NRT: Appendix A. Restore Series 6 Hybrid Storage Configuration Data

Document created by RSA Information Design and Development Employee on Jan 31, 2020Last modified by RSA Information Design and Development Employee on May 13, 2020
Version 3Show Document
  • View in full screen mode
 

The procedures in this Appendix do not apply if the hybrid was an 11.4 fresh installation and you had a disaster.

You must modify the /etc/fstab file for a Series5 or Series 6 Hybrid if a Series 5 or Series 6 Network Hybrid was upgraded from 11.2.x.x or 11.3.x.x to 11.4 and a disaster occurred.

These are the tasks to recovery from this disaster scenario.

  1. Image a new Series 5 or Series 6 Hybrid as Network Hybrid using an 11.4 ISO.
  2. Import the backed up data or configuration (nw-recovery-tool --import).
  3. Modify the recovered /etc/fstab file.

Sample etc/fstab File Before Disaster

The following data is an example of the external storage configuration backup for a Series 5 or 6 Hybrid that was upgraded to 11.4.

The data highlighted in yellow corresponds to internal storage on an upgraded system. This configuration is carried over from prior releases during upgrade process. This lay out changed in 11.4 (Fresh Install). You must only copy the entries corresponding to external storage (highlighted in green) to the new etc/fstab file as part of a disaster recovery.

When you export data or configuration using the nw-recovery-tool --export command, the storage configuration details are saved to <back-location>/unmanaged/etc/fstab. The fstab file contains both internal storage (highlighted in yellow) and external storage configuration (highlighted in green). The contents on a upgraded (10.6 or 11.x -> 11.4) Series 5 or Series 6 Network Hybrid look similar to the following storage configuration.

/dev/mapper/netwitness_vg00-root / xfs defaults 0 0 UUID=906e2a3d-3b59-46d1-975d-fa2b8467d009
/boot xfs defaults 0 0 /dev/mapper/netwitness_vg00-usrhome

/home xfs nosuid 0 0

/dev/mapper/netwitness_vg00-varlog /var/log xfs defaults 0 0

/dev/mapper/netwitness_vg00-nwhome /var/netwitness xfs nosuid,noatime 0 0

/dev/mapper/concentrator-vlnwc /var/netwitness/concentrator xfs noatime,nosuid 0 0

/dev/mapper/index-vlnwci /var/netwitness/concentrator/index xfs noatime,nosuid 0 0

/dev/mapper/concentrator-vlnwcm /var/netwitness/concentrator/metadb xfs noatime,nosuid 0 0

/dev/mapper/concentrator-vlnwcs /var/netwitness/concentrator/sessiondb xfs noatime,nosuid 0 0

/dev/mapper/decoderpacket-vlnwd /var/netwitness/decoder xfs noatime,nosuid 0 0

/dev/mapper/decoderpacket-vlnwdi /var/netwitness/decoder/index xfs noatime,nosuid 0 0

/dev/mapper/decodermeta-vlnwdm /var/netwitness/decoder/metadb xfs noatime,nosuid 0 0

/dev/mapper/decoderpacket-vlnwdp /var/netwitness/decoder/packetdb xfs noatime,nosuid 0 0

/dev/mapper/decoderpacket-vlnwds /var/netwitness/decoder/sessiondb xfs noatime,nosuid 0 0

/dev/mapper/netwitness_vg00-swap swap swap defaults 0 0

/var/netwitness/decoder /var/netwitness/logdecoder none defaults,rbind 0 0

/dev/concentrator0/sessiondb /var/netwitness/concentrator/sessiondb0 xfs noatime,nosuid 1 2

/dev/concentrator0/metadb /var/netwitness/concentrator/metadb0 xfs noatime,nosuid 1 2

/dev/decoder0/packetdb /var/netwitness/decoder/packetdb0 xfs noatime,nosuid 1

Sample etc/fstab File After Recovery - Before Modification

After you install 11.4 with the 11.4 ISO and execute the recovery tool execution to restore all previous configurations, the /etc/fstab file appears looks like the following example.

#
# /etc/fstab

# Created by anaconda on Thu Dec 5 17:31:26 2019

#

# Accessible filesystems, by reference, are maintained under '/dev/disk'

# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info

#

/dev/mapper/netwitness_vg00-root / xfs defaults 0 0

UUID=d84db66c-fce6-4fec-9f84-b3449861f664 /boot xfs defaults 0 0

/dev/mapper/netwitness_vg00-usrhome /home xfs nosuid 0 0

/dev/mapper/netwitness_vg00-varlog /var/log xfs defaults 0 0

/dev/mapper/netwitness_vg00-nwhome /var/netwitness xfs nosuid,noatime 0 0

/dev/mapper/netwitness_vg00-swap swap swap defaults 0 0

/dev/hybrid-decoder-meta/decoroot /var/netwitness/decoder xfs noatime,nosuid 1 2

/dev/packet/packetdb /var/netwitness/decoder/packetdb xfs noatime,nosuid 1 2

/dev/hybrid-concentrator/root /var/netwitness/concentrator xfs noatime,nosuid 1 2

/dev/index/index /var/netwitness/concentrator/index xfs noatime,nosuid 1 2

You can see that it is missing the external storage configurations. You must add the external storage configurations highlighted in green above) to the /etc/fstab file on the newly built Hybrid.

Sample etc/fstab File After Recovery - After Modification

After you make this updater, the /etc/fstab looks like the following example.

#

# /etc/fstab

# Created by anaconda on Thu Dec 5 17:31:26 2019

#

# Accessible filesystems, by reference, are maintained under '/dev/disk'

# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info

#

/dev/mapper/netwitness_vg00-root / xfs defaults 0 0

UUID=d84db66c-fce6-4fec-9f84-b3449861f664 /boot xfs defaults 0 0

/dev/mapper/netwitness_vg00-usrhome /home xfs nosuid 0 0

/dev/mapper/netwitness_vg00-varlog /var/log xfs defaults 0 0

/dev/mapper/netwitness_vg00-nwhome /var/netwitness xfs nosuid,noatime 0 0

/dev/mapper/netwitness_vg00-swap swap swap defaults 0 0

/dev/hybrid-decoder-meta/decoroot /var/netwitness/decoder xfs noatime,nosuid 1 2

/dev/packet/packetdb /var/netwitness/decoder/packetdb xfs noatime,nosuid 1 2

/dev/hybrid-concentrator/root /var/netwitness/concentrator xfs noatime,nosuid 1 2

/dev/index/index /var/netwitness/concentrator/index xfs noatime,nosuid 1 2

/dev/concentrator0/sessiondb /var/netwitness/concentrator/sessiondb0 xfs noatime,nosuid 1 2

/dev/concentrator0/metadb /var/netwitness/concentrator/metadb0 xfs noatime,nosuid 1 2

/dev/decoder0/packetdb /var/netwitness/decoder/packetdb0 xfs noatime,nosuid 1

Previous Topic:Disaster Recovery AWS
You are here
Table of Contents > Appendix A. Modify fstab for Series 5 and 6 Hybrid Storage After Recovery

Attachments

    Outcomes