Question & Answer
Question
Is the use of HPFS for the /store or any other partition supported?
Cause
Depending on the version, QRadar uses ext3, ext4, or xfs filesystems. Use of other filesystems, such as HPFS, are not supported by IBM.
Answer
Use of other filesystems often require modifications to QRadar, such as installation of certain drivers. Installation of third-party software on a QRadar appliance is not supported and often causes issues as described in technote 1991208: QRadar: Support for installation of non-QRadar RPMs.
Furthermore, even when the conversion is made without extra software, filesystems used with QRadar appliances are selected, and carefully tested for their performance characteristics. Use of other filesystems, regardless of the expected performance, is outside of the tested parameters. This can lead to excessive problems such as issues around IO latency.
In conclusion, use of other filesystems, such as HPFS, are not supported by IBM. Such attempts to use nonsupported filesystems can results in data corruption, data loss, as well as performance problems and are not recommended or supported.
Furthermore, even when the conversion is made without extra software, filesystems used with QRadar appliances are selected, and carefully tested for their performance characteristics. Use of other filesystems, regardless of the expected performance, is outside of the tested parameters. This can lead to excessive problems such as issues around IO latency.
In conclusion, use of other filesystems, such as HPFS, are not supported by IBM. Such attempts to use nonsupported filesystems can results in data corruption, data loss, as well as performance problems and are not recommended or supported.
Warning:
If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by IBM QRadar.
If you choose to use NFS anyway, NFS can be used only for daily backup data, such as the /store/backup directory. You cannot use NFS for storing active data, which includes the PostgreSQL and ariel databases. If you do use NFS, it might cause database corruption or performance issues.
[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Operating System","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
19 October 2022
UID
swg21992358