Configure Drive Pack(s)

[#1]

Configure Drive Pack(s)

The terms 'Meta Disk Kit' and Drive Pack' mean the same and are interchangeable.

Benefits of Series 6/6E Drive Pack

You can add additional drives to the Series 6 or 6E appliances to accommodate various use cases. These drives provide the capability for the decoder meta or concentrator index volumes to reside on the appliance. Each Meta Disk Kit has 3 drives. A maximum of 2 Meta Disk Kits can be installed on series 6/6E appliances. The Meta cache or index size determines the number of Meta Disk Kits.

• Maximize PowerVault Storage Capacity - Traditionally, PowerVault storage allocates a volume for the Decoder metadata. This reduces the usable storage on the PowerVault. Drive Packs reduce this issue by providing 20TB of extra usable PV storage.

• Reduces Cost for Meta Only Use Case - For metadata-only deployments, drive pack fits for a customer who want to purchase hardware from NetWitness. This provides more cost-effective solution, because a drive pack can substitute a PowerVault.

• Enable existing deployments to utilize compression options.

• Provides capability for expanding meta keys and associated indexing.

Decoder Meta Use Cases

• Meta-Only

• Maximize Power Vault Storage

Three or more 2.4TB 10K SAS SED drives can be added to a Decoder for the decodersmall or logdecodersmall volumes. These volumes are used to store the meta cache on the Decoders.

Both the Log Decoders and Network Decoders parse out meta data from the raw captured traffic. The meta data is then aggregated to a Concentrator for indexing.

The host requires storage to store a cache for the meta extracted during the data capture for Concentrator aggregation. The meta cache on a Decoder is generally fixed in size, but you can expand it to support additional cache to avoid possible connectivity loss between the Decoder and the corresponding Concentrator.

Typically, the decodersmall or logdecodersmall volumes are stored on the first three drives of the first and second (10G config only) PowerVault enclosures. By utilizing the drive pack option, these three drives can instead be used for the packetdb (maximizing Power Vault storage).

For meta-only scenarios, the decodersmall volume would be stored on the drive pack, therefore eliminating the need for a Power Vault.

Sample Storage Configuration Scenarios for Meta Disk Kit(s) on Decoder

This section describes how to configure a meta disk kit on a decoder as meta-only and maximized PowerVault storage capacity.

Meta-Only (No Externally Attached Storage)

Install and Configure one Meta Disk Kit (3 SED Drives configured as RAID 5) on S6 Core Appliance orchestrated as Decoder attached with one unconfigured PowerVault:

1. The configuration for Log Decoder is the similar as that of a Network Decoder. Substitute the service and volume names that correspond to Log Decoder.
2. A single Meta Disk pack is configured as RAID5 (3 drives) and two Meta Disk packs (6 drives) are configured as RAID6.
3. When configuring two Meta Disk Packs or adding the second Meta Disk pack, use appropriate disk slot numbers when creating the virtual drive.

On the Series 6 (Dell R640) appliance, the Meta Drive Pack disks are installed in slots 4, 5 and 6. The virtual drive configuration requires identifying the controller ID and Enclosure ID (EID). On Series 6 appliance, the controller ID and Enclosure IDs are 0 and 64. However, the nwraidtool.py script that is installed on every server can help to confirm these ID numbers.

1. Install the three drives in the Drive Pack in slots 4,5 and 6.

2. Identify the existing block devices using `raidList` property . Login to NW UI->Hosts->Select the Decoder Host->Actions->View->Explore->deviceAppliance->appliance (Right Click to access properties)->raidList and click Send.

   The existing devices on Controller 0, Enclosure 64 are highlighted in Yellow. The installed Drive Pack in slots 4,5 and 6 is underlined in Red.

   

3. ssh to the Decoder appliance or use iDRAC to connect to the decoder appliance console. Create the Virtual Drive or Drive Group (DG) on the internal controller using the disks in slot 4, 5 and 6 using the below command.

   /opt/MegaRAID/perccli/perccli64 /c0 add vd type=raid5 drives=64:4-6 strip=128

   

4. Identify the new device (highlighted in Yellow) using raidList command. Log into NW UI->Hosts->Select the Decoder Host->Actions->View->Explore->deviceAppliance->Appliance (Right Click to access properties)->raidList->Click on Send.

   

5. Execute the partNew command to create the decodersmall partition (decoder dir, index, metadb, sessiondb) with the following parameters.

   name=sdc service=decoder volume=decodersmall commit=1

   For logdecoder use: name=sdc service=logdecoder volume=logdecodersmall commit=1

   If a second Drive Pack is being configured, the volume for decoder would be ‘decodersmall0’. For logdecoder, it is ‘logdecodersmall0’.

   

   

6. Allocate the decodersmall to Decoder service using ‘srvAlloc’.

   service=decoder volume=decodersmall commit=1

   For logdecoder: service=logdecoder volume=logdecodersmall commit=1

   

Maximize PowerVault Storage Capacity

Installing and configuring a Drive pack on the Decoder appliance as decodersmall frees the first three drives on the attached Power Vault for storing additional packet data.

Best practice – when 1-4 PowerVaults are configured, a single Meta Disk kit is recommended and when 5-8 PowerVaults are configured two (2) Meta Disk kits are recommended (optional).

1. Follow the steps from 1 to 6 in Meta Only: No Externally Attached Storage section to configure one meta disk pack on decoder as decodersmall partition.

2. Use the Explorer view (Login into UI, select Hosts->Services->Decoder ->Actions->View- >Explorer->deviceAppliance->appliance(right click)->properties) -> raidList ->Click on Send, to identify and confirm the Controller Number, Enclosure Number, In Use, Drives, Devices, Drive Count, Size, and Vendor (highlighted in yellow).

   You should see the following information.

   In Use: FALSE

   Devices: <EMPTY>

   

3. Create the raid on the attached PowerVault. Identify the controller and enclosure from ‘raidList’. (Use appropriate value for preferSecure to enable encryption. To turn on encryption on SED capable drives, use preferSecure=1 after setting the security key on the controller. Encryption can also be turned on after configuring storage using the steps listed in Appendix B. Encrypt a Series 6E Core or Hybrid Host of the storage guide).

   controller=1 enclosure=250 scheme=packet-expansion commit=1

   

4. Identify the block device created in the earlier step. Use ‘raidList’ to retrieve all the block devices. In this case, it is ‘sdd’ (highlighted in Yellow).

   

5. Make partitions on the block device (‘sdd’) using ‘partNew’.

   name=sdd service=decoder volume=decoder commit=1

   

   

6. Allocate the decoder volume to Decoder service using ‘srvAlloc’.

   service=decoder volume=decoder commit=1

   

   Additional PowerVaults will be configured as outlined in the Storage Guide.

Concentrator Index Use Cases

• Support Additional Meta-Key Indexing

• Capability to Enable compression for Existing Deployments

Two or more 3.84 TB SSD SED drives can be added to a Concentrator to increase the index volume. The index storage needs are scaled based on the NetWitness Platform deployment retention requirements. If additional meta keys are enabled and indexed, it may impact index retention.

For existing deployments, an SSD index drive pack is required if you need to enable compression. When compressing the packetdb and metadb, additional index is needed to support compression of those databases.

Sample Storage Configuration for Concentrator Index with One Meta Disk Kit ( Three SSD’s)

This section describes the steps to configure a Meta Disk Kit (Three SSD’s) installed on a Series 6 appliance orchestrated as Concentrator and configured with One Power Vault.

- Concentrator index meta kit supports a minimum of two to a maximum of 6 drives (SSD).
- A single Meta Disk pack is configured as RAID5 (3 drives) or two Meta Disk packs (6 drives) are configured as RAID6. Two drive configuration is also supported. The two drives are added in slots 4,5 and configured as RAID1.
- When configuring two Meta Disk Packs or adding the second Meta Disk pack, use appropriate disk slot numbers when creating the virtual drive.

On the Series 6 (Dell R640) appliance, the Meta Drive Pack disks are installed in slots 4, 5 and 6. The virtual drive configuration requires identifying the controller ID and Enclosure ID (EID). On Series 6 appliance, the controller ID and Enclosure IDs are 0 and 64. However, the nwraidtool.py script that is installed on every server can help to confirm these ID numbers.

1. Install the three SSDs in the Meta Disk kit in slots 4,5 and 6 on the Concentrator Appliance.

2. Identify the existing block devices using raidList property. Login to NW UI->Hosts->Select the Concentrator Host->Actions->View->Explore->deviceAppliance->appliance (Right Click to access properties)->raidList and click Send.

   

3. ssh to the Concentrator appliance or use iDRAC to connect to the console. Use perccli to create the virtual drive with installed Meta Pack kit. Create the Virtual Drive or Drive Group (DG) on the internal controller using the disks in slot 4 through 6 using the below command.

   /opt/MegaRAID/perccli/perccli64 /c0 add vd type=raid5 drives=64:4-6 strip=128

   

4. Identify the new device (highlighted in Yellow) using raidList command. Login to NW UI->Hosts->Select the Concentrator Host->Actions->View->Explore->deviceAppliance->Appliance (Right Click to access properties)->raidList->Click on Send.

   

5. Execute the partNew command with the below parameters to create the new index partition on the block device (sde) created in earlier step:

   name=sde service=concentrator volume=index commit=1

   

6. Allocate the new index partition (index0) using srvAlloc property to concentrator service using the below parameters:

   service=concentrator volume=index0 commit=1

   

   

Enable Security on SED Capable Drives

To enable Security on the SED Capable Drive Group on PERC H740 Mini and PERC H840 Adaptors, see Appendix B. Encrypt a Series 6E Core or Hybrid Host (encryptSedVd.py) .