QRadar: Converting RAID 0 to RAID 5 for QRadar Packet Capture on an IBM x3650 M4 appliance

Answer

If your storage needs change, or you want to add redundancy and further protect your data, you can convert the RAID level of your logical drives from RAID 0 to RAID 5.

Delete the QRadar® Packet Capture RAID 0 Virtual Drive:

1. Enter the System BIOS at POST (F1).
2. From System Settings menu, select Storage.
3. Select LSI MegaRAID ConfigurationUtility.
4. From the Main Menu, select Virtual Drive Management.
5. Select Virtual Drive 2, RAID0, 40978GB, Optimal.
6. From the Select Operation option, select Delete Virtual Drive and then select Go.
7. Select Confirm, and select yes to confirm deleting the virtual drive.
8. Select OK when prompted that the operation finished successfully.

1. Select RAID Level <RAID5>.
2. Clear the Secure Virtual Disk option.
3. Clear the Use Data Protection option.
4. Select Physical Disks From <Unconfigured Capacity>.
5. Under the Select Physical Disks menu, select Media Type <HDD>.
6. Select Interface Type <SAS>.
7. Confirm Logical Sector <512 B>
8. Choose Unconfigured Physical Disks.
9. Click Check All to select every remaining drive (11 drives).
10. Click Apply Changes.
11. Click OK when prompted that the operation finished successfully.

1. Set the virtual disk parameters to match the following:
   

Parameter	Setting
Virtual Drive Name	Use the default setting.
Virtual Drive Size	[37252]
Virtual Drive Size Unit	GB
Strip Element Size	1 MB
Read Policy	Read Ahead
Write Policy	Force Write Back
I/O Policy	Direct
Access Policy	Read/Write
Drive Cache	Enable
Disable Background Initialization	No
Default Initialization	Fast

3. Click Save Configuration.
4. Click Confirm, and click Yes to confirm that you want to delete the virtual drive.
5. Click OK.
   
   
   
   
   Where do you find more information?

   ---