"Critical Error: PFS is inaccessible" on Security Analytics

Products

• Security Analytics
• Security Analytics - VA

Issue/Introduction

When logging into the GUI, a message is displayed in a pink banner that PFS is inaccessible.  If it mentions something about hard disks, it may also be related to this article: One or more disks have reported a failure

It also could be the result of a power failure in the data center.  There could be a loose cord or a recent test of the backup power.

Cause

The PFS file system, which is used to store captured packet data is inaccessible or offline, usually due to a hardware failure.

Resolution

This error message can be caused by several things, but most of the time it is due to some sort of hardware failure with the capture file system.  Check the following things:

1. Look in the /var/log/messages file and search for any 'hardware' error messages with grep HARDWARE /var/log/messages
2. Run 'df -h' from the command line and see if the /pfs partition is mounted.  If not mounted, try rebooting and see if it comes back.
3. Run 'lsi-show' from the command line and search for any Degraded or Offline volumes
4. Run pv_monitor.sh -H and look for a Status other than OK.

If you suspect there are hardware errors, please call technical support for further assistance.  Have a CSR ready to send so that support can perform a full analysis (generated from the Settings > System page).  Please include a full shipping address with a contact name and phone number to expedite the processing of your request.  Also, let support know if you need a field tech to replace the part.

Additional Information

The pink banner can be cleared from any Web UI page by selecting the X at the far right side of the of the banner.  If the problem persists, the pink banner will be displayed again shortly.