Question & Answer
Question
Can we change QRadar RAID 6 to a different RAID type?
Cause
Raid 6 is not enabled by default. When purchasing a XSeries server, RAID 6 is an option that must be licensed and paid for separately. These options are called "Feature on Demand" (FoD).
Answer
If you are using a QRadar appliance, it is not recommend to change raid settings.
- If you have an older QRadar Appliance with configuration of 2 disks in raid 1, and 10 in raid 5, that was done because the Linux Kernel was only capable of supporting up to a 16 Terabyte (TB) block devices. QRadar was configured with 2 drives in raid 1 for the operating system and the remaining 10 drives in a combination of raid 5 (with a hot spare) or raid 6 (double parity), depending on build date.
- Newer releases of RHEL OS (6.4 or higher) have allowed us to support up to 100 TB block devices, so we are now using a raid 6 configuration.
- Raid 6 on QRadar appliances, gives the best performance to disk utilization and its what is supported by QRadar.
Where do you find more information?
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
30 November 2018
UID
ibm10740505