Security Compliance

Resize a SEM virtual appliance

Learn how to increase and decrease the capacity of your SEM virtual appliance. This KB article describes two distinct methods. Refer to this article if SEM is running out of space.

First published date

10/11/2018 6:41 PM

Last published date

4/22/2025 4:54 PM

Overview

The Security Event Manager (formerly Log & Event Manager) virtual appliance default size is 250 GB. You can increase and decrease the capacity of your SEM virtual appliance using two distinct methods. This article describes how to perform these methods.

A quick way to gather size and retention information regarding the SEM can be found in this guide.

SEM - Create a Widget for Monitoring Log Retention

Product section

Security Event Manager

Resolution

Increase the SEM virtual appliance capacity 

You can increase the capacity of your SEM virtual appliance by increasing the hard disk size in your vSphere or Hyper-V client. If you want to increase the size of your virtual appliance, consider the following notes:

  • The default size of SEM is 250 GB. This size may be increased to 62TB based on the Virtual Disk formats used. 
  • For SEMs deployed before version 6.4, there is a limit of 2TB. If your upgrade path included 6.3.1 and older or if you have only 1 virtual disk on your virtual appliance, please contact Customer Support for assistance migrating.
  • The maximum virtualization platform disk size:
    • VMWare - VMDK - up to 62TB as of ESXi 6.7
    • Hyper-V - VHDX - up to 64TB is supported.
  • The SEM size cannot be increased until all snapshots or checkpoints have been deleted.
  • Shut down the virtual machine before making any changes to the size.

To shut down the virtual machine from the Appliance submenu of the CMC Console (SEM CMC appliance menu):

  1. Open the vSphere or Hyper-V virtual console.
  2. At the cmc> prompt, enter appliance. 
  3. Enter shutdown and then follow the commands to shut down SEM.
  4. Perform the disk size increase described by VMware or Microsoft on the 2nd Disk (240GB Default)
    • (Please ask assistance to your VM / HyperV team to increase the Disk Size of the SEM VM)
  5. Start the SEM appliance by selecting Play or Start. 

*As the SEM boots up it will detect the change and expand the disk. Do not interrupt this process or it may result in severe data loss. If you feel it has taken too long to boot, please contact support.


Decrease the SEM virtual appliance capacity 

If you need to decrease the capacity of the virtual appliance you will need to backup your log data and import only the needed data into a newly deployed SEM with the correct sized disks. Importing your configuration into the new SEM can be done from the Appliance submenu in the CMC console, but importing the backup log data will require reaching out to Technical Support for assistance.
Configure Backups on your SEM Appliance

The new disk must be large enough to accommodate all of the data you intend to restore to it.