"reset (Type 03)" showing up in /var/log/messages on Security Analytics

Products

• Security Analytics

Issue/Introduction

Bugs can be found in the firmware of drives.  The reset messages may look similar to:

Sep  8 21:25:01 server1 disk_subsystem[19374]: snlog: sn="##:##:##:##:##:##" id="DS" m="23" c="6" event="DISK_STATUS" category="HARDWARE" ip="192.0.2.1" model="R720xd" msg="Adapter 1; seqNum: 0x00055756; Time: Thu Sep  8 22:22:49 2016; Event Description: PD 1d(e0x26/s3) Path XXXXXXXXXXXXX  reset (Type 03); Device ID: 29; Enclosure Index: 38; Slot Number: 3; "

The tail end of the line indicates, in this case, slot 3.  If the slot number changes regularly, then this is a good candidate for a firmware update rather than a drive replacement.

 

Cause

The errors are caused by bugs in the firmware.

Resolution

Drive resets can happen periodically and as long as they are not happening frequently and on the same drive Slot, they can typically be ignored.  If there are multiple drive resets happening on the same drive within the same day or within the same week, it could be an indication of a drive that may fail soon, or it could still be a firmware issue.  It's a good idea to contact technical support before blindly applying a new firmware update.

There are multiple files from the manufacturer which can be obtained from Security Analytics support.  They are:

Brand     Model            Filename
Seagate   ST32000645SS     SAS-Drive_Firmware_568C9_LN_RS16_A00.BIN
Seagate   ST2000NM0001     SAS-Drive_Firmware_GXCDR_LN_PS08_A04.BIN
Seagate   ST2000NM0023     SAS-Drive_Firmware_MF5DP_LN_GS13_A00.BIN
Seagate   ST32000640SS     SAS-Drive_Firmware_XXTFT_LN_AS0B_A08.BIN
Toshiba   MG03SCA200       SAS-Drive_Firmware_0NXTP_LN_DG09_A00.BIN

Applying the firmware updates must be done after the drives are quiesced or idled.

The steps to update the Seagate drive firmware are:

1. Copy the attached file to your sensor.
2. Login as root over ssh to the sensor
3. Change the permissions of the file with  chmod u+x SAS-Drive_Firmware_*.BIN
4. Stop Security Analytics services with scotus stop
5. Run the appropriate firmware update file.

For example, ./SAS-Drive_Firmware_568C9_LN_RS16_A00.BIN
This may take 5-15 minutes.  

 

6. Monitor /var/log/messages for problems in the future by periodically running:

grep HARDWARE /var/log/messages
 

Notify support if you experience problems or have questions.