IBM Support

QRadar: Disk drive is in "Unconfigured (good)" state after replacement and is not being rebuilt automatically

Question/Answer


Question

A drive in the QRadar appliance that was replaced, is not automatically rebuilt into the RAID array, and is reported as "Unconfigured (good)".

Answer

Before you begin: This procedure is intended for appliances that will boot. If your appliance will not boot please contact support.

 

How to Rebuild a Drive

  1. Using an SSH session log in to the Console as root user.
     
  2. If the affected appliance is not the Console, SSH from the Console to the Managed Host with the bad drive.
     
  3. You need to get the correct enclosure position and slot of the drive by using the following command:

    opt/MegaRAID/MegaCli/MegaCli64 -PDList -aALL

    Output will be similar to:

    Adapter #0
    [...]
    Enclosure Device ID: 8
    Slot Number: 2
    [...]
    Firmware state: Unconfigured(good), Spun Up

     
  4. To get the right Array and Row position of the drive in the RAID array, execute:

    /opt/MegaRAID/MegaCli/MegaCli64 -pdgetmissing -aALL

    The output will be similar to:

    Adapter 0 - Missing Physical drives
    No. Array Row Size Expected
    0 0 3 3814697 MB

     
  5. Place the missing drive into the RAID array and run this command:

    /opt/MegaRAID/MegaCli/MegaCli64 -PdReplaceMissing -PhysDrv [8:2] -Array0 -row3 -a0

    Where 8 and 2 in [8:2] are the Enclosure Device ID and slot number respectively, 0 in Array0 is the array number, 3 in row3 is the number of the drive in the RAID array, and 0 in a0 represents the adapter.

    Output should be similar to:

    Adapter: 0: Missing PD at Array 0, Row 3 is replaced.

     Note:  Should you see a message similar to this while running step #4

      Adapter: 0: Failed to replace Missing PD at Array 0, Row 3.

     FW error description:
     PDs in LD have incompatible EEDP types
     Exit Code: 0x63

    Do the steps in the section for PI Support

  6. To start rebuilding the drive run this command:

    /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -Start -PhysDrv [8:2] -a0

    Output should be similar to this:

    started rebuild progress on device encl 8 slot 2
     
  7. To check status on the rebuilding status, run this command:

    /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -ShowProg -PhysDrv [8:2] -a0

    Note: You might have to escape the brackets "[" and "]" as "\[" and "\]".

 

Protection Information (PI) Support
 

Protection Information (PI) adds an extra eight bytes of information to the 512-byte sectors typical of enterprise hard drives.  In order for the drive to rebuild, PI needs to be disabled.

  1. Using an SSH session log in to the Console as root user.
     
  2. Use the all_servers  command to create the /opt/storcli directory on all systems in your deployment.
    /opt/qradar/support/all_servers.sh -C -k "mkdir /opt/storcli"
     
  3. Download the storcli64 utillity from this technote.
    storcli64.tar
     
  4. Using WinSCP or equivalent tool move the storcli64 utility to the /opt/storcli/ directory  on the Console.
     
  5. Change to /opt/storcli directory
    cd /opt/storcli
     
  6. Use the all_servers command to move the file from the console to all system in the deployment.
    /opt/qradar/support/all_servers.sh -p storcli64.tar  -r /opt/storcli
     
  7. If the bad drive is not on the Console, use an SSH session connect to the Managed Host with the bad drive.
     
  8. Change directories to /opt/storcli
    cd /opt/storcli
     
  9. decompress the storcli64.tar file by typing:
    tar -xvf storecli64.tar
     
  10. Using the storcli command check the PI state on the drive
    /opt/storcli/storcli64 /c0 show pi

    The drive should show PI support off and PI import off.
     
  11. If the PI support state is on use the storcli command to set the PI support state=off.
    opt/storcli/storcli64 /c0 set pi state=off
     
  12. Verify that PI support state=off using the storcli command.
    /opt/storcli/storcli64 /c0 show pi
    The drive should show PI support off and PI import off.
     
  13. Re-run steps the section How to Rebuild a Drive starting with step  #4

 


 

Document information

More support for: IBM QRadar SIEM

Component: Hardware

Software version: 7.2

Operating system(s): Linux

Reference #: 1988146

Modified date: 31 October 2018