Loading...

Knowledge Center


Errors appear in logs indicating Solid State Drive failure for Enterprise Security Manager
Technical Articles ID:   KB89039
Last Modified:  11/16/2018

Environment

McAfee Enterprise Security Manager (ESM) 10.x, 9.6.x, 9.5.x

Problem

Errors appear in /var/log/messages indicating a possible SSD failure is occurring.

Mar 27 21:39:06 McAfee smartd[954]: Device: /dev/sda [SAT], 159094178578432 Offline uncorrectable sectors (changed +4294967296) 
Mar 27 22:09:06 McAfee smartd[954]: Device: /dev/sda [SAT], 159102768513024 Offline uncorrectable sectors (changed +8589934592) 
Mar 27 22:39:06 McAfee smartd[954]: Device: /dev/sda [SAT], 159124243349504 Offline uncorrectable sectors (changed +21474836480
)

Cause

Checking with the command below, the solid state drive (SSD) is identified as a Kingston SSD:

McAfee-ENMELM-5600 ~ # lsscsi
[0:0:0:0]    disk    ATA      KINGSTON SKC300S 524A  /dev/sda
[6:2:0:0]    disk    Intel    RMS25CB080       3.34  /dev/sdb
[6:2:1:0]    disk    Intel    RMS25CB080       3.34  /dev/sdc

Based on Kingston’s information, the values are referred to in the Error are actually the number of reads and not errors at all. From the following example:
 
Mar 27 21:09:06 McAfee smartd[954]: Device: /dev/sda [SAT], 159089883611136 Offline uncorrectable sectors (changed +8589934592) 
 
159089883611136 = 90B100000000 (The trailing bytes are zeros which means there are no uncorrectable sectors per Kingston.)

Kingston drives have a non-standard way of reporting uncorrectable errors. Traditionally, the number reported by a drive for uncorrectable sectors is just the number of uncorrectable sectors. Kingston drives instead report the number of sectors read joined to the number of uncorrectable sectors (upper 3 bytes contain the count of sectors read, lower 4 bytes contain the number of uncorrectable sectors).

The version of smartmontools on SIEM products does not recognize this non-standard correctible error data. Kingston says that version 6.5 of smartmontools is required to support the Kingston drive used in SIEM products.

Solution

This is a known issue and future releases of ESM will have a version of smartmontools which are compatible with the Kingston drive. Currently, there is no release date or time frame available regarding a correction for this issue.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.