Unconfigured Foreign Drives in Security Analytics appliances

Products

• Security Analytics

Issue/Introduction

When a drive enclosure (JBOD) is powered off abruptly as in the case of a power outage, the drives may not come up before the sensor head is powered up.  The drives are seen as missing and then once they are powered on and ready are seen as foreign to the sensor.  This may also happen when a single drive is replaced.

Resolution

The resolution is simple once you determine the adapter number from lsi-show.  The adapter number is either a0, a1, a2, or a3.  It is found by running lsi-show and looking under the Id in the "Controller Information" section.  You will need to run lsi-show to find the failed JBOD and then megacli -cfgforeign -import -a1.  Change the 1 to the Adapter number in your case.

For example, this is for Controller for Adapter a1:
Controller Information
Id   Serial No        Firmware             Encl LD   PD   Product Name
a1   38T012N          3.130.05-2086        2    2    24   PERC H810 Adapter

Look for the Physical Drive Information that contains the "Unconfigured(good), Spun Up" drive.  For example,

Physical Drive Information
Id   E:S      Status                         FC       Size           Inquiry
9    12:0     Unconfigured(good), Spun Up    Foreign  1.819 TB       SEAGATE ST2000NM0023    SERIAL_NUMBER
8    12:1     Unconfigured(good), Spun Up    Foreign  1.819 TB       SEAGATE ST2000NM0023    SERIAL_NUMBER

Look a few lines above these to the first occurrence of "Controller Information" and find the Controller Id.  If it says "a1" then it is Adapter 1.

Then run:
megacli -cfgforeign -import -a1
If it works properly, run lsi-show and  you should see:

Physical Drive Information
Id   E:S      Status                         FC       Size           Inquiry
9    12:0     Online, Spun Up    Foreign  1.819 TB       SEAGATE ST2000NM0023    SERIAL_NUMBER
8    12:1     Online, Spun Up    Foreign  1.819 TB       SEAGATE ST2000NM0023    SERIAL_NUMBER

If there were multiple drives, you will need to run "reboot" to restart Security Analytics with the corrected Capture filesystem.  

You may want to silence the audible alarm coming from the hardware with megacli -adpsetprop alarmsilence -aX, replacing X with the adapter/controller number.  Or do 0, 1, and 2 to cover them all.

If you get an error that importing the configuration will create an inconsistent state in the RAID, please call Blue Coat technical support for further assistance.