FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)

This article describes how to migrate /cmdb to a new larger disk on Hypervisor.

Scope FortiSIEM

After adding the new disk on the VM via the Hypervisor console, use the following information to migrate the data for CMDB.

Create a backup of cmdb and move it to another location or server.

The database files are stored in /cmdb/data.

FortiSIEM automatically backs up this data twice daily and the backup files are stored in /data/archive/cmdb.

To perform a backup, move these files to another location. For example:


# cd /data/archive/cmdb

# cp phoenixdb* /<another>/<mount>/<point>



If the /data disk is on an external NFS mount then the CMDB backup is already separate from the VM infrastructure.


# pwd


# ls -lt

total 1213952

-rw-rw-rw- 1 root root 95559457 Apr 20 03:02 phoenixdb_2011-04-20T03-00-01

-rw-rw-rw- 1 root root 93010144 Apr 19 13:04 phoenixdb_2011-04-19T13-00-02

-rw-rw-rw- 1 root root 91142941 Apr 19 03:02 phoenixdb_2011-04-19T03-00-01

-rw-rw-rw- 1 root root 89686080 Apr 18 13:03 phoenixdb_2011-04-18T13-00-02

# cd /opt/phoenix/deployment

# phoenixdb /DB_backup phoenixdb_backup 1


Take a snapshot of the current instance, to restore it in case of any issue.


All the operations are done considering the system as Linux server,

from FortiSiem which only has to stop the processes.

Hence better to perform this under the supervision of a Linux administrator.

After completing the snapshot, stop the processes on the FortiSIEM:

# su admin
# phtools --stop ALL

Add the newly created larger disk and move the CMDB data to the new disk.

1) A new larger disk unformatted via the disk size has been extended from the Hypervisor console.

2) Reboot and run # lsblk: This will show the newly created disk '/dev/sde'.

3) Create a new temporary mount point directory: # mkdir /cmdb_new.
4) Format the new disk: # mkfs.ext3 /dev/sde.
5) Mounted the disk to /cmdb_new: # mount -t ext3 /dev/sde /cmdb_new.
6) Change to the /cmdb directory: # cd /cmdb.
7) Copy the data from /cmdb to /cmdb_new: # rsync --progress -av * /cmdb_new.

8) Unmount the existing cmdb file system: umount /cmdb.

9) Unmount the newly created file system: # umount /cmdb_new.

10) Mount the newly created file system to /cmdb: # mount -t ext3 /dev/sde /cmdb.

11) Backup the original fstab: # cp /etc/fstab /etc/fstab.<current date>.

12) Replace the UUID of the new disk in the fstab: # vi /etcfstab (edit with new UUID).

13) Reboot the system to ensure the larger cmdb will mount via /etc/fstab: # reboot.

14) Verify disk utilization now available: # df-h /cmdb.


Related document: