Do you know if NetWitness Logs * Packets can attach to an NFS Share or does it need to be a block SCSI device?
Block storage should be used for writing raw packet, logs, and meta data. NFS isn't recommended for performance reasons. The only exception is for Archiver warm or cold storage, which only full database slices are written to, not the incremental that is written to hot storage or Decoders or Concentrators.
You can find IOPS recommendations here. RSA NetWitness Logs & Packets 11.1 Virtual Host Installation Guide
Thank you Guy!
Retrieving data ...