IBM Support

QRadar: After a software installation of QRadar 7.5.0 the system fails to mount /store partition

Troubleshooting


Problem

Deploying a software installation of QRadar 7.5.0 the system fails to mount the /store partition, one reason is the /store partition was not created before the installation, use the following link as a guide when creating the partitions on your Red Hat Enterprise Linux server.

Symptom

When the disk free command is run, the following output is displayed:
df -h

Filesystem                        Size  Used Avail Use% Mounted on
devtmpfs                           16G  4.0K   16G   1% /dev
tmpfs                              16G     0   16G   0% /dev/shm
tmpfs                              16G  9.1M   16G   1% /run
tmpfs                              16G     0   16G   0% /sys/fs/cgroup
/dev/mapper/rootrhel-root          13G  3.5G  9.0G  29% /
/dev/mapper/rootrhel-storetmp      15G  4.5G   11G  30% /storetmp
/dev/mapper/rootrhel-tmp          3.0G   42M  3.0G   2% /tmp
/dev/mapper/rootrhel-opt           13G  4.2G  8.4G  34% /opt
/dev/mapper/rootrhel-home        1014M   33M  982M   4% /home
/dev/sda3                          32G  5.0G   28G  16% /recovery
/dev/sda2                        1014M  311M  704M  31% /boot
/dev/mapper/storerhel-transient    36G   37M   36G   1% /transient
/dev/mapper/rootrhel-var          5.0G  284M  4.8G   6% /var
/dev/mapper/rootrhel-varlog        15G  697M   15G   5% /var/log
/dev/mapper/rootrhel-varlogaudit  3.0G  101M  2.9G   4% /var/log/audit
tmpfs                             3.2G     0  3.2G   0% /run/user/0
Note: The Filesystem /dev/mapper/storerhel-store is not showing as mounted to /store.

Diagnosing The Problem

  1. Log in to the affected QRadar server as the root user.
  2. Change to the root directory. 
    cd /
  3. List the directory contents. 
    ls -l
    As you can see store is displayed, but appears as a folder under the root partition and not as a mount path. 
    total 10812
lrwxrwxrwx.   1 root   root         7 Jan  4  2022 bin -> usr/bin
dr-xr-xr-x.   4 root   root      4096 May 30 14:58 boot
drwxr-xr-x   21 root   root      3420 May 30 14:56 dev
drwxr-xr-x. 134 root   root     12288 May 30 14:54 etc
drwxr-xr-x.   9 root   root       119 May 30 14:54 home
lrwxrwxrwx.   1 root   root         7 Jan  4  2022 lib -> usr/lib
lrwxrwxrwx.   1 root   root         9 Jan  4  2022 lib64 -> usr/lib64
drwxr-xr-x.   5 root   root        48 Apr 28 09:14 media
drwxr-xr-x.   3 root   root        17 Jan  4  2022 mnt
drwxr-xr-x.  16 root   root       224 May 30 14:54 opt
dr-xr-xr-x  408 root   root         0 May 30 14:56 proc
drwxr-xr-x.   4 root   root        64 Jan  4  2022 recovery
dr-xr-x---.   7 root   root      4096 May 30 15:00 root
drwxr-xr-x   40 root   root      1180 May 30 14:58 run
lrwxrwxrwx.   1 root   root         8 Jan  4  2022 sbin -> usr/sbin
drwxr-xr-x.   2 root   root         6 Dec 14  2017 srv
-rw-r--r--    1 root   root   1569636 May 30 15:00 storcli.log
-rw-r--r--    1 root   root   3146662 May 30 12:26 storcli.log.1
-rw-r--r--    1 root   root   3146662 May 29 18:17 storcli.log.2
-rw-r--r--    1 root   root   3146662 May 29 12:53 storcli.log.3
drwxr-xr-x.   5 root   root        47 May 30 14:57 store
drwxr-xr-x.  27 nobody nobody    4096 May 30 14:58 storetmp
dr-xr-xr-x   13 root   root         0 May 30 15:00 sys
drwxrwxrwt.  67 root   root     12288 May 30 15:00 tmp
drwxrwxr-t.   7 root   siem       148 May 30 14:54 transient
drwxr-xr-x.  17 root   root       219 Apr 28 09:33 usr
drwxr-xr-x.  22 root   root      4096 Apr 27 14:00 var

     

Resolving The Problem

To resolve this issue, so /store mounts correctly, administrators need to edit the fstab file.
  1. Log in to the affected QRadar server as the root user.
  2. Run the command to display the contents of the fstab. 
    ​cat /etc/fstab
  3. Search in the output for the following line. If the line is not listed, administrators need to add it. 
    /dev/mapper/storerhel-store /store               xfs        inode64,logbsize=256k,noatime,nobarrier 0 0
  4. Stop the following services. 
    systemctl stop hostcontext
systemctl stop hostservices
    Note: If this procedure is being perfomed on a QRadar console also stop the tomcat service. 
    systemctl stop tomcat
  5. Rename /store, for example, you might rename it to/storecopy. 
    mv /store /storecopy
  6. Run the 'mount -a' command. This action mounts all filesystems (of the given types) mentioned in fstab. 
    mount -a
mount: mount point /store does not exist
    The directory for /store is created (you might have to wait a few minutes before the directory is displayed).
  7. Run the 'mount -a' command again, the Filesystem /dev/mapper/storerhel-store is mounted to the directory /store.
  8. Display the contents of the /store directory. 
    ls -l store
  9. If the /store directory is empty copy the contents from the /storecopy directory to /store. 
    cp -af /storecopy /store
  10. Run the disk free command and confirm the mount path is displayed. 
    df -h
Filesystem                        Size  Used Avail Use% Mounted on
devtmpfs                           16G  4.0K   16G   1% /dev
tmpfs                              16G     0   16G   0% /dev/shm
tmpfs                              16G  9.1M   16G   1% /run
tmpfs                              16G     0   16G   0% /sys/fs/cgroup
/dev/mapper/rootrhel-root          13G  3.5G  9.0G  29% /
/dev/mapper/rootrhel-storetmp      15G  4.5G   11G  30% /storetmp
/dev/mapper/rootrhel-tmp          3.0G   42M  3.0G   2% /tmp
/dev/mapper/rootrhel-opt           13G  4.2G  8.4G  34% /opt
/dev/mapper/rootrhel-home        1014M   33M  982M   4% /home
/dev/sda3                          32G  5.0G   28G  16% /recovery
/dev/sda2                        1014M  311M  704M  31% /boot
/dev/mapper/storerhel-transient    36G   37M   36G   1% /transient
/dev/mapper/rootrhel-var          5.0G  280M  4.8G   6% /var
/dev/mapper/rootrhel-varlog        15G  700M   15G   5% /var/log
/dev/mapper/rootrhel-varlogaudit  3.0G  101M  2.9G   4% /var/log/audit
tmpfs                             3.2G     0  3.2G   0% /run/user/0
/dev/mapper/storerhel-store       142G   36G  106G  25% /store
  11. Restart QRadar server. 
    reboot
  12. Remove the /storecopy directory. 
    rmdir /storecopy

    Results
    Confirm /store is mounted correctly by running the disk free command. 
    df -h
    The following mount is listed in the output. 
    /dev/mapper/storerhel-store       142G   28G  114G  20% /store
    Note: After completing the procedure the same issue exists, IBM recommends that the installation of the QRadar server is carried out again. Follow the recommended procedure in the attached QRadar: Software update checklist for administrators documentation.
    If you still expierence issues after the second deployment contact QRadar Support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwszAAA","label":"Install"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.0"}]

Document Information

Modified date:
08 June 2023

UID

ibm16959591

Page Feedback