Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring NFS backup on an existing HA Cluster

 

You can configure Network File System (NFS) for an existing high-availability cluster.

Note

If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by JSA.

If you choose to use NFS anyway, NFS can be used only for daily backup data, such as the /store/ backup directory. You cannot use NFS for storing active data, which includes the PostgreSQL and ariel databases. If you do use NFS, it might cause database corruption or performance issues.

  1. Use SSH to log in to the primary HA host as the root user.
  2. Start NFS services by typing the following commands:
    systemctl enable rpcbind

    systemctl start rpcbind
  3. Add the following line to the /opt/qradar/ha/fstab.back file.

    nfsserver:/nfs/export/path /store/backup nfs rw,soft,intr,noac 0 0

    You might need to adjust the settings for the NFS mount point to accommodate your configuration.

  4. Add the same line to the /etc/fstab file, preceded by #HA.

    #HA nfsserver:/nfs/export/path /store/backup nfs rw,soft,intr,noac 0 0

    You might need to adjust the settings for the NFS mount point to accommodate your configuration.

  5. Repeat steps 1 - 4 on the secondary HA host.
  6. Move your backup files from the existing directory on the primary HA host to a temporary location by typing the following commands:
    cd /store/

    mv backup backup.local
  7. Create a new backup directory on the primary HA host by typing the following command:
    mkdir /store/backup
  8. Set the permissions for the NFS volume on the primary HA host by typing the following command:
    chown nobody:nobody /store/backup
  9. Click Admin to open the admin tab.
  10. Click Advanced > Deploy Full Configuration. All services restart.
  11. Verify that the /store/backup mount point is listed in the output of the following command on the primary and secondary HA hosts:
    grep MOUNTS /opt/qradar/ha/ha.conf
  12. Verify that /store/backup is mounted on the primary HA host by typing the following command:
    df -h
  13. On the primary HA host, move the backup files from the temporary location to the NFS volume by typing the following command:
    mv -f /store/backup.local/* /store/backup
  14. Remove the backup.local directory by typing the following commands:
    cd /store

    rm -rf backup.local