000012588 - An RSA NetWitness appliance hangs at the 'Probing EDD' step during the boot process

Document created by RSA Customer Support Employee on Jan 10, 2017•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000012588
Applies ToRSA NetWitness NextGen
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Concentrator
RSA NetWitness Hybrid
RSA NetWitness Broker
IssueAn RSA NetWitness appliance hangs at the "Probing EDD" step during the boot process.
ResolutionIf you are unable to get past the 'Probing EDD' screen you must do the following:

1.  Either reboot the appliance and disable console redirection (knowledgebase article How to temporarily disable console output to the serial port on an RSA NetWitness appliance) if viewing with a monitor and keyboard, or connect to the COM port with a serial cable, and application set to 115200,8,N,1.
2.  Hit enter and you should be presented with the option of entering the root password. After doing so, you will be in an emergency shell.
3.  Do the following to mount the '/' file system with read/write permissions:

mount -o remount,rw /

Once the root filesystem is mounted read-write, the /etc/rc.sysinit file must be edited to provide additional time for the RAID volumes to come online prior to LVM initializing. Currently the sleep statement is set to 2 seconds but this value should be increased to 10 seconds.  To do this, perform the following steps:

1.  Open /etc/rc.sysinit for edit.
2.  Find the first incident of 'lvm'.
3.  On the next line is the 'sleep 2' statement.
4.  Change the '2' to '10' and save the file.

Here are the affected lines as they appear prior to editing:

        if [ -x /sbin/lvm ]; then
                sleep 2
                action $"Setting up Logical Volume Management:" /sbin/lvm vgchange -a y --ignorelockingfailure
        fi

Here is how they should appear after the edit:

        if [ -x /sbin/lvm ]; then
                sleep 10
                action $"Setting up Logical Volume Management:" /sbin/lvm vgchange -a y --ignorelockingfailure
        fi
Notes

It has been found that some appliances will hang on boot while at the "Probing EDD" message screen. This is due to the RAID volumes not coming online in time prior to LVM starting. 

Due to the fact that serial console redirection is turned on by default, if connected with a monitor and keyboard you will not be able to see where the OS boot is stalled at, but it is mostly likely unable to mount a filesystem on a RAID volume.

Legacy Article IDa58608

Attachments

    Outcomes