Impending drive failure in storage array in Security Analytics

Products

• Security Analytics

Issue/Introduction

When looking at the storage array logs for a Security Analytics storage device, one of the drives is reporting a impending drive failure.

IMPENDING_DRIVE_FAILURE_RISK_MED-Recovery Failure Type Code: 25 

Typically this is seen on the Dell MD3860f or the NetApp E5660 storage arrays, but it can happen on others.

Environment

Cause

An impending failure means that a certain threshold on the drive has been reached, but the drive is still functioning.  The actual drive has not failed, but it has been flagged as a drive that may fail in the near future. 

Resolution

All Security Analytics RAID volumes are redundant or may include hot spares.  If the drive fails, the volume may become DEGRADED temporarily while the hot spare is added to the volume and the volume is reconstructed. The drive should be replaced soon.  Contact technical support for assistance with the drive replacement and have ready the storage array support log bundle.