on Jan 29, 2019Article Content
| Article Number | 000037148 |
| Applies To | RSA Product Set: NetWitness Logs & Network RSA Product/Service Type: Core Appliance RSA Version/Condition: 11.x Platform: CentOS Platform (Other): VMware O/S Version: 7 |
| Issue | While upgrading a VM NetWitness appliance to NetWitness 11.x, some of the migrated mounts are missing. The pvscan output shows there is an "(unknown)" device.  The lvscan shows the missing appliance mounts are "inactive".  |
| Cause | If a "disk" is missing during the appliance boot, then the /dev/sd? device is not created, or will be removed if it was there. As the "disk" is missing this indicates that not all the VMDK files were migrated to the new NetWitness 11.x VM. |
| Resolution | In the ESXi server compared the number of disks configured in the old VM with the number of disks in the new VM. Find in the ESXi server a view that shows all the VMs configured disks, like the below example screenshot.  It is also possible the old VM's VMDK files are located on multiple datastore locations. Browsing the default datastore of the old VM may not find all the VMDK files. 1. Shutdown the new NetWitness 11.x VM. 2. Migrate the missing disk's VMDK files from the old VM to the new NetWitness 11.x VM. 3. Add the missing disk to the ESXi server configuration of the new NetWitness 11.x VM. 4. Restart the new NetWitness 11.x VM. 5. The missing mounts will now appear. |