Wazuh-Indexer LVM Disk Expansion

Taylor Walton

02-Sep-2025

How to Expand LVM Disk for /var/lib/wazuh-indexer

This guide outlines the steps to expand the logical volume and filesystem for the Wazuh Indexer located at /var/lib/wazuh-indexer, after additional disk capacity has been added to the underlying physical disk.

Prerequisites

• The disk (e.g., /dev/sdb) has already been expanded at the hypervisor or hardware level.
• The disk is used directly as an LVM physical volume (not partitioned).
• The mount point /var/lib/wazuh-indexer is backed by an ext4 filesystem on an LVM logical volume.

Step-by-Step Instructions

1. Resize the Physical Volume:
   Make LVM aware of the additional space added to /dev/sdb:

   pvresize /dev/sdb

2. Extend the Logical Volume:
   Increase the logical volume size to consume all available free space in the volume group:

   lvextend -l +100%FREE /dev/mapper/data-var_lib_wazuh_indexer

3. Resize the ext4 Filesystem:
   Expand the ext4 filesystem to match the new size of the logical volume:

   resize2fs /dev/mapper/data-var_lib_wazuh_indexer

Verification

Use the following command to confirm that the space is now fully allocated:

df -h /var/lib/wazuh-indexer

Example Output

Filesystem Size Used Avail Use% Mounted on/dev/mapper/data-var_lib_wazuh_indexer 3.5T 2.4T 1.1T 70% /var/lib/wazuh-indexer 

If the expanded size is not reflected, ensure all steps completed successfully and check for error messages.

Notes

• This procedure is safe to run live while Wazuh services are operational, assuming minimal I/O load.
• Always take a snapshot or backup before resizing critical production volumes.