cancel
Showing results for 
Search instead for 
Did you mean: 
mwd35
Level 7
Report Inappropriate Content
Message 1 of 8

ELM not seeing SAN storage

i have a problem with my elm, from the cli i can see the lun that has been allocated for the ELM, when i attempt to add the san storage to the data pool i see the following message repeated in the messages file.

EXT4-fs (sdd): mounted filesystem with ordered data mode. Opts: (null)


lsscsi shows the lun, GetSanVolumes returns valid results as well. how ever the UI refuses to show the san as a valid storage location. as it just shows NFS,iscsi, cifs.

[5:0:0:0]    disk    NETAPP   LUN              7350  /dev/sdd

i am also running 9.4.0

7 Replies

Re: ELM not seeing SAN storage

Give us some more details as it;s hard to say what is the problem.

Is that a VM or HW device?

What is the type of storage ? (FC is available only for HW devices)

But still the best will be to contact support as anyway you are paying for it.

Re: ELM not seeing SAN storage

Hi,

I have the same problem using ELM 9.3.2 (HW 5600) and IBM SAN (14 TB).

Below are some message logs:

Aug 29 11:38:10 McAfee kernel: [  138.335196] scsi 8:0:0:0: Direct-Access     IBM      2145             0000 PQ: 0 ANSI: 6

Aug 29 11:38:10 McAfee kernel: [  138.335611] sd 8:0:0:0: Attached scsi generic sg3 type 0

Aug 29 11:38:10 McAfee kernel: [  138.336054] sd 8:0:0:0: [sdd] 30903631872 512-byte logical blocks: (15.8 TB/14.3 TiB)

Aug 29 11:38:10 McAfee kernel: [  138.336742] sd 8:0:0:0: [sdd] Write Protect is off

Aug 29 11:38:10 McAfee kernel: [  138.336745] sd 8:0:0:0: [sdd] Mode Sense: 97 00 10 08

Aug 29 11:38:10 McAfee kernel: [  138.337176] sd 8:0:0:0: [sdd] Write cache: disabled, read cache: enabled, supports DPO and FUA

Aug 29 11:38:10 McAfee kernel: [  138.338099]  sdd:

Aug 29 11:38:10 McAfee kernel: [  140.798075]  unknown partition table

Aug 29 11:38:10 McAfee kernel: [  140.800190] sd 8:0:0:0: [sdd] Attached SCSI disk

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Opened lock file /var/lock/FormatSanVolume.sdd, 1

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Formatting device sdd...

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Checking for QLogic card...

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Found QLogic card...

Aug 29 11:39:22 McAfee FormatSanVolume[4159]: Debug: Detaching daemon...

Aug 29 11:39:22 McAfee FormatSanVolume[4167]: Formatting SAN device sdd...

Aug 29 11:46:13 McAfee FormatSanVolume[4167]: Completed formatting SAN device sdd

Another problem is that even archiving on the ESM 9.3.2 (HW 5600) to IBM SAN (12 TB) doesn't work.

Re: ELM not seeing SAN storage

We are also experiencing the same issue.

In addition we have been told by McAfee that the ELM doesn't support Multi Patch configurations? It makes me wonder why do they sell HBAs with two ports? Has anyone been able to use Multipath with the ELM?

Re: ELM not seeing SAN storage

It is a bad joke, but Multi Path is not supported by McAfee... I don't know, why, because every SAN customer using multipathing.

... and:

- the CIFS and NFS is supported, but not recommended

- the iSCSI is supported, so buggy, and all of our customer try to avoid iSCSI

...

and the orderable DAS is a low end storage without any monitoring capability. it is only a big disk box.

Re: ELM not seeing SAN storage

:

This is something that according to McAfee won't be fixed, and in my opinion one of the worse flaws in the ELM offering. How can an "authoritative log archive" lack multipath is beyond my understanding.

To make it worse, it is not as if Multipath is a complex black magic technology... Instead, the RHEL / Centos technology that McAfee uses as the base OS for its appliances COMES WITH MULTIPATH out of the box, meaning that McAfee simply decided to remove the feature when building the ELM...

Compare that to ArcSight Logger 5.3 where multipath is not only supported but its use is clearly described in the Release Notes...

Clearly something that should take note...

Re: ELM not seeing SAN storage

Hi,

You will probably laugh about it but... rebooting the ELM should solve the issue where SAN LUNs aren't visible to the ELM! It is like I'm running Windows 95 to store logs!!

Highlighted
hazwan
Level 8
Report Inappropriate Content
Message 8 of 8

Re: ELM not seeing SAN storage

Hi Guys,

Have you manage to add SAN Storage to ELM pool? What is the maximum size for SAN can be added? Last time I add 200Gb and after that my SAN guy give 400Gb but from the GUI I can set up to max 200Gb only. Any idea guys?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community