Guide for Replacing the Entire Chassis on a NetWitness Appliance

Issue

Series 4S and Series 5 devices are EOL. Series 6 devices do not use SD Cards. Series 7 devices should follow the steps under Series 7 Chassis Swaps.

A chassis swap is done when the internal drives are good, but another part of the hardware has failed. The new chassis is not set up prior to swapping the drives from the failed appliance.

Note that you may encounter exceptions to this flow and this document does not necessarily cover every set of circumstances you might encounter.  If you encounter a problem and are unsure how to proceed, please contact Support for guidance.

Tasks

1. Start the new Core or Hybrid appliance connected to a crash cart.  It does not have to be connected to the network for this step. 
2. Review /etc/udev/rules.d/71-biosdevname.rules and note which MAC addresses are assigned to which network interface.  This may help when modifying this file after replacing the chassis.  
3. OPTIONAL:  Configure the iDRAC interface in the new Core or Hybrid appliance to match the iDRAC configuration in the existing appliance. When you swap the appliances you will have access to the new appliance using the same IP Address.  DO NOT implement this step if both iDRAC interfaces will be live at the same time.  

1. Label each drive denoting which bay it is installed in on the existing Core or Hybrid appliance. 
2. Label each drive denoting which bay it is installed on the new Core or Hybrid appliance. 
3. Remove the drives from the new Core or Hybrid and set aside. 
4. Install the drives from the existing Core or Hybrid into the same drive bay in the new Core or Hybrid appliance. 
5. Remove the existing appliance from the rack. 
6. Install the new appliance in the rack. 
7. Connect power, network, SAS and iDRAC cables. 
8. Turn on the appliance.  
9. If prompted for a BIOS password, use the default "rsabios" password. 
10. During POST, if you encounter "There are offline or missing virtual drives with preserved cache" you must boot into the RAID configuration utility and clear the cached memory.  Use this link for additional information on this step.  
11. During POST, if you encounter drives found in a "foreign" configuration, import those drives when prompted on the POST screen which may look like the following.  

12. Check the network configuration and adjust any network configuration files that might reference the old MAC addresses from the existing (now old) Core or Hybrid. Make sure to check /etc/udev/rules.d/71-biosdevname.rules for the correct MAC addresses.  See the sample rules file below.  
13. Reboot the new appliance and make sure it boots, connects to the network and resumes capture and aggregation. 

Cause

Motherboard or other non-user replaceable hardware has failed inside the appliance, but the drives are good.

Workaround

Changing the /etc/sysconfig/network-scripts/ifcfg- files:

In CentOS 7 NM_CONTROLLED should be no. In AlmaLinux, it should be yes.

Modify the ifcfg- file that matches the interface name in use, for Series 6 it should be ifcfg-em1.

(Sample file of ifcfg-em1 file below, certain files will contain additional or less variables. This is an example of how the NAME, HWADDDR and DEVICE variables need to be changed to reflect new chassis.)

After changing the contents of the file reboot, check the file, verify the interfaces using the ifconfig command and confirm capture starts.

NOTE: In 12.5.1.0 fresh installs, the ifcfg- files are replaced by /etc/NetworkManager/system-connections/ .connection .

Resolution

You can use these steps to complete the process of swapping the drives from an old appliance into a new appliance.

Preparation:

1. Review /etc/udev/rules.d/71-biosdevname.rules. If this is set up, note which MAC is assigned to which interface to update after the swap.
2. Run the following command to confirm which interfaces are in use: ifconfig -a or ip a

Swapping the Hardware:

1. Remove any drives from the new appliance and set aside.
2. Install the drives from the existing appliance into the same drive bay in the new appliance. Do this one drive at a time, making sure they are fully seated.
3. Remove the existing appliance from the rack, take note which network interface is in use.
4. Install the new appliance in the rack.
5. Connect power, network, SAS and iDRAC cables.
6. Turn on the appliance.
7. If prompted for a BIOS password, the default password is "rsabios".
8. During POST, if you encounter "There are offline or missing virtual drives with preserved cache" you must boot into the RAID configuration utility and clear the cached memory. See Dell PowerEdge RAID Controller 10 User’s Guide PERC H345, H740P, H745, and H840 Series Controllers | Dell US for more information.
9. During POST, if you encounter drives found in a "foreign" configuration, import those drives when prompted on the POST screen which may look like the following:
   
   
   1. Press "F" when presented with this option
10. Once booted, the network will likely be unavailable because the physical Network Interface Card will have different Hardware MAC addresses. If that is the case, the new HW MAC addresses will need to be applied to the existing ifcfg-* and the 71-biosdevname.rules as documented in the Workaround and Notes subsections below. Because network access will be down until these are fixed, they will need to be configured via the iDRAC Virtual Console or with physical access to the server console itself. 

Notes

Changing the /etc/udev/rules.d/71-biosdevname.rules file if needed (this may only be required if they were originally configured):

Make a backup of the file before making any changes in case you need to refer to the original configuration later. Copy or rename the /etc/udev/rules.d/71-biosdevname.rules to /root/71-biosdevname.rules.bak.

Manually edit the /etc/udev/rules.d/71-biosdevname.rules file to replace the MAC addresses from the old appliance with the MAC addresses of the new appliance.

Once you delete the old file or older lines, save the file.

Reboot the appliance and verify the MAC addresses in the /etc/udev/rules.d/71-biosdevname.rules file match the new MAC addresses and that the interface names are what you intended.

Sample File:  /etc/udev/rules.d/71-biosdevname.rules:

Series 7 devices:

These should be the same as Series 6.

Internal Comments

Product Details

NetWitness Product Set: NetWitness Logs & Network
NetWitness Product/Service Type: NetWitness Hardware
NetWitness Version/Condition: 11.x, 12.x
Platform: CentOS, AlmaLinux

Summary

Updated article to swap a chassis for Series 6 devices

Approval Reviewer Queue

Technical approval queue