IBM Support

QRadar: How to determine what RAID level is used on my appliance and it's impact on drive failure.

Question & Answer


Question

How do I determine what RAID level I am using so I can determine my appliance state in QRadar?

Answer

Before you begin: This Procedure is for Physical appliances and not Virtual appliances. If this is a virtual appliance refer to your Server Administrator for help.

To determine what RAID level your appliance is using use this procedure.

  1. Log in to the QRadar Console using an SSH session.
  2. If the suspect host where you need to verify the RAID level is not the Console, use an SSH session to the appliance you need to verify.
  3. Type the command: /opt/MegaRAID/MegaCli/MegaCli64 -ShowSummary -a0
  4. The Virtual Drives will be listed at the end of the output and the RAID Level will be displayed. The output will be similar to this:
    Storage
           Virtual Drives
                    Virtual drive      : Target Id 0 ,VD name
                    Size               : 12.725 TB
                    State              : Optimal
                    RAID Level         : 5
  5. The following table shows the available redundancy of each RAID level, which is to say how many physical drives can fail or go offline before the Virtual Drive will go offline and data is not available
RAID Level
 Redundancy Additional Notes
RAID - 0 None There is no redundancy in RAID 0. Data will be lost if any physical drive fails
RAID - 1 1 Data is mirrored. The virtual drive will continue to function with a single failed physical drive
RAID - 5 1 RAID 5 uses 1 physical drive for parity, and will continue to function with a single failed physical drive
RAID - 6 2 RAID 6 uses 2 physical drives for parity, and can continue to function with two failed physical drives
RAID - 10 1 drive in each disk group RAID 10 spans a Virtual Drive across multiple disk groups. Each disk group has 2 physical drives. The Virtual Drive will continue to function if no disk group has more than a single drive failure. If a disk group loses both physical drives, the Virtual Drive will go offline.
Results: While RAID 6 has potential multiple hard disk drive failure redundancy, it is still best practice to replace any failed hard disk drive as soon as possible.
Even If you experience a single drive failure, it will effect system performance and there will be increased risk of data corruption or data loss if additional drives fail before the down disk is replaced and rebuilt.  To reduce the chance that this may occur do the following:
  1. Pay attention to failed disk warnings.
  2. If you get a warning use this procedure to verify that there is an issue.
    Troubleshooting Disk Failure or Predictive Disk Failure Notifications
  3. Once a disk failure is confirmed contact IBM QRadar Support for a replacement.
For additional details on understanding RAID levels and how many drives you can safely loose with out a segmentation fault refer to this article.   Standard RAID Levels


 

Where do you find more information?


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"QRadar 7.2.8;7.3.1;7.3.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
18 February 2019

UID

ibm10740485

Page Feedback