QRadar: Checklist for GlusterFS to Distributed Replication Block Device Migration on Event Collectors

Answer

1. Check whether you have Event Collectors in your deployment. This can be found by:
   1. Log in to the Console UI as an admin user.
   2. Click Admin tab > System Configuration > System and License Management.
   3. Under the System and License Management user interface, in the Version column, confirm whether the Event Collectors are all at a version lower than 7.4.2.
2. Ensure that bidirectional SSH is working between the console and all the Event Collectors in the deployment. In case bidirectional SSH is not working, use this article to troubleshoot and fix the issues.
3. On each Event Collector, ensure that /storetmp has enough space. By default, the migration script takes a backup of /store and stores it on /storetmp. The unused space on the /storetmp partition needs to be greater than the space that is used on the /store partition. You can use the df command with the -h parameter to list the partitions along with the details on used and unused space on each partition.
   
   For example, consider this output:

   Filesystem                        Size  Used Avail Use% Mounted on
   /dev/mapper/storerhel-store       365G   8G  311G  15% /store
   /dev/mapper/rootrhel-storetmp      15G   35M   15G   1% /storetmp
   

   This space usage is suitable as the used space of /store is 8 GB and the unused space of /storetmp is 15 GB.
4. Ensure that disk space on the Event Collectors is greater than 256 GB. Disk capacity can be found by using the lsblk command:
    

   lsblk 
   Output : 
   NAME                     MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
   sda                        8:0    0   500G  0 disk 

5.  On each Event Collector, check whether the /store partition is available. If not available, then rebuild the Event Collector with a minimum 256 GB of disk space. Run this command on the Event Collector to verify the /store partition is available. If the Event Collector is in HA, run the command on the active Event Collector.
    

   df -h | grep -i /store

   For more details, visit this knowledge-base article.
6. Check the permissions assigned to the script. The permissions need to be -rwxr-xr-x or 755. On the QRadar console, check the file permission of the script (the file with the .bin extension) by using this command:
    

   ls -ltrh /opt/qradar/ha/bin/glusterfs_migration_manager-<script_version>.bin
   

7. Ensure the hostnames of the Event Collectors in the deployment do not exceed 54 characters. More details about this limitation and the workaround can be found in this article.
8. If the entry for /store in the Event Collector's /etc/fstab has the filesystem type set to ext4, you are likely to encounter symptoms mentioned in this article. Use the instructions provided there to fix the issue.