Adding new disk for NSM

[jpancrazio]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

25

Storage for /

500GB

Storage for /nsm

500GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello All - As normal newb here .. I have added a NEW VM disk to move the NSM data to , I have seen the port on that and have gotten all the way to move the data with the sudo mv /nsm /nsm.old command, but I am getting this error "mv: cannot move '/nsm' to '/nsm.old': Device or resource busy" , I did also issue the sudo service docker stop command before this step and still no luck .. Have any additional advice on accomplishing this ?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Have you looked to see if there is a process still running on /nsm?

How about a reboot, then attempt the move command?

[jpancrazio]

Tips on what to look for? I did try the reboot and was getting the same results

[cm-ops]

Check to make sure the salt-minion service is stopped and disabled and that there are no containers running. You could also use lsof to search for open files on /nsm, lsof +D /nsm and see what PID are being used.

[Carlos-mb]

Is it possible than /msn is mounted as part of file system?
It was my case

[EDIT: I'm getting a nice error 500 from server.. so, use this info with care]

sudo umount /nsm
sudo mv /nsm /nsm.old
sudo mkdir -p /nsm
sudo mount /dev/sdb1 /nsm

In /etc/fstab add /dev/sdb1 /nsm ext4 defaults 0 2

sudo systemctl daemon-reload
sudo mount -a

sudo mv /nsm.old/* /nsm/

sudo rsync -avH /nsm.old/ /mnt/

rm -rf /nsm.old
sudo systemctl enable salt-minion
reboot

I hope this help

Regards

[jpancrazio]

Hey All , Just wanted to update this - that just extended the system lvg and added the free space to the system-nsm - this worked perfect -- thanks for the help