Skip to content
  • There are no suggestions because the search field is empty.

Netwitness manage Mount Points, Virtual Disks, and Partitions Configuration on WD Ultrastar 60

Issue

var(--lwc-colorbackgroundalt
#fff));color: var(--slds-g-color-neutral-base-10
3 verticals (36 drives) contain

Tasks

>sans-serif;>Add the /etc/fstab entry for each partition created using the following commands:

sans-serif;>Navigate to /database/config directory.

#fff));color: var(--slds-g-color-neutral-base-10
var(--lwc-colorbackgroundalt
sans-serif;>   


Cause

#fff));>: When a new entry is added
#181818);>: Throughout this section
#181818);>: You must increment the number at the end of the partitions of how many drives you want to use. For example
var(--lwc-colorbackgroundalt

Resolution

How to delete an existing mount point, associated partitions, and virtual disk

This section provides instructions for removing a mount point, its associated partitions, and the virtual disk on the WD Datastar 60 device.

  1. Verify what partitions are located on the WD Datastar 60 device. By default, their size is 147.3T.

  2. Execute lsblk command to display the partitions.

  3. View the existing mounts using either command:
    mount -a or df
  4. Unmount the partition using the following command:
    /bin/umount /dev/sday1

  1. Delete the entry for /dev/sday1 from /etc/fstab file.
  2. Wipe the partition of all data using the following command:
    /usr/sbin/wipefs -a /dev/sday

Caution: Do not add the number at the end. This action is data destructive.

  1. Re-label the disk with gpt using the following command:
    /sbin/parted -s /dev/sday mklabel gpt

 

  1. Delete the virtual disk using the following command:
    arcconf delete 1 logicaldrive all

 

How to create a virtual disk

This section provides steps to create a RAID 50 out of 12 drives with 3 RAID groups. (4 drive x 4 drive x 4 drive):

  1.  View the current RAID configuration using the arcconf command:
    arcconf list 1

  2. Create the RAID 50 using the following command. You must start with the highest disk number and then decrease by one.

  3. In the following example, it starts with disk 59, which is the highest-numbered disk in a WD Ultrastar 60
    arcconf create 1 logicaldrive stripesize 1024 legs 3 method default max 50 0,59 0,58 0,57 0,56 0,55 0,54 0,53 0,52 0,51 0,50 0,49 0,48 noprompt

  4. If more than 12 drives are attached to the appliance, create any additional RAID 50 using the arcconf command.
    arcconf create 1 logicaldrive stripesize 1024 legs 3 method default max 50 0,47 0,46 0,45 0,44 0,43 0,42 0,41 0,40 0,39 0,38 0,37 0,36 noprompt

How to create the partitions for using a Log Hybrid Appliance with the WD Ultrastar 60

This section provides steps to create the necessary partitions for using a Log Hybrid appliance with the WD Ultrastar 60:

  1. Execute lsblk command to view the virtual disks and obtain the /dev/sdXX assigned to the disk.

    Note: Throughout this section, /dev/sddt will be used as an example.

 

  1. Verify that the correct label is associated with the new virtual disk using the following command for each vertical (containing 12 drives):

    Note: You must increment the number at the end of the partitions of how many drives you want to use. For example, 3 verticals (36 drives) contain packetdb1, packetdb2, packetdb3
    parted -s /dev/sddt mklabel gpt

 

  1. Create the partitions using the following commands:
    parted -s -a optimal /dev/sddt mkpart packetdb1 xfs 0% 50%
    parted -s -a optimal /dev/sddt mkpart conosess1 xfs 50% 55%
    parted -s -a optimal /dev/sddt mkpart conometa1 xfs 55% 100%
  1. Create the file system on newly created partitions using the following commands:
    mkfs.xfs /dev/sddt1
    mkfs.xfs /dev/sddt2
    mkfs.xfs /dev/sddt3
  1. Create new directories using the following commands.

    Note: Ensure the Hybrid appliance has been successfully orchestrated before this step otherwise this command will fail. You must also add a number to the end of the directory locations so that it does not overwrite any existing partitions.
    mkdir /var/netwitness/logdecoder/packetdb1
    mkdir /var/netwitness/concentrator/sessiondb1
    mkdir /var/netwitness/concentrator/metadb1

    6.   Execute the blkid command to list all block devices along with their UUIDs.

    1. Add the /etc/fstab entry for each created partition using the following commands.
      UUID=<UUID_num> /var/netwitness/logdecoder/packetdb1 xfs noatime,nosuid 1 2
      UUID=<UUID_num> /var/netwitness/concentrator/sessiondb1 xfs noatime,nosuid 1 2
      UUID=<UUID_num> /var/netwitness/concentrator/metadb1 xfs noatime,nosuid 1 2
    2. Reload the systemctl daemon using the following command:
      systemctl daemon-reload

    3. Verify the mount points are configured correctly using the following mount command. If the command fails, it indicates an issue that will prevent the device from rebooting properly:
      mount -a

     

    Append appropriate sizes for core services:

    1. Log into the NwLogDecoder REST interface or Explore view on the NetWitness UI.

    2. Navigate to /database/config directory and append lines to packet.dir.

      Note: When a new entry is added, it must be separated by a semi-colon ';'.
      /var/netwitness/logdecoder/packetdb1=72.19 TB
    3. Log into the NwConcentrator REST interface or Explore view on the NetWitness UI.

    4. Navigate to /database/config directory and append lines to the meta.dir and session.dir.

      Note: When a new entry is added, it must be separated by a semi-colon ';'.
      Meta.dir:
      /var/netwitness/concentrator/metadb1=64.97 TB

      Session.dir:
      /var/netwitness/concentrator/sessiondb1=7.22 TB
    5. Restart the NwLogDecoder and NwConcentrator services.

     

    How to create the partitions for using a Network Hybrid Appliance with the WD Ultrastar 60

    This section provides steps to create the necessary partitions for using a Network Hybrid appliance with the WD Ultrastar 60:

    1. Execute lsblk command to view the virtual disks and obtain the /dev/sdXX assigned to the disk.

      Note      : Throughout this section, /dev/sddt will be used as an example.


    2. Verify that the correct label is associated with the new virtual disk using the following command for each vertical (containing 12 drives):

      Note: You must increment the number at the end of the partitions of how many drives you want to use. For example, 3 verticals (36 drives) contain packetdb1, packetdb2, packetdb3.
      parted -s /dev/sddt mklabel gpt
    3. Create the partitions using the following commands:
      parted -s -a optimal /dev/sddt mkpart packetdb1 xfs 0% 63%
      parted -s -a optimal /dev/sddt mkpart conosess1 xfs 63% 68%
      parted -s -a optimal /dev/sddt mkpart conometa1 xfs 68% 100%

    4. Create the file system on newly created partitions using the following commands:
      mkfs.xfs /dev/sddt1
      mkfs.xfs /dev/sddt2
      mkfs.xfs /dev/sddt3

    5. Create new directories using the following commands:

      Note: Ensure that the Hybrid appliance has been successfully orchestrated before this step otherwise, this command will fail. You must also add a number to the end of the directory locations so that it does not overwrite any existing partitions.
      mkdir /var/netwitness/decoder/packetdb1
      mkdir /var/netwitness/concentrator/sessiondb1
      mkdir /var/netwitness/concentrator/metadb1
                   
    6. Execute the blkid command to list all block drvices along with their UUIDs.
    7. Add the /etc/fstab entry for each partition created using the following commands: 
      UUID=<UUID_num> /var/netwitness/decoder/packetdb1 xfs noatime,nosuid 1 2
      UUID=<UUID_num> /var/netwitness/concentrator/sessiondb1 xfs noatime,nosuid 1 2
      UUID=<UUID_num> /var/netwitness/concentrator/metadb1 xfs noatime,nosuid 1 2
    1. Reload the systemctl daemon using the following command:
      system daemon reload
    2. Verify that the mount points are configured correctly using the following mount command. If the command fails, it indicates an issue that will prevent the device from rebooting properly:
      mount -a

    Append appropriate sizes for core services:

    1. Log into the NwDecoder REST interface or Explore view on the NetWitness UI.

    2. Navigate to /database/config directory and append lines to the packet.dir.

      Note: When a new entry is added, it must be separated by a semi-colon ';'.
      /var/netwitness/decoder/packetdb1=90.97 TB
          
    3. Log into the NwConcentrator REST interface or Explore view on the NetWitness UI.

    4. Navigate to /database/config directory and append to the meta.dir and session.dir lines..

      Note: When a new entry is added, it must be separated by a semi-colon ';'.
      Meta.dir:
      /var/netwitness/concentrator/metadb1=46.20 TB

      Session.dir:
      /var/netwitness/concentrator/sessiondb1=7.22 TB

      1. Restart the NwDecoder and NwConcentrator services.

       

      How to create the partitions for using a Decoder and Log Decoder Appliances with the WD Ultrastar 60 
      This section provides steps to create the necessary partitions for using a Decoder and Log Decoder appliances with the WD Ultrastar 60: 
      1. Execute lsblk command to view the virtual disks and obtain the /dev/sdXX assigned to the disk.

        Note        : Throughout this section, /dev/sddt will be used as an example.


      2. Verify that the correct label is associated with the new virtual disk using the following command for each vertical (containing 12 drives):

        Note: You must increment the number at the end of the partitions of how many drives you want to use. For example, 3 verticals (36 drives) contain packetdb1, packetdb2, packetdb3
        parted -s /dev/sddt mklabel gpt
      3. Create the partitions using the following commands:
        parted /dev/sddt mkpart decoroot xfs 3MiB 20484MiB
        parted /dev/sddt mkpart decondex xfs 20484MiB 51204MiB
        parted /dev/sddt mkpart decosess xfs 51204MiB 1099782MiB
        parted /dev/sddt mkpart decometa xfs 1099782MiB 11585544MiB
        parted /dev/sddt mkpart decopack xfs 11585544MiB 100%

      4. Create the file
        sans-serif;>You must also add a number to the end of the directory locations so that it does not overwrite any existing partitions.

        #181818);>Note

        Notes

        #fff));>Notevar(--lwc-colorbackgroundalt
        #181818);>: Throughout this section
        #181818);>: You must increment the number at the end of the partitions of how many drives you want to use. For example

        Product Details

        var(--lwc-colorbackgroundalt
        #181818);>/dev/sddt #181818);>packetdb1

        Approval Reviewer Queue

        it must be separated by a semi-colon ';'.

        3 verticals (36 drives) contain #fff));color: var(--slds-g-color-neutral-base-10