IBM Support

QRadar: Disk drive is in "Unconfigured (good)" state after replacement and is not being rebuilt automatically

Question & Answer


Question

A drive in the QRadar appliance that was replaced, is not automatically rebuilt into the RAID array, and is reported as "Unconfigured (good)".

Answer

Before you begin: This procedure is intended for appliances that will boot. If your appliance will not boot please contact support.

How to Rebuild a Drive

  1. Using an SSH session log in to the Console as root user.
     
  2. If the affected appliance is not the Console, SSH from the Console to the Managed Host with the bad drive.
     
  3. You need to get the correct enclosure position and slot of the drive by using the following command:

    opt/MegaRAID/MegaCli/MegaCli64 -PDList -aALL

    Output will be similar to:

    Adapter #0
    [...]
    Enclosure Device ID: 8
    Slot Number: 2
    [...]
    Firmware state: Unconfigured(good), Spun Up

     
  4. To get the right Array and Row position of the drive in the RAID array, execute:

    /opt/MegaRAID/MegaCli/MegaCli64 -pdgetmissing -aALL

    The output will be similar to:

    Adapter 0 - Missing Physical drives
    No. Array Row Size Expected
    0 0 3 3814697 MB

     
  5. Place the missing drive into the RAID array and run this command:

    /opt/MegaRAID/MegaCli/MegaCli64 -PdReplaceMissing -PhysDrv [8:2] -Array0 -row3 -a0

    Where 8 and 2 in [8:2] are the Enclosure Device ID and slot number, 0 in Array0 is the array number, 3 in row3 is the number of the drive in the RAID array, and 0 in a0 represents the adapter.

    Output should be similar to:

    Adapter: 0: Missing PD at Array 0, Row 3 is replaced.

     Note:  Should you see a message similar to this while running step #4

      Adapter: 0: Failed to replace Missing PD at Array 0, Row 3.

     FW error description:
     PDs in LD have incompatible EEDP types
     Exit Code: 0x63

    Do the steps in the section for PI Support

  6. To start rebuilding the drive run this command:

    /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -Start -PhysDrv [8:2] -a0

    Output should be similar to this:

    started rebuild progress on device encl 8 slot 2
     
  7. To check status on the rebuilding status, run this command:

    /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -ShowProg -PhysDrv [8:2] -a0

    Note: You might have to escape the brackets "[" and "]" as "\[" and "\]".

Protection Information (PI) Support
 

Protection Information (PI) adds an extra eight bytes of information to the 512-byte sectors typical of enterprise hard drives.  In order for the drive to rebuild, PI needs to be disabled. The StorCLI utility is required to modify the controller's PI state. StorCLI was added to QRadar in 7.4.0 Fix Pack 1. Before this patch, StorCLI will need to be downloaded and added to QRadar.

Downloading and installing StorCLI in QRadar versions prior to 7.4.0 Fix Pack 1
  1. Use an SSH session log in to the Console as root user.
     
  2. Use the all_servers command to create the /opt/storcli directory on all systems in your deployment.
    /opt/qradar/support/all_servers.sh -C -k "mkdir /opt/storcli"
     
  3. Download the storcli64 utillity from this technote.
    storcli64.tar
     
  4. Using WinSCP or equivalent tool move the storcli64 utility to the /opt/storcli/ directory on the Console.
     
  5. Change to /opt/storcli directory
    cd /opt/storcli
     
  6. Use the all_servers command to move the file from the console to all system in the deployment.
    /opt/qradar/support/all_servers.sh -p storcli64.tar -r /opt/storcli
     
  7. If the bad drive is not on the Console, use an SSH session connect to the Managed Host with the bad drive.
     
  8. Change directories to /opt/storcli
    cd /opt/storcli
     
  9. decompress the storcli64.tar file by typing:
    tar -xvf storecli64.tar
     
Using StorCLI to check and modify PI state
  1. Change directory to the StorCLI install directory.
    If installed in steps above: cd /opt/storcli
    7.4.0 FP1 and later: cd /opt/MegaRAID/storcli
  2. Use the storcli command to check the PI state on the drive
    ./storcli64 /c0 show pi

    The drive should show PI support off and PI import off.
     
  3. If the PI support state is on use the storcli command to set the PI support state=off.
    ./storcli64 /c0 set pi state=off
     
  4. Verify that PI support state=off using the storcli command.
    ./storcli64 /c0 show pi
    The drive should show PI support off and PI import off.
     
  5. Re-run steps the section How to Rebuild a Drive starting with step  #4
 

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Hardware","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 April 2021

UID

swg21988146