Prerequisites for installing QRadar on your hardware

Before you install the Red Hat® Enterprise Linux® (RHEL) operating system on your hardware, verify that your system meets the system requirements.

QRadar and RHEL version compatibility

The following table describes the version of Red Hat Enterprise Linux used with the IBM® QRadar® version.

Table 1. Red Hat version
IBM QRadar version Red Hat Enterprise Linux version
IBM QRadar 7.5.0 Red Hat Enterprise Linux V7.9 64-bit

The following table describes the system requirements:

Table 2. System requirements for RHEL installations on your own appliance

Requirement

Description

KickStart disks

Not supported

Network Time Protocol (NTP)

Optional

Not supported

If you want to use NTP as your time server, ensure that you install the NTP package.

Optional

If you want to use NTP as your time server, ensure that you install the Chrony package.

Firewall configuration

WWW (http, https) enabled

SSH-enabled

Hardware

See the following tables for memory, processor, and storage requirements.
Important: Upgrading to RHEL-8 on systems with LUKS encrypted partitions is not supported. Ensure that your deployment does not include hosts with LUKS encrypted partitions to successfully upgrade your system. For more information, see Known Limitations (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/upgrading_from_rhel_7_to_rhel_8/planning-an-upgrade_upgrading-from-rhel-7-to-rhel-8).

Memory and CPU requirements

If you use hardware that is not provided by IBM QRadar, verify that your appliance meets or exceeds the specifications for memory and CPU of the corresponding QRadar appliance. The corresponding QRadar xx05, xx29, or xx48 appliance specifications are based on factors such as the EPS, FPM, and performance requirements of your deployment. For information about the specifications of the QRadar appliances, see IBM QRadar Hardware Guide.

Important: You can change the memory or the CPU of your appliance by shutting down the appliance and making the changes. When you restart the appliance, the system detects the changes and adjusts the performance-related configuration. You must maintain the minimum requirements.

Storage requirements

Your appliance must have at least 256 GB of storage available.

The following table shows the storage requirements for installing QRadar on your hardware.

Important: The minimum required storage size varies based on factors such as event size, events per second (EPS), and retention requirements.
Table 3. Minimum storage requirements for appliances when you use the virtual or software installation option.
System classification Appliance information IOPS Data transfer rate (MB/s)
Minimum performance Supports XX05 licensing 800 500
Medium performance Supports XX29 licensing 1200 1000
High Performance Supports XX48 licensing 10,000 2000
Small All-in-One (Console) or 1600 Less than 500 EPS 300 300
Event/Flow Collectors Events and flows 300 300