Frozen Teir

[alveare1]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8 to 16 depending on node

RAM

16 or 32gb

Storage for /

512

Storage for /nsm

512

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

When I set search nodes to data_frozen the search node faults and Elasticsearch goes missing.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Do you have an elastic license and are you using searchable snapshots? The only data tiers in SO are hot-warm-cold and content.

[alveare1]

Thank you. I do have a license do you see this being added down the road?

[cm-ops]

I don't since the frozen tier holds partially mounted indices of searchable snapshots exclusively and Security Onion uses the basic license.

The old frozen indices was depricated. That was a way to minimize the heap space used by indices that were rarely accessed but still resided on local disk.