FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
vraev
Staff
Staff
Article Id 265607

Description

 

This article describes how to add additional space under a KVM/QEMU virtual environment.

 

Scope

 

FortiManager and FortiAnalyzer.

 

Solution


FortiManager and FortiAnalyzer share architecture based on a GNU/Linux environment. They use the Logical Volume Manager (LVM) to handle space provisioning.

LVM has three parts: Physical volumes (PV), Volume groups (VG), and Logical volumes (LV).

When using logical volumes, file systems can extend across multiple disks, since it is possible to aggregate disks and partitions into a single logical volume.


In this case, the LVM is used to aggregate all of the provisioned space from the Host OS as a one-volume group and logical volume then to resize the file system to use all of the available space.

 

vraev_0-1690290034091.png

 

Adding additional drives and any other changes related to the VM must be made when the VM is shut down. If this change is made on a live system, unexpected results may occur.
FortiManager and FortiAnalyzer accept up to 15th virtual drives (VD).

When adding additional space to FortiManager (FMG) and FortiAnalyzer (FAZ), use the formula to estimate the space that will be needed for the FortiAnalyzer and FortiManager with the FortiAnalyzer feature.

 

To achieve this, it is necessary to know how much space is to be added to the VM. The Host OS uses a Debian GNU/Linux distribution.
In FortiManager or FortiAnalyzer:

 

execute shutdown

 

Under the Host OS:

 

To create additional HDD space:

qemu-img create -f qcow2 fortimanager2.qcow2 80G

qemu-img

The program that is used to create the image.

create

The action.

-f qcow2

Specifies the output disk image format at 'qcow2'.

fortimanager.qcow2

The name and the path to store the file.

80G

Defines the size of the image as 20 gigabytes. K, M, G, and T can be used.

 

Prepare an XML file to provision the space to the VM:

 

<disk type='file' device='disk'>

   <driver name='qemu' type='qcow2' cache='none'/>

   <source file='/srv/VMs/fortimanager2.qcow2'/>

   <target dev='vdb'/>

</disk>

 

Attach the space to the VM:

 

virsh attach-device <Name> ./storage.xml

 

Start the VM:

 

virsh start <Name>

 

Run the following under FortiManager/FortiAnalyzer:

 

execute lvm info

execute lvm extend

 

The VM will require a reboot.

 

Perform the following tasks on the Host OS.

The following commands will provide more information for the attached files to the VM which are acting as an HDD.

virsh domblklist <Name>

 

virsh domblkinfo <Name> vdb --human

 

Example:

 

Shut down the VM. A graceful shutdown is strongly recommended. After, reviewing the current state of the VM.
Only the running VMs will be present with the following command.

Run the following on the Host OS:

virsh list

Id   Name   State

--------------------

 

Create a new HDD.

qemu-img create -f qcow2 fortimanager2.qcow2 80G

Formatting 'fortimanager2.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=85899345920 lazy_refcounts=off refcount_bits=16

 

To attach the newly created file to the VM, it is necessary to provide information about where the file is, what type it is, and other details. This can be achieved through the command line or by preparing an XML containing the requested information.

 

cat storage.xml

<disk type='file' device='disk'>

   <driver name='qemu' type='qcow2' cache='none'/>

   <source file='/srv/VMs/ fortimanager2.qcow2’ />

   <target dev='vdb'/>

</disk>

 

virsh attach-device --config FMGinternal ./storage.xml

 

After running the command, the device will attach successfully.

 

Start the VM and access the CLI.

 

virsh start FMGinternal

 

virsh console FMGinternal

 

In FortiManager or FortiAnalyzer:

Review the newly attached disk. The disk is shown as unused.

 

execute lvm info

LVM Status: OK

LVM Size: 80GB

File System: ext4 78GB

 

Disk1 :         Used       80GB

Disk2 :       Unused       80GB

Disk3 :  Unavailable        0GB
--- output is omitted ---

 

Extending the disk space will include the newly provided disk and resize the file system.

 

execute lvm extend

This operation will need to reboot the system.

Do you want to continue? (y/n)y

 

Rescan disks...

  add new disk2: 80GB

Extend /dev/mdvg/mdlv...

Fsck /dev/mdvg/mdlv...

  Done, no error.

Resize2fs /dev/mdvg/mdlv...

Please stand by while rebooting the system.

[  156.666138] reboot: Restarting system

 

The LVM status is OK the disk is included as part of the LVM pool. The file system is successfully resized.

 

execute lvm info

LVM Status: OK
LVM Size: 160GB
File System: ext4 157GB

Disk1 :         Used       80GB
Disk2 :         Used       80GB
Disk3 :  Unavailable        0GB
Disk4 :  Unavailable        0GB
--- output is omitted ---

Review the provision from the Host OS.

virsh domblklist FMGinternal

 Target   Source
----------------------------------------

 hda      /srv/VMs/fmg.qcow2
 hdb      /srv/VMs/fortimanager.qcow2
 vdb      /srv/VMs/fortimanager2.qcow2

virsh domblkinfo FMGinternal vdb --human

Capacity:       80.000 GiB
Allocation:     196.000 KiB
Physical:       193.250 KiB

Troubleshooting:

If the space is provisioned when the VM is in a working state. It will be shown as 0GB under the FortiManager and FortiAnalyzer.

 

execute lvm info

LVM Status: OK

LVM Size: 80GB

File System: ext4 78GB

 

Disk1 :         Used       80GB

Disk2 :       Unused       0GB

Disk3 :  Unavailable        0GB

 

In the Host OS:

If the 'virsh' command hangs during some operations, restart it. If it still hangs, review the rights of the user and the logs for more clues.

 

systemctl restart libvirtd

Review the logs with 'journalctl' and press G to go to the latest ones.

 

journalctl -b 0

 

Note: In the current versions is possible to add up to 15 disks. The system will not prevent adding more disks, but doing so may could cause unexpected issues.

 
 

 

lvm_info.png

 

The last step is to configure the log storage:

Configuring log storage policy

 

Related articles: