Technical Tip: Resize Threat Hunting Data Disk

[rduggal_FTNT]

Description	This article describes how to resize and expand the Threat hunting data disk.
Scope	Specific to FortiEDR On Prem Threat Hunting.
Solution	Note: As a best practice, it is recommended to take snapshot of the Threat hunting VM before initiating the procedure to expand the data disk. Shutdown the TH VM -> Increase/Expand the data disk (Disk 2) to the required storage size -> Save it and then Power On the VM.      2. SSH to TH VM -> Execute the 'lsblk' command to identify the data disk. For example: Note that sdb is the storage disk with a total size of 140 GB. Run the command 'df -h' to determine the available and used storage. According to the above output, the size on disk is 127 GB and the available amount is 121 GB. The additional 10 GB can be resized and made available. Execute the following commands to first print the total size that can be utilized to resize the disk and then begin procedure to expand the disk. The following commands and screenshots are for reference: parted /dev/sdb print parted /dev/sdb resizepart 1 (follow the prompts) resize2fs /dev/sdb1 To verify that disk has been successfully resized, use command 'df -h'. If there are still any problems during the resizing, open a new technical support ticket for further assistance: Support Fortinet.