IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Array Rebuild Logs

    Posted 03/16/20 10:26 AM
    Hi All,

    I've come in this morning and found that there's been two instances of rebuild events over the weekend which I've never seen before.

    At around 3AM: 806f070d-0405ffff : Rebuild in progress for Array in system

    Then around 2PM later that day:

    0x816f070d0405ffff Rebuild completed for Array in system

    I've had a look at a few articles and from my understanding we would see this happening if a drive failed and the RAID 6 would take over and rebuild the errored drive to a functioning one. However, I checked the IMM and all the drives are showing as okay. Can anyone point me in the right direction with this? I checked the event log and this hasn't occured since the console was comissioned several years ago.

    Thanks in advance!



    ------------------------------
    Sam Taylor
    ------------------------------


  • 2.  RE: Array Rebuild Logs

    Posted 03/17/20 04:12 AM
    Based on mentions of RAID 6 and IMM, I would assume this is the Lenovo-based QRadar appliance.
    There were some some particular circumstances with x-Series where such cases were not reported through IMM, so it mght be due to a bug in that firmware release (is it the latest firmware pack?). The best way would be to collect the DSA log and submit to support for analysis - guidance is available on this support page.

    ------------------------------
    Dusan VIDOVIC
    ------------------------------



  • 3.  RE: Array Rebuild Logs

    Posted 03/23/20 04:26 AM
    Thanks Dusan, one of the drives actually failed over this weekend so I'll be raising a case for support to get it swapped out.

    ------------------------------
    Sam Taylor
    ------------------------------

    Original Message


Related Content