000029173 - How to configure a WARM Tier on an RSA Security Analytics 10.4 Archiver

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000029173
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.4.x
Platform: CentOS
O/S Version: EL6
ResolutionIn order to create a WARM tier on an RSA Security Analytics Archiver appliance, follow the steps below.
1. Create an NFS mount on the NAS, e.g: /mnt/Archiver.
2. Verify that the NFS mount is reachable from the Archiver.  In the example below, is the IP address of the NAS.
[root@saarchiver archiver]# showmount -e
Export list for
/mnt/Archiver (everyone)

3. Create a directory on the Archiver to mount the NFS.
mkdir /var/netwitness/archiver/nas

4. Add the NFS mount to /etc/fstab. /var/netwitness/archiver/nas nfs rw,nolock,tcp,auto,addr= 0 0

5.  Issue the command mount -a to apply the change.
6. Verify the change with the df -h command, which should show output similar to the example below.
                       96G  223M   96G   1% /var/netwitness/archiver/nas

7. In the Security Analytics UI, navigate to Administration -> Services, click on the Action button for the Archiver, select View -> Config, and click on Add Tier.
User-added image

8. Configure the following under Warm tab then click the Save button:
User-added image

9. Click on the Apply button.
User-added image

10. At the prompt, click the Yes button.
User-added image
11. Once the Archiver service is back up, verify that it is seeing the Warm storage.
 User-added image

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.