After you increase the storage capacity of your Symantec Advanced Threat Protection (ATP) appliance or VM, you must run the extend_storage tool to complete the upgrade process. The tool does the following:
Detects and partitions the new drive
Generates log messages regarding tool execution
Allots 45% of the new storage to Elasticsearch and 55% to backup and restore
A backup of the Symantec EDR database is strongly recommended before running extend_storage.
Be aware of the following caveats regarding the operation of the tool:
The tool operates on one disk per tool run. To extend disk space using multiple disks, you must run the tool for each disk.
The minimum free disk space that is required on an extendable disk is 10GB.
The maximum free disk space on an extended disk is 2TB for virtual and 16TB for physical.
The tool displays up to five disks to choose from at each session.
The tool only checks for SCSI and SATA controllers.
Make sure that /var/lib/elasticsearch is not open anywhere else.
Make sure that you do not run the extend_storage tool from the /var/lib/elasticsearch folder.
To run the extend_storage tool
Open a command-line interface on the upgraded ATP appliance or VM instance.
Type extend_storage and press Enter.
The current datastore size (total and available) appears along with a message that strongly recommends that you to back up your ATP data before you extend storage.
At the Do you want to proceed? [Y/N] prompt, type Y and then press Enter.
The tool proceeds to convert the backup partition and check the disk(s).
A message appears: Invalid new disks detected, and the new disk is listed along with information about the available space on the disk.
You are prompted to select a new disk. Type the appropriate number and then press Enter.
The tool runs and displays status information and the available space that followed by a message that the tool has run successfully.
The following screen shot provides an example:
Subscribing will provide email updates when this Article is updated. Login is required.