File System Options for Offboard Storage
Use an offboard storage solution to move the
/store file system or specific subdirectories,
such as the
You can move the
system to increase the fault tolerance levels in your JSA deployment. Each option impacts JSA performance.
/store file system
to an external device provides an alternative to implementing a high-availability
is the most common file system that is moved to an offboard storage
solution. By moving the
/store/ariel file system, you can move collected log and network activity data
to external storage. The local disk remains used for the PostgreSQL
database and for temporary search results.
Administrators can move the following types of JSA data to offboard storage devices:
PostgreSQL metadata and configuration information
Log activity, payloads (raw data), normalized data, and indexes
Network activity, payloads, normalized data, and indexes
Time series graphs (global views and aggregates)
Performance Impact Of Offboard Storage Solutions
/store file system
to an external device might affect JSA
After the migration, all data I/O to the
/store file system is no longer performed on the local disk. Before you
move your JSA data to an external storage device you
must consider the following information:
Maintain your log and network activity searches on your local disk by mounting the
/store/transientfile system to the unused
Searches that are marked as saved are also in the
/store/transientdirectory. If you experience a local disk failure, these searches are not saved.
By creating multiple
volumes and mounting
can expand your storage capabilities past the single file system that
is configured by default with JSA. A single file system
supports up to 500 TB.
Any subdirectory in the
/store file system can be used as a mount point for your external
storage device. However, only the
/store/ariel file systems are
supported for offboard with a high-availability deployment.
If you want to move dedicated event or flow data, you might
configure more specific mount points. For example, you can configure
/store/ariel/events/payloads as mount points.
More storage expansion options
You can add more data storage to JSA host or optimize your current storage by using one or more of these options:
Install a Data Node. Data Nodes enable new and existing JSA deployments to add storage and processing capacity on demand as required. For more information, see the Juniper Secure Analytics Architecture and Deployment Guide.
Configure your Network File System (NFS) storage. You can configure NFS for a stand-alone JSA Console, new JSA HA deployments, or existing JSA HA deployments.
Configure your retention policies to define how long JSA is required to keep event and flow data, and what to do when that data reaches a certain age. For more information, see the Juniper Secure Analytics Administration Guide.
Enable event coalescing to improve performance, and reduce storage impacts, when a large burst of events is received that match a specific criteria.