000037148 - Virtual disk mounts missing after migrating the VMDK files during NetWitness 11 upgrade

Document created by RSA Customer Support Employee on Jan 29, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037148
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.x
Platform: CentOS
Platform (Other): VMware
O/S Version: 7
IssueWhile upgrading a VM NetWitness appliance to NetWitness 11.x, some of the migrated mounts are missing.

The pvscan output shows there is an "(unknown)" device.

pvscan (unknown)

The lvscan shows the missing appliance mounts are "inactive".

User-added image
CauseIf a "disk" is missing during the appliance boot, then the /dev/sd? device is not created, or will be removed if it was there.

As the "disk" is missing this indicates that not all the VMDK files were migrated to the new NetWitness 11.x VM.
ResolutionIn the ESXi server compared the number of disks configured in the old VM with the number of disks in the new VM.

Find in the ESXi server a view that shows all the VMs configured disks, like the below example screenshot.

User-added image

It is also possible the old VM's VMDK files are located on multiple datastore locations. Browsing the default datastore of the old VM may not find all the VMDK files.

1.  Shutdown the new NetWitness 11.x VM.
2.  Migrate the missing disk's VMDK files from the old VM to the new NetWitness 11.x VM.
3.  Add the missing disk to the ESXi server configuration of the new NetWitness 11.x VM.
4.  Restart the new NetWitness 11.x VM.
5.  The missing mounts will now appear.