QRadarの/store/backupをNFS領域に移動する

## NFSサーバ準備
参考資料：https://qiita.com/Higemal/items/f06a1dda931da3ac4f7a

nfs-utilisインストール
```
[root@cents7 ~]# yum install nfs-utils
読み込んだプラグイン:fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: mirror.web-ster.com
 * extras: mnvoip.mm.fcix.net
 * updates: linux.mirrors.es.net
base                                                                                                                                                                                        | 3.6 kB  00:00:00
extras                                                                                                                                                                                      | 2.9 kB  00:00:00
updates                                                                                                                                                                                     | 2.9 kB  00:00:00
依存性の解決をしています
--> トランザクションの確認を実行しています。
---> パッケージ nfs-utils.x86_64 1:1.3.0-0.68.el7 を 更新
---> パッケージ nfs-utils.x86_64 1:1.3.0-0.68.el7.2 を アップデート
--> 依存性解決を終了しました。

依存性を解決しました

===================================================================================================================================================================================================================
 Package                                           アーキテクチャー                               バージョン                                                 リポジトリー                                     容量
===================================================================================================================================================================================================================
更新します:
 nfs-utils                                         x86_64                                         1:1.3.0-0.68.el7.2                                         updates                                         413 k

トランザクションの要約
===================================================================================================================================================================================================================
更新  1 パッケージ

合計容量: 413 k
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  更新します              : 1:nfs-utils-1.3.0-0.68.el7.2.x86_64                                                                                                                                                1/2
  整理中                  : 1:nfs-utils-1.3.0-0.68.el7.x86_64                                                                                                                                                  2/2
  検証中                  : 1:nfs-utils-1.3.0-0.68.el7.2.x86_64                                                                                                                                                1/2
  検証中                  : 1:nfs-utils-1.3.0-0.68.el7.x86_64                                                                                                                                                  2/2

更新:
  nfs-utils.x86_64 1:1.3.0-0.68.el7.2

完了しました!
```
公開用NFS領域作成
```
[root@cents7 ~]# mkdir -p /share/nfs
```
/etc/exportsの中に接続許可IP範囲(xxx.xxx.xxx.xxx/24)及び公開用ディレクトリ設定
```
[root@cents7 ~]# vi /etc/exports
```
```/share/nfs xxx.xxx.xxx.xxx/24(rw,no_root_squash,async)```

rpcbind及びnfsサービス開始
```
[root@cents7 ~]# systemctl start rpcbind
[root@cents7 ~]# systemctl start nfs
```
rpcbind及びnfsサービス自動起動ON
```
[root@cents7 ~]# systemctl enable rpcbind
[root@cents7 ~]# systemctl enable nfs
Created symlink from /etc/systemd/system/multi-user.target.wants/nfs-server.service to /usr/lib/systemd/system/nfs-server.service.
```
サービスステータス確認
```
[root@cents7 ~]# systemctl status rpcbind
● rpcbind.service - RPC bind service
   Loaded: loaded (/usr/lib/systemd/system/rpcbind.service; enabled; vendor preset: enabled)
   Active: active (running) since 水 2023-07-19 10:37:49 JST; 1h 1min ago
 Main PID: 950 (rpcbind)
   CGroup: /system.slice/rpcbind.service
           └─950 /sbin/rpcbind -w

 7月 19 10:37:46 cents7.localdomain systemd[1]: Starting RPC bind service...
 7月 19 10:37:49 cents7.localdomain systemd[1]: Started RPC bind service.
[root@cents7 ~]# systemctl status nfs
● nfs-server.service - NFS server and services
   Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; enabled; vendor preset: disabled)
  Drop-In: /run/systemd/generator/nfs-server.service.d
           └─order-with-mounts.conf
   Active: active (exited) since 水 2023-07-19 11:38:27 JST; 44s ago
 Main PID: 3700 (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/nfs-server.service

 7月 19 11:38:27 cents7.localdomain systemd[1]: Starting NFS server and services...
 7月 19 11:38:27 cents7.localdomain exportfs[3698]: exportfs: Failed to stat /share/nfs: No such file or directory
 7月 19 11:38:27 cents7.localdomain systemd[1]: Started NFS server and services.
[root@cents7 ~]#
```
NFSポート確認　port2049がlistenしていればOK
```
[root@cents7 ~]# netstat -an | grep 2049
tcp        0      0 0.0.0.0:2049            0.0.0.0:*               LISTEN
tcp6       0      0 :::2049                 :::*                    LISTEN
udp        0      0 0.0.0.0:2049            0.0.0.0:*
udp6       0      0 :::2049                 :::*
```

# QRadar側の設定
参考資料：https://www.ibm.com/docs/ja/SS42VS_7.4/pdf/b_offboard_storage.pdf

fstabファイルを開き一番下にてNFSサーバ情報を追加
```
[root@QRadar750AIO ~]# vi /etc/fstab
```
```xxx.xxx.xxx.xxx:/share/nfs /store/backup nfs rw,soft,intr,noac 0 0```

現行の/store/backupを名前を変えて移動

```
[root@QRadar750AIO ~]# mv /store/backup /store/backup.local/
```
/store/backupを新規に作ります。
```
[root@QRadar750AIO ~]# mkdir /store/backup
```
NFSボリュームに対して権限を設定します。

```
[root@QRadar750AIO ~]# chown nobody:nobody /store/backup
```
NFSをマウントします。

```
[root@QRadar750AIO ~]# mount /store/backup
```
dfコマンドでマウントされたNFS(/store/backup)を確認します。以下の例では、一番下
```
[root@QRadar750AIO ~]# df -h
Filesystem                        Size  Used Avail Use% Mounted on
devtmpfs                           16G  4.0K   16G   1% /dev
tmpfs                              16G  1.1M   16G   1% /dev/shm
tmpfs                              16G   18M   16G   1% /run
tmpfs                              16G     0   16G   0% /sys/fs/cgroup
/dev/mapper/rootrhel-root          13G  4.9G  7.7G  40% /
/dev/sda2                        1014M  262M  753M  26% /boot
/dev/mapper/rootrhel-opt           13G  4.3G  8.3G  34% /opt
/dev/mapper/rootrhel-storetmp      15G   37M   15G   1% /storetmp
/dev/mapper/rootrhel-var          5.0G  214M  4.8G   5% /var
/dev/mapper/rootrhel-tmp          3.0G   37M  3.0G   2% /tmp
/dev/sda3                          32G  5.4G   27G  17% /recovery
/dev/mapper/storerhel-store       142G   62G   80G  44% /store
/dev/mapper/storerhel-transient    36G   34M   36G   1% /transient
/dev/mapper/rootrhel-home        1014M   33M  982M   4% /home
/dev/mapper/rootrhel-varlog        15G  714M   15G   5% /var/log
/dev/mapper/rootrhel-varlogaudit  3.0G  258M  2.8G   9% /var/log/audit
overlay                           142G   62G   80G  44% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/overlay2/de03150dd757b2d8af0ce8f89abe072800b6d606abbacabdeae5370253b82725/merged
overlay                           142G   62G   80G  44% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/overlay2/0fb177ad0e0f073cbc6b1af32dbb20a2f967cff3a937e5b0b9e93ddf0e896202/merged
overlay                           142G   62G   80G  44% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/overlay2/12ec11fab23988ec32982dc6e1e3c5468d657a486eb761af93f1eecfeb0a14af/merged
overlay                           142G   62G   80G  44% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/overlay2/35b555126e48db966f23d561aca50b37ffca0c520d3e16f3e0e27b0227f4fa40/merged
overlay                           142G   62G   80G  44% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/overlay2/1233faf7b881cf8f09809054338b0d036bca6d4496ecca1b819c8e0f310fa4f7/merged
shm                                64M     0   64M   0% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/containers/5328907ff40d98b20aa5d058062c6757d2a8cce7facef01ec4bf38a7f55a4e3e/mounts/shm
shm                                64M   68K   64M   1% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/containers/ffae6ff0498779530744b97407d03b6d5dc722861c6c04d062791cdf5da48c9b/mounts/shm
shm                                64M     0   64M   0% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/containers/579f0df73cb04a697736c52a3acb6c4d8a1f77a313bc93933e46871ab2e940f0/mounts/shm
shm                                64M     0   64M   0% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/containers/9c9739d020dd0357c73e47ff590128286b1e087e7c5b50a051c3bed67f4aab59/mounts/shm
shm                                64M   16K   64M   1% /store/docker-data/engine/VMware-56-4d-f3-98-a2-d9-e7-2a-db-d7-3d-1b-9f-4c-bd-df/containers/983e9d946eee82ad8f063da2c64f108e3ebeb763e0b80a45ec8d30ed6503a6ca/mounts/shm
tmpfs                             3.2G     0  3.2G   0% /run/user/0
xxx.xxx.xxx.xxx:/share/nfs             50G  5.7G   45G  12% /store/backup
```
/store/backup.localを/store/backupにコピーします。
```
[root@QRadar750AIO ~]# nohup cp -f /store/backup.local/* /store/backup &
[root@QRadar750AIO ~]# disown
```