Both internal RAID 1 SSD disks are failed (Slot 12 and Slot 13) in the RSA NetWitness Series 5 Hybrid appliance.
The /var/netwitness/concentrator/index mount is unavailable, and the NetWitness Series 5 Hybrid appliance is unable to boot. Image description
There is a known issue with SanDisk D417 SSD disks that are used in some NetWitness Series 5 Hybrid appliances where they can prematurely be marked as Bad. There is a SanDisk D417 SSD firmware update to fix.
SSD disks have a finite write life. Can see the remaining SSD write endurance in the NetWitness appliance iDRAC, Overview > Storage > Physical Disks, look at each appliance SSD disk at the field "Remaining Rated Write Endurance" which shows the remaining write endurance of the SSDs. When it drops to 0% the SSD disk becomes read-only. Image description
Option after RMA replacing both SSD disks and need to manually recreate the NetWitness /var/netwitness/concentrator/index mount
After replacing both SSD disks the RAID 1 configuration for the NetWitness /var/netwitness/concentrator/index mount is lost and needs to be manually recreated.
If the NetWitness appliance will not boot due to a Foreign configuration discovered. Choosing the option to import the Foreign configuration will likely create 2 separate Virtual Disks (VD4 & VD5) for the two new SSDs then boot into Single User Mode.
Create Volume Group "VolGroup4" on the new "sde" disk. vgcreate VolGroup04 /dev/sde vgscan
[root@hybrid ~]# vgcreate VolGroup04 /dev/sde Volume group "VolGroup04" successfully created
[root@hybrid ~]# vgscan
Reading volume groups from cache.
Found volume group "VolGroup03" using metadata type lvm2
Found volume group "VolGroup04" using metadata type lvm2
Found volume group "netwitness_vg00" using metadata type lvm2
Found volume group "VolGroup02" using metadata type lvm2
Found volume group "VolGroup01" using metadata type lvm2
Create a Logical Volume on the new Volume Group. lvcreate -y -n concinde -l 100%FREE VolGroup04 lvscan
[root@hybrid ~]# lvcreate -y -n concinde -l 100%FREE VolGroup04
Wiping ntfs signature on /dev/VolGroup04/concinde.
Logical volume "concinde" created.
[root@hybrid ~]# lvscan
ACTIVE '/dev/VolGroup03/concroot' [30.00 GiB] inherit
ACTIVE '/dev/VolGroup03/concsess' [1.00 TiB] inherit
ACTIVE '/dev/VolGroup03/concmeta' [<9.89 TiB] inherit
ACTIVE '/dev/VolGroup04/concinde' [744.62 GiB] inherit
ACTIVE '/dev/netwitness_vg00/nwhome' [486.53 GiB] inherit
ACTIVE '/dev/netwitness_vg00/warec' [390.62 GiB] inherit
ACTIVE '/dev/netwitness_vg00/root' [29.31 GiB] inherit
ACTIVE '/dev/netwitness_vg00/varlog' [10.00 GiB] inherit
ACTIVE '/dev/netwitness_vg00/usrhome' [10.00 GiB] inherit
ACTIVE '/dev/netwitness_vg00/swap' [4.00 GiB] inherit
ACTIVE '/dev/VolGroup02/decoroot' [30.00 GiB] inherit
ACTIVE '/dev/VolGroup02/decoinde' [30.00 GiB] inherit
ACTIVE '/dev/VolGroup02/decosess' [100.00 GiB] inherit
ACTIVE '/dev/VolGroup02/decopack' [<16.22 TiB] inherit
ACTIVE '/dev/VolGroup01/decometa' [<930.97 GiB] inherit
Make an xfs file system on the Logical Volume. mkfs.xfs /dev/VolGroup04/concinde
If any managed-values-* directories exist under the current /var/netwitness/concentrator/index directory, move them away. Otherwise, these directories and files will be hidden behind the new "/var/netwitness/concentrator/index" mount, causing lost disk space.
Reboot the Hybrid appliance and confirm the Concentrator service is running and is writing into the rebuilt Concentrator index mount. reboot
Preferred Option - Recover at least one of the two failed SSD SanDisk disks
Pull and fully re-insert each failed SSD disks (Slot 12 and Slot 13).
Download a copy of the new SanDisk D417 firmware. Reference: RSA NetWitness Availability of BIOS & iDRAC Firmware Updates Follow the link for SanDisk D417 for the model number(s) ..., under Series 5 to download the new SanDisk D417 firmware version, which is a Windows 64-bit .exe program that can be loaded via the appliance iDRAC. Image description
Try to update the SanDisk D417 firmware via the iDRAC, Overview > iDRAC Settings > Update and Rollback, choose the update SanDisk firmware Windows 64-bit .exe program and run it to update the firmware.