Rabbitmq Critical Alert on Archiver Host

[yazantaleb01]

Hello,

I'm getting the following critical alert regarding storage space at the Archiver host:

Critical Filesystem Usage on Rabbitmq Message Broker

/var/netwitness has exceeded 75% of capacity

The concern here is that (/var/netwitness) directory is used by the Archiver Hot Storage, so what is the proper way to handle this problem? as in the alert description, when it reaches 80% there will be service impact.

Thanks in advance.

[sravan.koneti]

Hi @yazantaleb01 ,

It looks like you have not created seperate filesystem for Archiver storage and everything being written to /var/netwitness. This file system will be monitored to notify consumption.

I believe, this is VM. If yes, please add additional disk and create separate archiver filsystem using https://community.netwitness.com/t5/netwitness-platform-online/virtual-host-installation-guide-for-12-4/ta-p/709123 page 50.

[yazantaleb01]

Thanks for the quick reply,

As you said, it's a VM and the version is 12.1.0.1

I have created two other volume groups for warm and cold storage, the question is that I already have data in the hot storage, if I created a new logical volume, is there any impact on the current stored data, will it still be accessible? how to change the mount point to the new logical volume?

Thanks.

[sravan.koneti]

Hi @yazantaleb01 ,

Thanks for sharing additional details. If you create new filesystem (should not conflict with existing one), The data still be available in existing filesytem.

Later plan some downtime to archiver.

then stop archiver.

Move all hot storage to new filesystem

then change hot storage location to new filesystem.

Please create NetWitness support ticket to validate all your existing configuration. This helps us to guide you with storage creation with no data loss.

[yazantaleb01]

Helllo @sravan.koneti 

I've added a new storage volume for the hot storage and moved the old data to the new location, but I'm not able to remove the old mount point or modify the collection as below:

Thanks.