"Critical Error: PFS is inaccessible" on Security Analytics

Products

• Security Analytics
• Security Analytics - VA

Issue/Introduction

When logging into the GUI, a message is displayed in a pink banner that PFS is inaccessible.  If it mentions something about hard disks, it may also be related to this article: One or more disks have reported a failure

Cause

The PFS file system, which is used to store captured packet data is inaccessible or offline, usually due to a hardware failure.

Resolution

This error message can be caused by several things, but most of the time it is due to some sort of hardware failure with the capture file system.  Check the following things:

1. Look in the /var/log/messages file and search for any 'hardware' error messages.
2. Run 'df -h' from the command line and see if the /pfs partition is mounted.  If not mounted, try rebooting and see if it comes back.
3. Run 'lsi-show' from the command line and search for any Degraded or Offline volumes
4. If external storage is involved such as NetApp or Dell, check the storage utilities (MDSM, SANtricity or Powervault Manager) and look for drive errors.

If you suspect there are hardware errors, please call technical support for further assistance.  Have a CSR ready to send so that support can perform a full analysis (generated from the Settings > System page).  Please include a full shipping address with a contact name and phone number to expedite the processing of your request.  Also, let support know if you need a field tech to replace the part.

Additional Information

It is possible that if /pfs is corrupt due to failed hard drives, when the drives are replaced, you may need to run some consistency checks on the file system before /pfs will remount.  Some of these utilities are:

• dsfsck
• check_slot_files

If either of those come back with errors, they will need to be fixed before /pfs will mount.  

• dsfsck -f  (will usually resolve the slot errors)
• xfs_repair may be required to repair the XFS filesystem.

The pink banner can be cleared from any Web UI page by selecting the X at the far right side of the of the banner.  If the problem persists, the pink banner will be displayed again shortly.