> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-increase-the-disk-size-of-the-siem-index-server-in-enginsight.md).

# How do I increase the disk size of the SIEM Index Server in Enginsight?

If disk storage on the SIEM Index Server is running out, you can expand the available disk size, provided that the SIEM Index Server is installed in a virtual environment.

The following guide shows you which steps you need to take to increase the disk size.

{% hint style="danger" %}
**Please note**: These steps are **potentially risky** and can **cause data loss** if they are not carried out correctly. Make sure you have created an **up-to-date backup of your data** before you continue!
{% endhint %}

***

## Preparation: Selecting the Correct Disk

If your system has more than one disk, for example `/dev/sda` or `/dev/sdb`, the storage usage behind each disk may differ depending on your setup. The following notes can help you identify the correct disk that needs to be expanded.

{% hint style="warning" %}
**Please note**: The results are provided **without guarantee** and should only be used as guidance. Which disk actually needs to be expanded depends on your specific environment. Therefore, make sure you have created an up-to-date backup before making any changes.

Also note that the following **path specifications only apply to standard installations**. In custom setups, mount points and directories may be structured differently.
{% endhint %}

### Backups on the SIEM Management Server

If backups of the Enginsight SIEM **on the SIEM Management Server** are affected, the directory `/opt/enginsight/loggernaut/backups` or one of its subfolders may have been moved to an additional disk.

If the following command returns output, this disk is a possible candidate for expansion:

```
mount | grep "/opt/enginsight/loggernaut/backups"
```

### SIEM Index Server

On the SIEM Index Server, the directory `/var/solr` may have been moved to an additional disk.

If the following command returns output, this disk is a possible candidate for expansion:

```
mount | grep "/var/solr"
```

***

## Increasing the Disk Size

Take the following steps to increase the disk size:

{% stepper %}
{% step %}

### Stop services on the SIEM Management Server

1. Log in to the **SIEM Management Server**.
2. Stop the Loggernaut component using the following command:

```
sudo systemctl stop ngs-loggernaut
```

3. Stop all Docker services, including Apache Zookeeper, using the following command:

```
sudo docker compose -f /opt/enginsight/enterprise/docker-compose.yml stop
```

{% endstep %}

{% step %}

### Stop services on the SIEM Index Server

1. Log in to the **SIEM Index Server**.
2. Stop all Docker services, including Apache Solr, using the following command:

```
sudo docker compose -f /opt/enginsight/enterprise/docker-compose.yml stop
```

{% endstep %}

{% step %}

### Expand the disk on the hypervisor

{% hint style="info" %}
How you change settings for a virtual machine (VM) depends on the hypervisor you use.
{% endhint %}

1. Log in to the hypervisor you use.
2. Select the VM whose disk you want to expand.
3. Go to the VM settings and increase the disk size according to your requirements.
   {% endstep %}

{% step %}

### Install `fdisk`

To work with partitions, you must make sure that `fdisk`, a tool for managing partition tables on disks, is installed on the selected VM.

Run the following command:

```
sudo apt install fdisk
```

{% endstep %}

{% step %}

### Comment out the partition in **`/etc/fstab`**

Edit the `/etc/fstab` file to comment out the entries for the partition that you want to expand. This prevents issues while the partitions are being edited.

1. Open the file using the following command:

```
sudo nano /etc/fstab
```

2. Comment out the relevant lines by adding a hash character **#** at the beginning of each line.
3. Save the changes to the file (**Ctrl** + **o**) and confirm the save process.
   {% endstep %}

{% step %}

### Disable swap memory

If you have a swap partition, you must disable it using the following command:

```
sudo swapoff -a
```

{% endstep %}

{% step %}

### Start `fdisk`

Start `fdisk` for the disk you want to expand using the following command. Replace `/dev/sda` with the corresponding device, for example `/dev/sdb` or `/dev/sdc`:

```
sudo fdisk /dev/sda
```

{% endstep %}

{% step %}

### Delete partitions

Delete all partitions one after another using the command `d`.

Enter the partition numbers when prompted.
{% endstep %}

{% step %}

### Create a new partition

Create a new partition using the command `n`.

You will be prompted for several values:

1. Confirm the creation of a new partition with `p` for *Primary*.
2. Enter the partition number. This is usually `1` for the first partition.
3. Enter the start block. Use the default value for this.

{% hint style="danger" %}
**Please note**: Using the default value for the start block is very important!
{% endhint %}

4. Enter the end block. Use the highest possible value or the default value to use all available free space.
   {% endstep %}

{% step %}

### Confirm settings

If you are asked about a signature, answer with `N` for *No*.
{% endstep %}

{% step %}

### Save changes

Save the changes using the command `w`.
{% endstep %}

{% step %}

### Expand the file system

Expand the file system to the new partition size using the following command. Replace `/dev/sda1` with the corresponding device:

```
sudo resize2fs /dev/sda1
```

{% endstep %}

{% step %}

### Reactivate entries in `/etc/fstab`

Edit the `/etc/fstab` file again to uncomment the entries for the partition that was expanded.

1. Uncomment the relevant lines by removing the hash characters **#**.
2. Save the changes to the file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
   {% endstep %}

{% step %}

### Create a swap file

Create a new swap file using the following commands:

```
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
sudo cp /etc/fstab /etc/fstab.bak
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf
echo 'vm.vfs_cache_pressure=10' | sudo tee -a /etc/sysctl.conf
```

{% endstep %}

{% step %}

### Restart the VM

Restart the VM using the following command to apply the changes:

```
 sudo reboot
```

{% endstep %}

{% step %}

### Check the changes

After the restart, the disk should be expanded and the partitions should be configured correctly.

Use the following command to check whether all partitions and the swap file are detected and used correctly:

```
sudo df -h
```

{% endstep %}

{% step %}

### Start services on the SIEM Management Server

1. Log in to the **SIEM Management Server**.
2. Start the Loggernaut component using the following command:

```
sudo systemctl start ngs-loggernaut
```

3. Start all Docker services, including Apache Zookeeper, using the following command:

```
sudo docker compose -f /opt/enginsight/enterprise/docker-compose.yml up -d
```

{% endstep %}

{% step %}

### Start services on the SIEM Index Server

1. Log in to the **SIEM Index Server**.
2. Start all Docker services, including Apache Solr, using the following command:

```
sudo docker compose -f /opt/enginsight/enterprise/docker-compose.yml up -d
```

{% endstep %}

{% step %}

### Check Docker containers

Finally, use the following command to check whether all Docker containers are running correctly:

```
sudo docker ps
```

{% endstep %}
{% endstepper %}

***

## Further Resources

* [How do I add another SIEM Index Server in Enginsight?](/docs/knowledge-base/english/siem/how-do-i-add-another-siem-index-server-in-enginsight.md)

***