5 Replies Latest reply on Nov 2, 2015 10:10 AM by dancd2l

    How to manually remove ELM storage pools

    drdsec

      All,

       

      I recently encountered this problem with a customer's ELM - An unused ELM storage pool could not be removed from the ESM user interface. Although the storage allocation mount point was removed, and the configuration references were removed from /etc/NitroGuard/alloc.conf, mgtdbloc.conf and storage.conf - the storage pools were stuck in the management database.

       

      The solution is to manually remove unused/orphaned storage pools from the ELM management database. Here's how -

       

      1. Stop ELM/RCVR services in the ESM UI Properties window.

      2. SSH to ELM/RCVR as root.

      3. cd /usr/local/elm/dfl

      4. nsql connect_elm_direct.sql

      5. select * from rg - Identify the row number for the pool you want to remove.

      6. delete from rg where rg.RGID= '1' - where 1 is the row number from step 5 that you want to remove.

      7. select * from sh - Identify the row number for the storage allocation you want to remove.

      8. delete from sh where sh.SHID= '1' - where 1 is the row number from step 7 that you want to remove.

      9. Start services from the ESM UI Properties window.

       

      Important - You should make a backup copy of /usr/local/elm/mgtdb before proceeding with these steps. I've only tested this in VM and in one customer environment on version 9.3.2. Your results could vary!

       

      Cheers,

      David

       

      Message was edited by: drdsec on 5/5/14 9:42:19 AM CDT
        • 1. Re: How to manually remove ELM storage pools

          Good Day Community,

           

          Although this post was made with the best of intentions, if you are unable to perform any action adequately via the provided GUI, i.e. you do not get the desired and expected results or it results in an error, please do not attempt to re-mediate the problem in the back end such as has been posted in the above.  Please ensure that a call is made into the Support network where we will be able to help.  Unfortunately, we are now in the position whereby the above steps were followed and we are now trying to recover the situation.  Please do call into Support and make the most of your support entitlement.  We are here to help and are very happy to do so.  Thank you.

           

          SIEM SEO

          • 2. Re: How to manually remove ELM storage pools
            dancd2l

            I have yet to find out when I can Delete a Pool.  I see the warning about not being able to delete a Pool "once it is used," but I have created some to test.  I expect that once the data has aged out and I have no data in the Pool I should be able to delete it through the GUI.  Is that correct?

            • 3. Re: How to manually remove ELM storage pools
              cbayless

              yes you should be able to delete through the gui

              • 4. Re: How to manually remove ELM storage pools
                shardwick

                In my trial and error, as well as, working with PS, ELM storage pools must be empty prior to being deleted/removed.  If a pool has been in use, you must:

                 

                - Turn off all current logging to that pool

                - Change the retention levels to lower the amount of data to the minimal timeframe. 

                 

                Example:

                StoragePool_1 = 1 year

                Change retention time to "1 day" and allow the residual data to fall out of the pool. 

                 

                - Validate through the ELM Usage logs that data is not being written to that pool

                 

                Then you can edit the pool (change/add/delete)

                 

                Caveat: I still had errors when attempting to delete the pools after following the steps above. They finally had to be removed manually by Tier 3.   I do not recommend modifying anything on the back end without PS being involved.

                • 5. Re: How to manually remove ELM storage pools
                  dancd2l

                  Thanks.  The step I was missing was to point all my sources to another pool.  I had some that weren't sending logs, but were still setup to.  So even though the ELM usage log showed zero logs, I still couldn't delete the pool because in theory it was still expecting them.  Once I cleared that up I was able to delete the pool.