Virtual disk mounts missing after migrating the VMDK files during NetWitness 11 upgrade

Issue

While upgrading a VM NetWitness appliance to NetWitness 11.x, some of the migrated mounts are missing.

The pvscan output shows there is an "(unknown)" device.



The lvscan shows the missing appliance mounts are "inactive".

Cause

If a "disk" is missing during the appliance boot, then the /dev/sd? device is not created, or will be removed if it was there.

As the "disk" is missing this indicates that not all the VMDK files were migrated to the new NetWitness 11.x VM.

Resolution

In the ESXi server compared the number of disks configured in the old VM with the number of disks in the new VM.

Find in the ESXi server a view that shows all the VMs configured disks, like the below example screenshot.



It is also possible the old VM's VMDK files are located on multiple datastore locations. Browsing the default datastore of the old VM may not find all the VMDK files.

1.  Shutdown the new NetWitness 11.x VM.
2.  Migrate the missing disk's VMDK files from the old VM to the new NetWitness 11.x VM.
3.  Add the missing disk to the ESXi server configuration of the new NetWitness 11.x VM.
4.  Restart the new NetWitness 11.x VM.
5.  The missing mounts will now appear.

Product Details

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.x
Platform: CentOS
Platform (Other): VMware
O/S Version: 7

Summary

During the NetWitness upgrade to 11.x of a VMware virtual appliance, after migrating the VMDK files, not all appliance mounts are available.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue