System administrators installing RSA NetWitness appliances that are attached to Dell EMC Unity storage.
Dell EMC Unity storage is and accessible
Dell EMC PowerPath licenses are available. Note: Use the latest version of PowerPath.
An RSA NetWitness appliance is available that can be attached to Dell EMC Unity storage:
It is important to follow the steps in the order listed below.
Install the appliance software using the OS installation image
Allocate storage through the Dell EMC Unity UI
Install PowerPath on the appliance
Instantiate the appliance with the RSA NetWitness Platform software
Run the RSA NetWitness Unity configuration program
Install the Appliance
If your appliance does not already have the RSA NetWitness Platform 11.1 or 10.6.5 base OS image on it yet, you may have to install it using the RSA-provided OS image. Further details on installing the RSA NetWitness Platform install image are located in the following documents:
For the purpose of a Unity storage install, we will perform storage setup BEFORE setting up the appliance as an RSA NetWitness node.
Set up the Unity storage before running nwsetup-tui
Allocate Storage in Unity
You will need to work with your Dell EMC Storage Engineer to allocate storage within your Unity environment for the RSA NetWitness Platform.
RAID Groups needed for the RSA NetWitness Platform
Your Unity Storage will contain some number of NL-SAS drives and SSD drives, which may vary depending on the exact configuration purchased. For the purposes of the RSA NetWitness Platform, we recommend organizing RAID groups that correspond to each drive type.
RAID Group Type
All Packet Decoder volumes
All Log Decoder volumes All Archiver volumes
Concentrator meta volume
Concentrator index volume
RSA recommends that Packet and Log Decoders receive two LUNs, one for Packet data, the other for all other databases. This allows you to segregate the high-bandwidth Packet Database from the other databases so they do not compete for I/O bandwidth with other activity.
Concentrators require a separate SSD-based index volume for best performance. This will necessarily be housed on a different RAID group than the Concentrator Meta database volume, which can be stored on NL-SAS. Archivers can utilize a single large NL-SAS storage volume per appliance.
Recommended Storage Allocation Per Appliance
Meta/Session Volume (smaller NL-SAS volume)
Packet Volume (large NL-SAS)
Meta/Session Volume (medium-sized NL-SAS)
Packet Volume (medium-sized NL-SAS)
Meta Volume (large NL-SAS)
Index Volume (SSD)
Data Archive Volume (large-NL-SAS)
Every RSA NetWitness appliance that will be using the Unity storage needs to be added as a host within the Unity interface. After hosts and LUNs are created, you must assign the LUNs to the hosts. Assigning the LUNs to the hosts makes the storage visible to the host. At this point the host will be able to locate the storage through the host-based Dell EMC PowerPath software.
Install Dell EMC PowerPath on the Appliance
Dell EMC PowerPath must be installed on the appliance. Work with your Dell EMC Storage Engineer to receive your licenses and install the software.
Verify that the PowerPath license is installed using the emcpreg command:
Run the RSA NetWitness Unity Configuration Program
Run NwArrayConfig.py to allocate the storage volumes presented to your appliance within the RSA NetWitness Platform software.
This utility performs these tasks automatically:
Identifies PowerPath-controlled LUNs presented to the appliance.
Builds Linux volumes and filesystems
Creates mount points for the volumes
Updates the RSA NetWitness service configurations to utilize the provided volumes
Below is an example of successful output from NwArrayConfig successfully configuring Log Decoder storage:
[root@NWAPPLIANCE24932 ~]# /opt/rsa/saTools/NwArrayConfig.py Creating new volume group logdecodersmall on /dev/emcpowera Volume group "logdecodersmall" successfully created Creating new volume group logdecoder on /dev/emcpowerb Volume group "logdecoder" successfully created Success!: Added all available storage found. Successfully configured the logdecoder with the appropriate disk arrays. You will need to restart the logdecoder service for the database configuration to be loaded.
Validate that the filesystems have been created and mounted:
The Unity Config program generates a log file, arrayCfg.log, if it encounters an error in the Unity storage setup. Verbose command output can be found in this file. The arrayCfg.log file is created in the working directory from which the NwArrayConfig.py command is invoked.
Common Error Output from NwArrayConfig
Failed!: Ssl may be set opposite of what was attempted
The core service configuration could not be updated.
Verify that the core service is running (NwDecoder, NwLogDecoder, NwConcentrator or NwArchiver)
Failed!: No available VNX LUNs found. Verify VNX configuration before trying again.
The storage LUNs attached to this system have already been allocated.
As a safety precaution, NwArrayConfig will not overwrite any volume that might currently store data.
To reallocate LUNs, you must unmount any filesystems on them and manually remove the Logical Volumes, Volume Groups, and Physical Volumes defined on the LUNs.
Unity-specific Issues You May Encounter During Installation
Multiple drives show up in the ‘Failed State’ resulting in the Pool going offline. For example, you see messages stating "Storage pool NLPool is offline." The disks toggle between failed and normal state randomly.
Rebooting both the storage Processors at (or about) the same time resulting in the following error message:
The Dirty Cache data for LUN 4 has been lost. Gather service information and contact your service provider.
The storage processors must be rebooted one after the other. Make sure the first storage processor is before rebooting the second one.
In some cases, this could reflect a power failure scenario. Requires Dell EMC Support to resolve.
Incorrect SFP used in the host's Emulex cards
The SFP must be one of the following:
Finisar FTLF8529P3BNV (019-048-045)
Avago AFBR-57F5AMZ (no Dell EMC part number)
Delivered with new Emulex cards: Emulex Part No: NET-PCI-DELL-EMULXDP-8GB-FC-N NETWITNESS
Dell EMC PowerPath license not applied. This results in PowerPath not enabling all failover modes.
Run the following command on the RSA NetWitness host and the reboot the host:
emcpreg --add <LicenseCode>
Verify the License is applied with the following command:
Replace Unity Storage with JBOD (That is, DAC or PowerVault)
Scenario: You want to remove Unity as storage for a device previously and reconfigure the device to use DAC or PowerVault as storage (configured with a JBOD).
This case requires the below steps in addition to removing Unity and PowerPath rpm:
SSH to the host device.
Unmount and remove the file systems for Unity.
Open the /etc/lvm/lvm.conffile. vi /etc/lvm/lvm.conf
Search for global_filter in this file, and comment out the line you find starting with it. global_filter = [ "a|/dev/.*/by-id/scsi-3644a842047f0070022e3bd6a0a7ca863|", "a|/dev/.*/byd/scsi-3644a842047f0070022e3bd6b0a87a8a8|", "a/emcpower.*/", "r/sd.*/", "r/disk.*/"]
Change the global_filter arguments to the following argument. #global_filter = [ "a|/dev/.*/by-id/scsi-3644a842047f0070022e3bd6a0a7ca863|", "a|/dev/.*/byd/scsi-3644a842047f0070022e3bd6b0a87a8a8|", "a/emcpower.*/", "r/sd.*/", "r/disk.*/" ]
Restart the lvm daemon. systemctl restart lvm2-lvmetad.service
Configure JBOD (DAC or PowerVault) storage on the device as described in the DAC and PowerVault Hardware Setup Guides.