File System Options for Offboard Storage
Use an offboard storage solution to move the
/store file system or specific subdirectories,
such as the
You can move the
system to increase the fault tolerance levels in your JSA deployment. Each option impacts JSA performance.
/store file system
to an external device provides an alternative to implementing a high-availability
is the most common file system that is moved to an offboard storage
solution. By moving the
/store/ariel file system, you can move collected log and network activity data
to external storage. The local disk remains used for the PostgreSQL
database and for temporary search results.
Administrators can move the following types of JSA data to offboard storage devices:
PostgreSQL metadata and configuration information
Log activity, payloads (raw data), normalized data, and indexes
Network activity, payloads, normalized data, and indexes
Time series graphs (global views and aggregates)
Performance Impact Of Offboard Storage Solutions
/store file system
to an external device might affect JSA
After the migration, all data I/O to the
/store file system is no longer performed on the local disk. Before you
move your JSA data to an external storage device you
must consider the following information:
Maintain your log and network activity searches on your local disk by mounting the
/store/transientfile system to the unused
Searches that are marked as saved are also in the
/store/transientdirectory. If you experience a local disk failure, these searches are not saved.
By creating multiple volumes and mounting
can expand your storage capabilities past the 16 TB file system
limit that is supported by JSA.
Any subdirectory in the
/store file system can be used as a mount point for your external
If you want to move dedicated event or flow data, you might
configure more specific mount points. For example, you can configure
/store/ariel/events/payloads as mount points.