This topic contains the recommended Azure partition.
Admin Server or Broker
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome. If there are multiple disk, create a RAID 0 array.
Run lsblk to get the physical volume name.
If you attach one 2 TB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is /dev/sdc)
-
vgextend netwitness_vg00 /dev/sdc
-
lvextend –L 1.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
If you attach two 1 TB disk, run the following commands:
-
mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf
-
pvcreate /dev/md0
-
vgextend netwitness_vg00 /dev/md0
-
lvextend –L 1.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
-
mdadm --detail --scan > /etc/mdadm.conf
RSA recommends the following partition. However, you can change these values based on the retention days.
ESA Primary or ESA Secondary
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome. If there are multiple disk, create a RAID 0 array.
Run lsblk to get the physical volume name.
If you attach one 6 TB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is dev/sdc)
- vgextend netwitness_vg00 /dev/sdc
- lvextend –L 5.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
If you attach two 3 TB disk, run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf
- pvcreate /dev/md0
- vgextend netwitness_vg00 /dev/md0
-
lvextend –L 5.9T /dev/netwitness_vg00/nwhome
- xfs_growfs /dev/netwitness_vg00/nwhome
- mdadm --detail --scan > /etc/mdadm.conf
RSA recommends the following partition. However, you can change these values based on the retention days.
Log Collector
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome.
Run lsblk to get the physical volume name.
If you attach one 500 GB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is dev/sdc)
- vgextend netwitness_vg00 /dev/sdc
- lvextend –L 600G /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
RSA recommends the following partition. However, you can change these values based on the retention days.
Log Decoder
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome, and make sure that no other partition resides on this Log Decoder. Attach additional disks for the Log Decoder database partition with the name suffix external. If there are multiple disk, create a RAID 0 array.
Run lsblk to get the physical volume name.
If you attach one 2 TB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is dev/sdc)
- vgextend netwitness_vg00 /dev/sdc
- lvextend –L 1.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
If you attach two 1 TB disk, run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf
- pvcreate /dev/md0
- vgextend netwitness_vg00 /dev/md0
- lvextend –L 1.9T /dev/netwitness_vg00/nwhome
- xfs_growfs /dev/netwitness_vg00/nwhome
- mdadm --detail --scan > /etc/mdadm.conf
Other Partition Required
The following partition should be on the volume group logdecodersmall and should be in a single RAID 0 array.
Note: The following disks should have a suffix external.
Run lsblk to get the physical volume name and run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf (depending on the number of disk attached)
- pvcreate /dev/md0
- vgcreate –s 32 logdecodersmall /dev/md0
- lvcreate –L <disk_size> -n <lvm_name> logdecodersmall
- mkfs.xfs /dev/logdecodersmall/<lvm_name>
- Repeat steps 4 and 5 for all the LVMs mentioned.
- mdadm --detail --scan > /etc/mdadm.conf
The following partition should be on the volume group logdecoder and should be in a single RAID 0 array:
Run lsblk to get the physical volume name and run the following commands:
- mdadm --create /dev/md1 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf (depending on the number of disk attached)
- pvcreate /dev/md1
- vgcreate –s 32 logdecoder /dev/md1
- lvcreate –L <disk_size> -n packetdb logdecoder
- mkfs.xfs /dev/logdecoder/packetdb
- mdadm --detail --scan > /etc/mdadm.conf
RSA recommends the following partition. However, you can change these values based on the retention days.
Note: Create the /var/netwitness/logdecoder partition, mount it, and then create the remaining partition.
Create each directory and mount the LVM on it in a serial manner, except /var/netwitness, which is already created.
After mounting the directory, add the following entries in /etc/fstab in the same order:
- /dev/logdecodersmall/decoroot /var/netwitness/logdecoder xfs noatime,nosuid 1 2
- /dev/logdecodersmall/index /var/netwitness/logdecoder/index xfs noatime,nosuid 1 2
- /dev/logdecodersmall/metadb /var/netwitness/logdecoder/metadb xfs noatime,nosuid 1 2
- /dev/logdecodersmall/sessiondb /var/netwitness/logdecoder/sessiondb xfs noatime,nosuid 1 2
- /dev/logdecoder/packetdb /var/netwitness/logdecoder/packetdb xfs noatime,nosuid 1 2
Concentrator
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome, and make sure that no other partition resides on this Concentrator. Attach additional disks for the Concentrator database partition with the name suffix external. If there are multiple disk, create a RAID 0 array.
Run lsblk to get the physical volume name.
If you attach one 2 TB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is dev/sdc)
- vgextend netwitness_vg00 /dev/sdc
- lvextend –L 1.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
If you attach two 1 TB disk, run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf
- pvcreate /dev/md0
- vgextend netwitness_vg00 /dev/md0
- lvextend –L 1.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
- mdadm --detail --scan > /etc/mdadm.conf
Other Partition Required
The following partition should be on the volume group concentrator and should be in a single RAID 0 array.
Note: The following disks should have a suffix external.
Run lsblk to get the physical volume name and run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf (depending on the number of disk attached)
- pvcreate /dev/md0
- vgcreate –s 32 concentrator /dev/md0
- lvcreate –L <disk_size> -n <lvm_name> concentrator
- mkfs.xfs /dev/concentrator /<lvm_name>
- Repeat steps 4 and 5 for all the LVMs mentioned
- mdadm --detail --scan > /etc/mdadm.conf
The following partition should be on volume group index and should be in single RAID 0 array:
Run lsblk to get the physical volume name and run the following commands:
- mdadm --create /dev/md1 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf (depending on the number of disk attached)
- pvcreate /dev/md1
- vgcreate –s 32 index /dev/md1
- lvcreate –L <disk_size> -n index index
- mkfs.xfs /dev/index/index
- mdadm --detail --scan > /etc/mdadm.conf
RSA recommends the following partition. However, you can change these values based on the retention days.
Note: Create the /var/netwitness/concentrator partition, mount it, and then create the remaining partition.
Create each directory and mount the LVM on it, except /var/netwitness, which is already created.
After mounting the directory, add the following entries in /etc/fstab in the same order:
- /dev/concentrator/root /var/netwitness/concentrator xfs noatime,nosuid 1 2
- /dev/concentrator/sessiondb /var/netwitness/concentrator/sessiondb xfs noatime,nosuid 1 2
- /dev/concentrator/metadb /var/netwitness/concentrator/metadb xfs noatime,nosuid 1 2 2
- /dev/index/index /var/netwitness/concentrator/index xfs noatime,nosuid 1 2
Archiver
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome, and make sure that no other partition resides on this Archiver. Attach other addititional disks for the Archiver database partition with the name suffix external. If there are multiple disk, create a RAID 0 array.
Run lsblk to get the physical volume name.
If you attach one 2 TB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is dev/sdc)
- vgextend netwitness_vg00 /dev/sdc
- lvextend –L 1.9T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
If you attach two 1 TB disk, run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf
- pvcreate /dev/md0
- vgextend netwitness_vg00 /dev/md0
- lvextend –L 1.9T /dev/netwitness_vg00/nwhome
- xfs_growfs /dev/netwitness_vg00/nwhome
-
mdadm --detail --scan > /etc/mdadm.conf
Other Partition Required
The following partition should be on the volume group archiver and should be in a single RAID 0 array.
Note: The following disks should have a suffix external.
Run lsblk to get the physical volume name and run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf (depending on the number of disk attached)
- pvcreate /dev/md0
- vgcreate –s 32 archiver /dev/md0
- lvcreate –L <disk_size> -n archiver archiver
- mkfs.xfs /dev/archiver/archiver
- mdadm --detail --scan > /etc/mdadm.conf
RSA recommends the following partition. However, you can change these values based on the retention days.
Create each directory and mount the LVM on it in a serial manner, except /var/netwitness, which is already created.
After mounting the directory, add the following entries in /etc/fstab in the same order:
- /dev/archiver/archiver /var/netwitness/archiver xfs noatime,nosuid 1 2
Endpoint Hybrid or Endpoint Log Hybrid
For an extension of /var/netwitness/ partition, attach an addititional disk with name suffix nwhome, and make sure that no other partition resides on this Endpoint Hybrid or Endpoint Log Hybrid. Attach other addititional disks for the endpoint database partition with the name suffix external. If there are multiple disk, create a RAID 0 array.
Run lsblk to get the physical volume name.
If you attach one 1 TB disk, run the following commands:
- pvcreate <pv_name> (for example, pv_name is dev/sdc)
- vgextend netwitness_vg00 /dev/sdc
-
lvextend –L 1T /dev/netwitness_vg00/nwhome
-
xfs_growfs /dev/netwitness_vg00/nwhome
Other Partition Required
The following partition should be on the volume group endpoint and should be in a single RAID 0 array.
Note: The following disks should have a suffix nwhome.
Run lsblk to get the physical volume name and run the following commands:
- mdadm --create /dev/md0 --assume-clean --level 0 --raid-devices=2 /dev/sde /dev/sdf (depending on the number of disk attached)
- pvcreate /dev/md0
- vgcreate –s 32 endpoint /dev/md0
- lvcreate –L <disk_size> -n <lvm_name> endpoint
- mkfs.xfs /dev/ endpoint /<lvm_name>
-
Repeat steps 4 and 5 for all the LVMs mentioned.
- mdadm --detail --scan > /etc/mdadm.conf
RSA recommends the following partition. However, you can change these values based on the retention days.