IBM Support

QRadar: M7 hardware appliances use StoreCLI commands and deprecate MegaCLI functionality

News


Abstract

The release of QRadar appliances on M7 hardware deprecates the use of MegaCLI commands. Users who experience issues trying to run MegaCLI commands must use StorCLI. This technical note provides basic information and commands for users on QRadar M7 hardware.

Content

StorCLI is the command-line tool required by users to manage and configure Broadcom and Avago RAID controllers. StoreCLI supports all 12Gb per second and newer RAID controllers and is the only tool available to manage Tri-Mode and newer cards, premanently replacing MegaCLI.

Newer Dell appliances and QRadar M7 hardware appliances from Lenovo can experience issues where a storage reset occurs when querying the RAID controller with MegaCLI. MegaCLI commands can cause the RAID storage to be offline or unavailable while the adapter internally resets. Due to potential errors, QRadar 7.5.0 Update Package 4 and later versions scan for MegaCLI incompatible RAID controllers and remove the MegaCLI software during a new appliance (ISO) installation. Administrators must not attempt to reinstall MegaCLI as the software tool is incompatible with M7 appliances and can cause hardware issues. All commands going forward must use StorCLI to manage drives QRadar M7 appliances.

Before you begin

  • -a0 and /c0 options are used to issue commands to adapter 0 or controller 0. Most QRadar appliances include one RAID controller, which is controller 0. QRadar Packet Capture appliances include two RAID controllers. If you have QRadar Packet Capture appliances, you can use  /c0 or /c1 commands depending on which controller you need to update or query.
  • E:S and /ex/sx are place holders for the Enclosure ID and the drive slot number. A drive in slot 8, enclosure ID 134 on controller 0 would be:
    MegaCLI: slot 8, enclosure 134 StoreCLI: slot 8, enclosure 134
    -PhysDrv [134:8] -a0 /c0/e134/s8

Common command reference table

Administrators with M7 appliance can use this table to understand the differences between MegaCLI commands (deprecated) and StoreCLI commands that administrators must use.


Changing the drive state
Usage MegaCLI (do not use on M7 appliances) StoreCLI (
Force drive as good /opt/MegaRAID/MegaCli/MegaCli64 -PDMakeGood -PhysDrv [E:S] [-force] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx set good [force]
Set drive as good /opt/MegaRAID/MegaCli/MegaCli64 -PDMakeGood -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx set good
Set drive as hot spare /opt/MegaRAID/MegaCli/MegaCli64 -PDHSP -Set -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx add hotsparedrive
Display copyback progress /opt/MegaRAID/MegaCli/MegaCli64 -PDCpyBk -ShowProg -PhysDrv [E:S] -a0  /opt/MegaRAID/storcli/storcli64 /c0/ex/sx show copyback

Adapter event logs, information, and battery status
Usage MegaCLI (do not use on M7s) StoreCLI
Display all adapter info /opt/MegaRAID/MegaCli/MegaCli64 -AdpAllInfo -aALL /opt/MegaRAID/storcli/storcli64 /c0 show all
Display event logs /opt/MegaRAID/MegaCli/MegaCli64 -AdpEventLog -GetEvents -f /tmp/MegaCLI_Events.log-a0 /opt/MegaRAID/storcli/storcli64 /c0 show events file=/tmp/MegaCLI_Events.log
Display terminal logs /opt/MegaRAID/MegaCli/MegaCli64 -FwTermLog -Dsply -aALL /opt/MegaRAID/storcli/storcli64 /c0 show termlog
Display battery info /opt/MegaRAID/MegaCli/MegaCli64 -AdpBbuCmd -aALL /opt/MegaRAID/storcli/storcli64 /c0/cv show all
Drive location LED for replacement drives
Usage MegaCLI (do not use on M7s) StoreCLI
Enable drive locator light /opt/MegaRAID/MegaCli/MegaCli64 -PDLocate -Start -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx start locate
Disable drive locator light /opt/MegaRAID/MegaCli/MegaCli64 -PDLocate -Stop -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx stop locate
Virtual and physical drive information
Usage MegaCLI (do not use on M7s) StoreCLI
Display drive state /opt/MegaRAID/MegaCli/MegaCli64 -ShowSummary  -a0 /opt/MegaRAID/storcli/storcli64 /c0/dall show
Display adapter configuration /opt/MegaRAID/MegaCli/MegaCli64 -CfgDsply -aALL /opt/MegaRAID/storcli/storcli64 /c0/dall show all
Display physical drive information /opt/MegaRAID/MegaCli/MegaCli64 -PDList -a0 /opt/MegaRAID/storcli/storcli64 /c0/eall/sall show all
Display physical drive information with predictive disk failures /opt/MegaRAID/MegaCli/MegaCli64 -PDList -aALL | grep -i --before-context=20 "\adapter\|Firmware state:" | grep -i "\firmware\|slot\|enclosure device\|--\|adapter\|predictive failure count" | less /opt/MegaRAID/storcli/storcli64 /c0/eall/sall show all | egrep '[0-9]+:[0-9]|Count' | less
Show all drive information /opt/MegaRAID/MegaCli/MegaCli64 -PDInfo -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx show all
Commands used to replace drives that experience predictive disk failures
Usage MegaCLI (do not use on M7s) StoreCLI
Prepare and spindown drive for removal /opt/MegaRAID/MegaCli/MegaCli64 -PDPrpRmv -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx spindown
Spinup replacement drive /opt/MegaRAID/MegaCli/MegaCli64 -PDPrpRmv -Undo -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx spinup
Set drive to the offline state /opt/MegaRAID/MegaCli/MegaCli64 -PDOffline -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx set offline
Mark the drive as missing /opt/MegaRAID/MegaCli/MegaCli64 -PDMarkMissing -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx set missing
Show missing drive information /opt/MegaRAID/MegaCli/MegaCli64 -PdGetMissing -a0 /opt/MegaRAID/storcli/storcli64 /c0/dall show all
Replace missing drive /opt/MegaRAID/MegaCli/MegaCli64 -PdReplaceMissing -PhysDrv [E:S] -arrayN -rowN -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx insert dg=N array=N row=N
Start a drive rebuild /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -Start -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx start rebuild
Display rebuild progress /opt/MegaRAID/MegaCli/MegaCli64 -PDRbld -ShowProg -PhysDrv [E:S] -a0 /opt/MegaRAID/storcli/storcli64 /c0/ex/sx show rebuild

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtcAAA","label":"Hardware"}],"Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Document Information

Modified date:
04 January 2024

UID

ibm16967359