You request to know what additional hardware needs to be installed into the Dell R720 appliance in order to use the Endpoint Data Recorder or Endpoint Activity Recorder feature in Advanced Threat Protection (ATP)/Endpoint Detection and Response (EDR) 3.0 and later.
This document is for Dell PowerEdge R720 hardware. This can be confirmed on the Appliance page of the ATP Manager or All-in-One server, shown here:
This information can also be determine at the command-line interface by running 'show --info' which will provide the following information:
localhost> show --info
Model Number: R720
Service Tag: XXXXXXX
System CPUs: Intel(R) Xeon(R) CPU E5-2697 v2 @ 2.70GHz (2)
CPU Cores: 48
Total Memory: 98304 (MB)
Disk Size: 558 (GB)
In order for the ATP 8880 appliance running on R720 to support the Endpoint Data Recorder feature, you will need to purchase 4 additional 1.8 TB hard drives and 12 RDIMMs of 16Gb RAM.
Component |
Dell Part Number |
Quantity |
---|---|---|
1.8TB 10K RPM SAS 512e 2.5in Hot-plug Hard Drive, Cus Kit 12G |
400-AJQM |
4 |
Dell 16GB Certified Memory - 2Rx4 DDR3 RDIMM 1866MHz SV |
A7187318 |
12 |
IMPORTANT: Retain your Customer Purchase Order details (number, dates, items purchased) for your component upgrade order. This information is required by Dell if the appliance requires hardware support or if there are warranty issues. Newly added Dell components are covered in the remaining support period of the appliance. Also make a note of the service tag for the appliance being updated with these newer components.
Before you start, download or otherwise procure the owner’s manual for your appliance platform: Dell R720:http://topics-cdn.dell.com/pdf/poweredge-r720_owner's%20manual_en-us.pdf
The Dell R720 has eight hard drive bays. The appliance ships with four 300GB, 15K, SAS hard drives configured as a RAID 5 array. This array provides approximately 550 GB of disk space. To scale the appliances for ATP 3.0, four additional hard drives are installed and configured as a second RAID 10 array. These extra hard drives are added to the four empty hard drive slots of the R720.
The new array uses four 1.8TB, 10K, SAS drives. The available space of the volume after RAID 10 configuration is approximately 3.3TB. To install the drives, follow the instructions provided in the Dell owner’s manual for the appliance.
IMPORTANT: You are replacing the existing memory modules, not adding to them. Be sure that you follow all module handling precautions as indicated by Dell. Mishandling memory modules can render them unusable due to static discharge or other damage incurred through improper insertion.
Upgrading the memory requires that you do the following:
The memory modules you are replacing are obvious by their physical appearance. Non-used slots are populated with blank modules that feature a plastic trim piece along the top. Leave these in place! The actual memory modules do not have the trim pieces. The memory modules you replace are indicated by the red arrows in the following image:
Warning: |
Memory module orientation is reversed for some of the slots- if the module does not readily insert, reverse its orientation and try again. DO NOT FORCE THE MODULES INTO PLACE! |
After you replace the memory modules, replace the cooling shroud and top panel, and plug the unit back into the electrical outlet. Follow the instructions in the manual to verify that the memory is properly recognized.
After installing the hard drives, you must configure them as a second RAID 10 array. You have two options to configure the array:
The iDRAC web interface is much easier to configure, since the BIOS menu only allows use of the arrow keys for navigation. However, if your organization does not allow the use of the iDRAC interface, the BIOS menu system is your only option.
After installing the new drives, perform the following steps to configure the RAID 10 drive array using iDRAC.
To configure the RAID 10 array using iDRAC
On the Apply Operation Mode drop-down menu, choose either Apply Now, Add to Pending Operations, or At Next Reboot.
Note: The 'At Next Reboot' option requires you to reboot the appliance before the virtual disk is initialized.
In the lower right corner, click Create Virtual Disk and at the prompt, click OK. Refresh the page.
Note: If you see a message that the capacity is out of range, remove the last decimal value from Capacity and try again.
In the left pane, select Storage. Verify that all eight disks are in the Ready state, and the Virtual Disks count is 2.
These instructions assume you’ve already installed the new hard drives and the server is powered down.
Click Advanced and on the Create Virtual Disk-Advanced panel, select Initialize and click OK.
Note: Verify that the Read Policy is set to Read Ahead, Write Policy is Write Back, and Strip Size is 64KB.
After the initialization is complete, click OK, and then click OK again.
Press Esc, then Ctrl+Alt+Delete to reboot into the ATP 3.0 software.
Once you have installed the upgraded hardware and configured the new virtual disk, you will need to run the 'extend_storage' command from the command-line interface (CLI).
The following screen shot provides an example:
You can then run 'show --info' again and you will see the new hardware accounted for:
localhost> show --info
Model Number: R720
Service Tag: XXXXXXX
System CPUs: Intel(R) Xeon(R) CPU E5-2697 v2 @ 2.70GHz (2)
CPU Cores: 48
Total Memory: 193233 (MB)
Disk Size: 4645 (GB)
You can now enable the Endpoint Data Recorder option on the ATP web interface under Settings -> Global next to the SEPM Web Servers configuration.