Disk drive is in "Unconfigured (good)" state after replacement and is not being rebuilt automatically

Question & Answer

 

해당 건은 QRadar 장비이며 일반 장비에서도 이와 같은 현상이 생길 수 있으니 참고하고 아래대로 하면 잘됩니다.

 

Question

A drive in the QRadar appliance that was replaced, is not automatically rebuilt into the RAID array, and is reported as "Unconfigured (good)".

Answer

Before you begin: This procedure is intended for appliances that will boot. If your appliance will not boot please contact support.

• How to Rebuild a Drive
• Protection Information (PI) Support
  • Downloading StorCLI
  • Using StorCLI

 

How to Rebuild a Drive

1. Using an SSH session log in to the Console as root user.
    
2. If the affected appliance is not the Console, SSH from the Console to the Managed Host with the bad drive.
    
3. You need to get the correct enclosure position and slot of the drive by using the following command:
   
   opt/MegaRAID/MegaCli/MegaCli64 -PDList -aALL
   
   Output will be similar to:
   
   Adapter #0
   [...]
   Enclosure Device ID: 8
   Slot Number: 2
   [...]
   Firmware state: Unconfigured(good), Spun Up
    
4. To get the right Array and Row position of the drive in the RAID array, execute:
   
   /opt/MegaRAID/MegaCli/MegaCli64 -pdgetmissing -aALL
   
   The output will be similar to:
   
   Adapter 0 - Missing Physical drives
   No. Array Row Size Expected
   0 0 3 3814697 MB
    
5. Place the missing drive into the RAID array and run this command:
   
   /opt/MegaRAID/MegaCli/MegaCli64 -PdReplaceMissing -PhysDrv [8:2] -Array0 -row3 -a0
   
   Where 8 and 2 in [8:2] are the Enclosure Device ID and slot number, 0 in Array0 is the array number, 3 in row3 is the number of the drive in the RAID array, and 0 in a0 represents the adapter.
   
   Output should be similar to:
   
   Adapter: 0: Missing PD at Array 0, Row 3 is replaced.
   
    Note:  Should you see a message similar to this while running step #4  Adapter: 0: Failed to replace Missing PD at Array 0, Row 3.
6.  FW error description:
    PDs in LD have incompatible EEDP types
    Exit Code: 0x63
   Do the steps in the section for PI Support
7. To start rebuilding the drive run this command:
   
   /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -Start -PhysDrv [8:2] -a0
   
   Output should be similar to this:
   
   started rebuild progress on device encl 8 slot 2
    
8. To check status on the rebuilding status, run this command:
   
   /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -ShowProg -PhysDrv [8:2] -a0
   
   Note: You might have to escape the brackets "[" and "]" as "\[" and "\]".

 

Protection Information (PI) Support
 

Protection Information (PI) adds an extra eight bytes of information to the 512-byte sectors typical of enterprise hard drives.  In order for the drive to rebuild, PI needs to be disabled. The StorCLI utility is required to modify the controller's PI state. StorCLI was added to QRadar in 7.4.0 Fix Pack 1. Before this patch, StorCLI will need to be downloaded and added to QRadar.

Downloading and installing StorCLI in QRadar versions prior to 7.4.0 Fix Pack 1

 

1. Use an SSH session log in to the Console as root user.
    
2. Use the all_servers command to create the /opt/storcli directory on all systems in your deployment.
   /opt/qradar/support/all_servers.sh -C -k "mkdir /opt/storcli"
    
3. Download the storcli64 utillity from this technote.
   storcli64.tar
    
4. Using WinSCP or equivalent tool move the storcli64 utility to the /opt/storcli/ directory on the Console.
    
5. Change to /opt/storcli directory
   cd /opt/storcli
    
6. Use the all_servers command to move the file from the console to all system in the deployment.
   /opt/qradar/support/all_servers.sh -p storcli64.tar -r /opt/storcli
    
7. If the bad drive is not on the Console, use an SSH session connect to the Managed Host with the bad drive.
    
8. Change directories to /opt/storcli
   cd /opt/storcli
    
9. decompress the storcli64.tar file by typing:
   tar -xvf storecli64.tar
    

Using StorCLI to check and modify PI state

 

1. Change directory to the StorCLI install directory.
   If installed in steps above: cd /opt/storcli
   7.4.0 FP1 and later: cd /opt/MegaRAID/storcli
2. Use the storcli command to check the PI state on the drive
   ./storcli64 /c0 show pi
   
   The drive should show PI support off and PI import off.
    
3. If the PI support state is on use the storcli command to set the PI support state=off.
   ./storcli64 /c0 set pi state=off
    
4. Verify that PI support state=off using the storcli command.
   ./storcli64 /c0 show pi
   The drive should show PI support off and PI import off.
    
5. Re-run steps the section How to Rebuild a Drive starting with step  #4