ELM not seeing SAN storage

[mwd35]

i have a problem with my elm, from the cli i can see the lun that has been allocated for the ELM, when i attempt to add the san storage to the data pool i see the following message repeated in the messages file.

EXT4-fs (sdd): mounted filesystem with ordered data mode. Opts: (null)

lsscsi shows the lun, GetSanVolumes returns valid results as well. how ever the UI refuses to show the san as a valid storage location. as it just shows NFS,iscsi, cifs.

[5:0:0:0]    disk    NETAPP   LUN              7350  /dev/sdd

i am also running 9.4.0

[alexander_h]

Give us some more details as it;s hard to say what is the problem.

Is that a VM or HW device?

What is the type of storage ? (FC is available only for HW devices)

But still the best will be to contact support as anyway you are paying for it.

[ninon.nkulu]

Hi,

I have the same problem using ELM 9.3.2 (HW 5600) and IBM SAN (14 TB).

Below are some message logs:

Aug 29 11:38:10 McAfee kernel: [  138.335196] scsi 8:0:0:0: Direct-Access     IBM      2145             0000 PQ: 0 ANSI: 6

Aug 29 11:38:10 McAfee kernel: [  138.335611] sd 8:0:0:0: Attached scsi generic sg3 type 0

Aug 29 11:38:10 McAfee kernel: [  138.336054] sd 8:0:0:0: [sdd] 30903631872 512-byte logical blocks: (15.8 TB/14.3 TiB)

Aug 29 11:38:10 McAfee kernel: [  138.336742] sd 8:0:0:0: [sdd] Write Protect is off

Aug 29 11:38:10 McAfee kernel: [  138.336745] sd 8:0:0:0: [sdd] Mode Sense: 97 00 10 08

Aug 29 11:38:10 McAfee kernel: [  138.337176] sd 8:0:0:0: [sdd] Write cache: disabled, read cache: enabled, supports DPO and FUA

Aug 29 11:38:10 McAfee kernel: [  138.338099]  sdd:

Aug 29 11:38:10 McAfee kernel: [  140.798075]  unknown partition table

Aug 29 11:38:10 McAfee kernel: [  140.800190] sd 8:0:0:0: [sdd] Attached SCSI disk

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Opened lock file /var/lock/FormatSanVolume.sdd, 1

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Formatting device sdd...

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Checking for QLogic card...

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Found QLogic card...

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Debug: Detaching daemon...

Aug 29 11:39:22 McAfee FormatSanVolume[4167]: Formatting SAN device sdd...

Aug 29 11:46:13 McAfee FormatSanVolume[4167]: Completed formatting SAN device sdd

Another problem is that even archiving on the ESM 9.3.2 (HW 5600) to IBM SAN (12 TB) doesn't work.

[rhinomike]

We are also experiencing the same issue.

In addition we have been told by McAfee that the ELM doesn't support Multi Patch configurations? It makes me wonder why do they sell HBAs with two ports? Has anyone been able to use Multipath with the ELM?

[gyhlavaty]

It is a bad joke, but Multi Path is not supported by McAfee... I don't know, why, because every SAN customer using multipathing.

... and:

- the CIFS and NFS is supported, but not recommended

- the iSCSI is supported, so buggy, and all of our customer try to avoid iSCSI

...

and the orderable DAS is a low end storage without any monitoring capability. it is only a big disk box.

[rhinomike]

:

This is something that according to McAfee won't be fixed, and in my opinion one of the worse flaws in the ELM offering. How can an "authoritative log archive" lack multipath is beyond my understanding.

To make it worse, it is not as if Multipath is a complex black magic technology... Instead, the RHEL / Centos technology that McAfee uses as the base OS for its appliances COMES WITH MULTIPATH out of the box, meaning that McAfee simply decided to remove the feature when building the ELM...

Compare that to ArcSight Logger 5.3 where multipath is not only supported but its use is clearly described in the Release Notes...

Clearly something that should take note...

[rhinomike]

Hi,

You will probably laugh about it but... rebooting the ELM should solve the issue where SAN LUNs aren't visible to the ELM! It is like I'm running Windows 95 to store logs!!

[hazwan]

Hi Guys,

Have you manage to add SAN Storage to ELM pool? What is the maximum size for SAN can be added? Last time I add 200Gb and after that my SAN guy give 400Gb but from the GUI I can set up to max 200Gb only. Any idea guys?