Appendix B - Disk Layout v8.0.0

Important

This document relates to the Disk Layout for Snare Central v8.0.0. For details related to v8.1.0 please refer to the following guide.

Snare Central complies with the “Red Hat Enterprise Linux 6 Security Technical Implementation Guide (STIG)” recommendation from DoD with the following independent file systems structure using Linux logical volume manager (LVM):

Partition	Size and Details of Usage	Disk Manger Resize Capability
/	10.00 GB - part of operating system	No
/boot	0.50 GB - part of operating system	No
/usr	5.00 GB - part of operating system	No
/var	5.00 GB - part of operating system	No
/var/log	5.00 GB - part of operating system	No
/var/log/audit	0.50 GB - part of operating system	No
/home	2.00 GB - User home directories	No
/tmp	5.00 GB noudev,nosuid,noexec - used for temporary operating system and application files	No
/data	50.00 GB contains the Snare application and various operational components	No - can be resized using snare CLI menu
/data/SnareCache	10.00 GB reserved for new database reporting engine	Yes
/data/SnareIndex	10.00 GB reserved for new database reporting engine	Yes
/data/SnareResultsCache	10.00 GB reserved for new database reporting engine	Yes
/data/SnareReflector	5.00 GB used for new disk cache feature of reflector	Yes
/data/SnareTransition	10.00 GB used for Snare Collection subsystem before being archived to SnareArchive	Yes
/data/SnareArchive00	rest of disk space	Yes
/data/SnareArchive	Overlayfs file system used to allow the mounting of NFS, CIFS( Windows and Samba) shares, DVD, CDROM and USB backup media

With Snare Central using LVM for its file systems, it allows users to easily resize any of them if enough free disk space is available. One thing to notice is that the Snare Central main data storage is the rest of the server's disk capacity. If a new physical disk is added to the system, it can fully or partially be assigned to this file system within the Disk Manager.