Focus

Panorama Administrator's Guide

Regenerate Metadata for M-Series Appliance RAID Pairs

Table of Contents

Regenerate Metadata for M-Series Appliance RAID Pairs

When a system failure occurs on the M-600, M-500, or M-200 appliance and you need to physically move the disks from one appliance to another, regenerating the metadata is necessary. The metadata is required to locate logs on the disk; when a user issues a log query, the query consults this metadata to access the requested log data.

For each configured RAID disk pair in the M-Series appliance, you must access the appliance CLI and run the following command to regenerate the metadata:

> request metadata-regenerate slot <slot_number>

For example:

> request metadata-regenerate slot 1

The size of the RAID disks determines how long metadata regeneration takes. On average, it takes an hour for every 100GB. When you run the command, the CLI session is locked until the command is fully executed. You can use multiple CLI sessions to save time. For example, to replace four RAID pairs of 1TB drives with a total of 4TB of log data, launch four CLI sessions and run the command in each session to regenerate metadata simultaneously for all the pairs/slots in about 10 hours.

During metadata regeneration, the Collector Group to which these disks belong is not available and the disk pair is not available for any logging or reporting operations (writes/queries). However, you can perform other tasks such as handling new firewall connections or managing configuration changes on the managed firewalls. All other Collector Groups that Panorama manages and that aren’t part of this RMA process can perform the assigned logging and reporting functionality as normal.

Migrate Log Collectors after Failure/RMA of Non-HA Panorama

View Log Query Jobs