensure that the virtual appliance meets the specifications of the physical appliance. The purpose of this recommendation is to ensure that virtual data node installations include enough resources and storage to operate as intended in a deployment.


 


 

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Hardware and Firmware","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
31 March 2020

UID

swg21682128