000029173 - How to configure a WARM Tier on an RSA Security Analytics 10.4 and above Archiver

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Jul 24, 2019
Version 9Show Document
  • View in full screen mode

Article Content

Article Number000029173
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.4.x, 10.6.X, 11.X
Platform: CentOS
O/S Version: EL6
ResolutionIn order to create a WARM tier on an RSA Security Analytics Archiver appliance, follow the steps below.
  1. Create an NFS mount on the NAS, e.g: /mnt/Archiver.
  2. Verify that the NFS mount is reachable from the Archiver.  In the example below, 10.44.10.68 is the IP address of the NAS.

    [root@saarchiver archiver]# showmount -e 10.44.10.68
    Export list for 10.44.10.68:
    /mnt/Archiver (everyone)

  3. Create a directory on the Archiver to mount the NFS.

    mkdir /var/netwitness/archiver/nas

  4. Add the NFS mount to /etc/fstab.

    10.44.10.68:/mnt/Archiver /var/netwitness/archiver/nas nfs rw,nolock,tcp,auto,addr=10.44.10.68 0 0

  5. Issue the command mount -a to apply the change.  
  6. Verify the change with the df -h command, which should show output similar to the example below.

    10.44.10.68:/mnt/Archiver
                           96G  223M   96G   1% /var/netwitness/archiver/nas

    Note: Step 7,8 and 9 applicable to 10.4.X version.
     
  7. In the Security Analytics UI, navigate to Administration -> Services, click on the Action button for the Archiver, select View -> Config, and click on Add Tier.  
    User-added image

  8. Configure the following under Warm tab then click the Save button:  
    User-added image

  9. Click on the Apply button.
    User-added image

     
    Note: Step A and B applicable to 10.6 and 11.X versions.

    1. Click on Settings button highlighted below.
        warm1
    2. Configure mount directory as below and click Save.
       
        warm2
  10. At the prompt, click the Yes button.
    User-added image 
  11. Once the Archiver service is back up, verify that it is seeing the Warm storage.
     User-added image

     

    If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

    Please use below documents as a reference for warm storage configuration.
    Configure Total Warm Storage for an Archiver in 11.X
    Configure Total Warm Storage for an Archiver in 10.6

Attachments

    Outcomes