IBM Support

QRadar: Commands that are used to identify a particular hard drive, in the chassis prior to replacement



There are two commands Administrators can use to identify a particular hard drive in the chassis. This can be helpful for drive replacement, if the drive is in predictive failure and has not been set offline by the RAID Controller:

Resolving The Problem

To locate the drive that requires replacement.

  1. SSH into your QRadar Console or Managed host with root privileges.
  2. To start flashing the drive LED, run the following command:
    /opt/MegaRAID/MegaCli/MegaCli64 -PdLocate -start -physdrv \ [ENCLOSURE:DRIVE\] -a0
  3. To stop flashing the drive LED, run the following command:
    /opt/MegaRAID/MegaCli64/MegaCli64 -PdLocate -stop -physdrv \[ENCLOSURE:DRIVE\] -a0

    All these commands are assuming there is only an adapter 0 ("-a0"), but you can also use "-aALL"
  4. Pull the drive you need to replace from the slot.
  5. Insert the new drive into the slot.

Results: The new drive should begin rebuilding.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Hardware","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"},{"code":"PF025","label":"Platform Independent"}],"Version":"7.0;7.1;7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018