000026393 - RSA NetWitness Appliance Post Drive Replacement Steps

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000026393
Applies ToRSA NetWitness NextGen
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Concentrator
RSA NetWitness Hybrid
RSA NetWitness Broker
RSA Security Analytics
IssueRSA NetWitness Appliance Post Drive Replacement Steps.
What steps should be taken after a drive has been replaced on an RSA NetWitness appliance?
How do I configure a newly replaced drive as a hot spare on my Security Analytics appliance?

In the event that a single drive fails in your RSA NetWitness Appliance, the hot spare drive should take over for the failed drive.  Once a replacement drive is received and has been swapped out for the failed drive you will need to follow the steps below to configure the drive as the new hot spare.


After connecting to the appliance via SSH, issue the commands below:


  1. Run /opt/MegaRAID/CmdTool2/CmdTool2 pdlist a0 or /opt/MegaRAID/MegaCli/MegaCli64 pdlist a0
  2. Look through the list to find the newly added drive and check its firmware and foreign states.
  3. If the foreign state is not ?None? then run the following to clear the foreign configuration:
       /opt/MegaRAID/CmdTool2/CmdTool2 CfgForeign Clear a0 or /opt/MegaRAID/MegaCli/MegaCli64 CfgForeign clear a0
  4. If the firmware state shows ?unconfigured(bad)? then run the following, where EID is the enclosure ID and the SLOT is the slot number of the new drive:
      /opt/MegaRAID/CmdTool2/CmdTool2 PDMakeGood PhysDrv[EID:SLOT] Force a0 or

      /opt/MegaRAID/MegaCli/MegaCLI64 PDMakeGood PhysDrv[EID:SLOT] Force a0
  5. Run the following command to add the drive as the hot spare
      /opt/MegaRAID/CmdTool2/CmdTool2 PDHSP Set EnclAffinity PhysDrv[EID:SLOT] a0 or
       /opt/MegaRAID/MegaCli/MegaCli64 PDHSP Set EnclAffinity PhysDrv[EID:SLOT] a0


If you are unsure of any of the steps above or experience any issues, contact RSA Support for further assistance.


RSA NetWitness and Security Analytics appliances use the Intel MegaRAID utility for maintaining the RAID arrays.  The path varies depending on the appliance manufacturer.

  • Dell appliances (as well as some older appliances) use /opt/MegaRAID/MegaCli/MegaCli64
  • Super Micro appliances use /opt/MegaRAID/CmdTool2/CmdTool2


CAUTION!  The commands above assume that the drive in question is connected to Adapter 0.  To ensure that you are issuing the commands against the correct adapter, it is recommended that you utilize the NetWitness RAID Utility script.  See KB article How to Download and Use the RSA NetWitness RAID Utility for information on downloading and using the script.

Legacy Article IDa58660