IBM Support

QRadar: Supported RAID levels on QRadar Appliances

Question & Answer


Can we change QRadar RAID 6 to a different RAID type?


Raid 6 is not enabled by default. When purchasing a XSeries server, RAID 6 is an option that must be licensed and paid for separately. These options are called "Feature on Demand" (FoD).


If you are using a QRadar appliance, it is not recommend to change raid settings.


  • If you have an older QRadar Appliance with configuration of 2 disks in raid 1, and 10 in raid 5, that was done because the Linux Kernel was only capable of supporting up to a 16 Terabyte (TB) block devices. QRadar was configured with 2 drives in raid 1 for the operating system and the remaining 10 drives in a combination of raid 5 (with a hot spare) or raid 6 (double parity), depending on build date.
  • Newer releases of RHEL OS (6.4 or higher) have allowed us to support up to 100 TB block devices, so we are now using a raid 6 configuration.
  • Raid 6 on QRadar appliances, gives the best performance to disk utilization and its what is supported by QRadar.

Where do you find more information?


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
30 November 2018