How to configure a WARM Tier on an RSA Security Analytics 10.4 and above Archiver

[#1]

Article Number

000001245

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.4.x, 10.6.X, 11.X
Platform: CentOS
O/S Version: EL6

Resolution

In order to create a WARM tier on an RSA Security Analytics Archiver appliance, follow the steps below.

1. Create an NFS mount on the NAS, e.g: /mnt/Archiver.
2. Verify that the NFS mount is reachable from the Archiver.  In the example below, 10.44.10.68 is the IP address of the NAS.

   
   [root@saarchiver archiver]# showmount -e 10.44.10.68
   Export list for 10.44.10.68:
   /mnt/Archiver (everyone)

3. Create a directory on the Archiver to mount the NFS.

   
   mkdir /var/netwitness/archiver/nas

4. Add the NFS mount to /etc/fstab.

   
   10.44.10.68:/mnt/Archiver /var/netwitness/archiver/nas nfs rw,nolock,tcp,auto,addr=10.44.10.68 0 0

5. Issue the command mount -a to apply the change.  
6. Verify the change with the df -h command, which should show output similar to the example below.

   
   10.44.10.68:/mnt/Archiver
                          96G  223M   96G   1% /var/netwitness/archiver/nas

   Note: Step 7,8 and 9 applicable to 10.4.X version.
    
7. In the Security Analytics UI, navigate to Administration -> Services, click on the Action button for the Archiver, select View -> Config, and click on Add Tier.