I have a Packet Concentrator & Decoder that I am decommissioning and I need to wipe the data. I have wiped all of the data except the logical volumes below:
ACTIVE '/dev/netwitness_vg00/nwhome' [<202.66 GiB] inherit
ACTIVE '/dev/netwitness_vg00/root' [29.31 GiB] inherit
ACTIVE '/dev/netwitness_vg00/varlog' [10.00 GiB] inherit
ACTIVE '/dev/netwitness_vg00/usrhome' [10.00 GiB] inherit
ACTIVE '/dev/netwitness_vg00/swap' [4.00 GiB] inherit
Does anyone know how I can make these inactive so that I can remove them? Below is an example of the message that I am getting:
Logical volume netwitness_vg00/nwhome contains a filesystem in use.
Steps I have already done on our Concentrator to save time:
-Stopped nwconcentrator, nwdecoder
-Removed mounts from /etc/fstab
-umount /var/netwitness/concentrator/metadb, sessiondb, index
-lvremove /dev/concentrator/metadb, sessiondb
-pvremove -ff /dev/sdc
-pvremove -ff /dev/sdd
-vgremove –f <name of volume group>
-lvremove /dev/<name of volume group>
You will want to make sure that you are not in the directory that the volume group points to when you run the lvremove command... so change directory to /root first.
Also another command that may be helpful is 'lsof'. This will show any process that is using the filesystem.
> lsof /var/netwitness
you would need to reboot to single user mode to do everything except / (root), or boot to a live ISO and then remove them (so you are not running from those volumes
also, may want to do a wipe-a /dev/sdX (X being c or d) to and then disassemble the RAID volumes also note for the external volumes, you can use the Appliance rest port command sot remove the volumes and then remove the RAID configs