qradar-boot-volume-grow.sh

Mount Point Current Size    Proposed Size   Why?
/ (root)    20 GB   100 GB  Gives the OS breathing room for updates and temp files.
/opt    14 GB   200 GB  QRadar binaries and many extensions/apps live here.
/var/log    18 GB   500 GB  Critical. This is where QRadar stores active logs.
/storetmp   15 GB   500 GB  Used for temporary data processing and backups.
/var    8 GB    50 GB   General system variable data.
Free Space  0 GB    ~500 GB Keep this unallocated. LVM allows you to grow any folder instantly later if it gets full.


fdisk /dev/sda

[root@qradar-20260102-1919 ~]# fdisk /dev/sda

The device presents a logical sector size that is smaller than
the physical sector size. Aligning to a physical sector (or optimal
I/O) size boundary is recommended, or performance may be impacted.
Welcome to fdisk (util-linux 2.23.2).

Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Command (m for help): p

Disk /dev/sda: 2147.5 GB, 2147483648000 bytes, 4194304000 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 1048576 bytes
Disk label type: dos
Disk identifier: 0x0000db86

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048     2099199     1048576   83  Linux
/dev/sda2         2099200     2508799      204800    6  FAT16
/dev/sda3         2508800   255852543   126671872   8e  Linux LVM

Command (m for help): d
Partition number (1-3, default 3): 3
Partition 3 is deleted

Command (m for help): n
Partition type:
   p   primary (2 primary, 0 extended, 2 free)
   e   extended
Select (default p): p
Partition number (3,4, default 3): 3
First sector (2508800-4194303999, default 2508800):
Using default value 2508800
Last sector, +sectors or +size{K,M,G} (2508800-4194303999, default 4194303999):
Using default value 4194303999
Partition 3 of type Linux and of size 2 TiB is set

Command (m for help): t
Partition number (1-3, default 3): 3
Hex code (type L to list all codes): 31
Changed type of partition 'Linux' to 'unknown'

Command (m for help): t
Partition number (1-3, default 3): 3
Hex code (type L to list all codes): L

 0  Empty           24  NEC DOS         81  Minix / old Lin bf  Solaris
 1  FAT12           27  Hidden NTFS Win 82  Linux swap / So c1  DRDOS/sec (FAT-
 2  XENIX root      39  Plan 9          83  Linux           c4  DRDOS/sec (FAT-
 3  XENIX usr       3c  PartitionMagic  84  OS/2 hidden C:  c6  DRDOS/sec (FAT-
 4  FAT16 <32M      40  Venix 80286     85  Linux extended  c7  Syrinx
 5  Extended        41  PPC PReP Boot   86  NTFS volume set da  Non-FS data
 6  FAT16           42  SFS             87  NTFS volume set db  CP/M / CTOS / .
 7  HPFS/NTFS/exFAT 4d  QNX4.x          88  Linux plaintext de  Dell Utility
 8  AIX             4e  QNX4.x 2nd part 8e  Linux LVM       df  BootIt
 9  AIX bootable    4f  QNX4.x 3rd part 93  Amoeba          e1  DOS access
 a  OS/2 Boot Manag 50  OnTrack DM      94  Amoeba BBT      e3  DOS R/O
 b  W95 FAT32       51  OnTrack DM6 Aux 9f  BSD/OS          e4  SpeedStor
 c  W95 FAT32 (LBA) 52  CP/M            a0  IBM Thinkpad hi eb  BeOS fs
 e  W95 FAT16 (LBA) 53  OnTrack DM6 Aux a5  FreeBSD         ee  GPT
 f  W95 Ext'd (LBA) 54  OnTrackDM6      a6  OpenBSD         ef  EFI (FAT-12/16/
10  OPUS            55  EZ-Drive        a7  NeXTSTEP        f0  Linux/PA-RISC b
11  Hidden FAT12    56  Golden Bow      a8  Darwin UFS      f1  SpeedStor
12  Compaq diagnost 5c  Priam Edisk     a9  NetBSD          f4  SpeedStor
14  Hidden FAT16 <3 61  SpeedStor       ab  Darwin boot     f2  DOS secondary
16  Hidden FAT16    63  GNU HURD or Sys af  HFS / HFS+      fb  VMware VMFS
17  Hidden HPFS/NTF 64  Novell Netware  b7  BSDI fs         fc  VMware VMKCORE
18  AST SmartSleep  65  Novell Netware  b8  BSDI swap       fd  Linux raid auto
1b  Hidden W95 FAT3 70  DiskSecure Mult bb  Boot Wizard hid fe  LANstep
1c  Hidden W95 FAT3 75  PC/IX           be  Solaris boot    ff  BBT
1e  Hidden W95 FAT1 80  Old Minix
Hex code (type L to list all codes): 8e
Changed type of partition 'unknown' to 'Linux LVM'

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table. The new table will be used at
the next reboot or after you run partprobe(8) or kpartx(8)
Syncing disks.


[root@qradar-20260102-1919 ~]# partprobe /dev/sda
[root@qradar-20260102-1919 ~]# pvresize /dev/sda3
  Physical volume "/dev/sda3" changed
  1 physical volume(s) resized or updated / 0 physical volume(s) not resized
[root@qradar-20260102-1919 ~]# vgs
  VG   #PV #LV #SN Attr   VSize VFree
  rhel   1   9   0 wz--n- 1.95t 1.83t

# Expand / (root) to 100 GB:
lvextend -r -L 100G /dev/mapper/rhel-root

# Expand /opt to 200 GB:
lvextend -r -L 200G /dev/mapper/rhel-opt

# Expand /var/log to 500 GB:
lvextend -r -L 500G /dev/mapper/rhel-var_log

# Expand /storetmp to 500 GB:
lvextend -r -L 500G /dev/mapper/rhel-storetmp

# Expand /var to 50 GB:
lvextend -r -L 50G /dev/mapper/rhel-var