Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Storage: (Optional) Series 6/6E Drive Pack for Decoder Meta Cache

Document created by RSA Information Design and Development Employee on Nov 16, 2020
Version 1Show Document
  • View in full screen mode
 

In NetWitness Platform version 11.5.1 and Later, for the Series 6/6E appliances, you can use a drive pack (1 or more 2.4TB 10K SAS drives) for the decodersmall or logdecodersmall volumes. These volumes are used to store the meta cache on the Decoders.

Both the Log Decoders and Network Decoders parse out meta data from the raw captured traffic. The meta data is then aggregated to a Concentrator for indexing. The host requires storage to store a cache for the meta extracted during the data capture for Concentrator aggregation. The meta cache on a Decoder is generally fixed in size but you can expand it to support additional cache to avoid possible connectivity loss between the Decoder and the corresponding Concentrator.

Typically, the decodersmall or logdecodersmall volumes are stored on the first 3 drives of the 1st and 2nd (10G config only) PowerVault enclosures.

When configuring Series 6/6E drive packs, the decodersmall and log decodersmall volumes will reside on the appliance. A minimum of 2 drives and a maximum of 6 drives must be configured. The number of drives will depend on how much cache is needed.

Benefits of Series 6/6E Drive Pack

  • Maximize PowerVault Storage Capacity - Traditionally, PowerVault storage allocates a volume for the Decoder metadata. This reduces the usable storage on the PowerVault. Drive Packs reduces this issue by providing 20TB of extra usable PV storage.
  • Reduces Cost for Meta Only Use Case - For metadata-only deployments, drive pack fits for a customer who want to purchase hardware from RSA. This provides more cost-effective solution, because a drive pack can substitute a PowerVault.

Configuring Series 6/6E Drive Pack

  • The drives MUST be installed post appliance imaging.

  • RAID can be setup either using the perccli, or from the Bios menu.

    • Bios menu requires rebooting to Bios setup menu (F2).

    • Select device settings, Integrated Raid controller: Dell <PERC H740P mini > configuration utility, Main Menu, Configuration Management, Create virtual Disk.

    • To create virtual disk, select RAID type and new drives.

      • Drives should be configured for RAID 1, 5 or 6

  • After the creation of the virtual disk is complete, a new block device will become available to the host.

  • To complete configuration the new block device must be configured for the application. For more information see, Task 3 - Allocate Block Devices to Partitions, Volume Groups, and Logical Volumes.

Previous Topic:Prepare Unity Storage
You are here
Table of Contents > (Optional) Series 6/6E Drive Pack for Decoder

Attachments

    Outcomes