Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Highlighted
karl2k1 Absent Member.
Absent Member.
329 views

Expandability of L7400s logger?

Hello,
We currently have an L7400s logger that is setup with 2 logical drives according to the RAID config under sysadmin tab:
400GB - Raid 5 - unsure of where this is being utilized
4.2TB - Raid 5 - used for main storage

6 physical disks are present

According to documentation, the L7400s supports up to 42TB of space.  How is that possible and how can I go about adding additional space?  If I were to go more than 6 disks, I'd want to convert to at least a RAID 6 or 10Raid config.JPG

Labels (2)
Tags (3)
0 Likes
Reply
4 Replies
Bomme Respected Contributor.
Respected Contributor.

Re: Expandability of L7400s logger?

Hi Karl,

The server (hardware-wise) might support up to 42TB of space.

However - even if you should succeed in getting more disk space on your logger, it won't do you any good, since the logger software, only supports 4.2 TB for the database.

One more thing - ArcSight claims that the compression is 'up to x10' - could it be this, you've read as support of up to 42 TB of space? (4.2 x 10)

Also, be aware, that even though the 6 disks are in a RAID5, you do not have a hot spare. Therefore, IF a disk should crash, be sure to have it replaced immediately - we've had the scenario a couple of times, where the replace drive didn't make it in time 😞

Cheers - Claus

0 Likes
Reply
Outstanding Contributor.. douglas.baker@h1 Outstanding Contributor..
Outstanding Contributor..

Re: Expandability of L7400s logger?

The storage 'capacity' is based on the net amount of event data stored AFTER compression by the CORRE engine as it is stored. Compression is @ ~ 10:1 for all combinations of event types. The ~ 4TB on the data partition with the compression ratio of 10:1 yields the documented storage capacity. There is therefore no 'missing' storage capacity that you would need to add, i.e extra HDD/SSD, in order to realize the storage capacity.

Thank you,

Doug

0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: Expandability of L7400s logger?

Thanks for answering so quickly
Ok, makes total sense...sorta a marketing gimmick to say it handles 42TB of data.  Also Claus, I believe that is how the appliance is built, it makes me nervous that I can only lose one disk "safely", thats kind of the risk you run into when you use an appliance.  I believe you'd be able to have better redundancy if you purchased a software logger:http://www8.hp.com/us/en/software-solutions/arcsight-logger-log-management/tech-specs.html

I the only way to have more than 4.2 TB of online data would be to peer loggers together, right?

0 Likes
Reply
Outstanding Contributor.. douglas.baker@h1 Outstanding Contributor..
Outstanding Contributor..

Re: Expandability of L7400s logger?

I don't see the 'gimmick'. Any file that starts out at some size and is then compressed is still the same file even though it occupies less space. On Logger, i.e. (any) CORRE engine, there is no option for uncompressed data storage at rest. Of course, your point is well taken that there is 'marketing'.

I could ramble on about RAID# .vs. RAID# but for recovery purposes I would recommend 'quick repair'!

Total volume, i.e. event capacity, can be enhanced by peering as you indicate.

Depending on your requirements for retention your V3, volume, velocity and variability, may warrant multiple Loggers. One can even imagine dual feeding all events to multiple Loggers to provide for options in the event of the loss of an entire storage host, i.e. disaster recovery, however peering does not include de-duplication so your configuration considerations would have to include not only where your data resides at rest but how many of this it is! A S/W Logger is however no more inherently resilient than an appliance based solution although it does provide you with storage configuration options that the branded appliance does not to address your issues to some degree, again the RAID# topic.

Thank you,

Doug

.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.