Article Number
000001245
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.4.x, 10.6.X, 11.X
Platform: CentOS
O/S Version: EL6
Resolution
In order to create a WARM tier on an RSA Security Analytics Archiver appliance, follow the steps below.
- Create an NFS mount on the NAS, e.g: /mnt/Archiver.
- Verify that the NFS mount is reachable from the Archiver. In the example below, 10.44.10.68 is the IP address of the NAS.
[root@saarchiver archiver]# showmount -e 10.44.10.68
Export list for 10.44.10.68:
/mnt/Archiver (everyone)
- Create a directory on the Archiver to mount the NFS.
mkdir /var/netwitness/archiver/nas
- Add the NFS mount to /etc/fstab.
10.44.10.68:/mnt/Archiver /var/netwitness/archiver/nas nfs rw,nolock,tcp,auto,addr=10.44.10.68 0 0
- Issue the command mount -a to apply the change.
- Verify the change with the df -h command, which should show output similar to the example below.
10.44.10.68:/mnt/Archiver
96G 223M 96G 1% /var/netwitness/archiver/nas
Note: Step 7,8 and 9 applicable to 10.4.X version.
- In the Security Analytics UI, navigate to Administration -> Services, click on the Action button for the Archiver, select View -> Config, and click on Add Tier.
Image description
- Configure the following under Warm tab then click the Save button:
Image description
- Click on the Apply button.
Image description
Note: Step A and B applicable to 10.6 and 11.X versions.
- Click on Settings button highlighted below.
Image description - Configure mount directory as below and click Save.
Image description
- At the prompt, click the Yes button.
Image description - Once the Archiver service is back up, verify that it is seeing the Warm storage.
Image description
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.
Please use below documents as a reference for warm storage configuration.
Configure Total Warm Storage for an Archiver in 11.X
Configure Total Warm Storage for an Archiver in 10.6