RAID management
RAID helps to divide data storage over multiple disks, providing increased data reliability. FortiAnalyzer units that contain multiple hard disks can have their RAID array configured for capacity, performance, and availability.
You can view the status of the RAID array from the RAID menu in System Settings > RAID Management. The RAID Management page displays the status of each disk in the RAID array, including the disk’s RAID level. This menu also displays how much disk space is being used.
Under Disk Management the following information is displayed: Disk Number, Member of RAID, Disk Status, Size (GB), and Disk Model. See Figure 44 on page 63.
The Alert Message Console widget, located in System Settings> Dashboard, will provides detailed information about any RAID array failures. For more information see “Alert Messages Console widget” on page 55.
If you need to remove a disk from the FortiAnalyzer unit, you might be able to hot swap it. Hot swapping means that you remove a failed hard disk and replace it with a new one while the FortiAnalyzer unit is in operation. Hot swapping is a quick and efficient way to replace hard disks. For more information about hot swapping, see “Hot swapping hard disks” on page 67.
Figure 44:RAID management menu page
To configure the RAID level:
- Go to System Settings > RAID Management, in the RAID Level field, select Change.
The RAID Settings dialog box opens.
Figure 45:RAID settings dialog box
- From the RAID Level drop-down list, select the RAID level you want to use, then select OK.
Once selected, depending on the RAID level, it may take a significant amount of time to generate the RAID array.
Supported RAID levels
FortiAnalyzer units with multiple hard drives can support the following RAID levels:
- Linear
Linear RAID combines all hard disks into one large virtual disk. The total space available in this option is the capacity of all disks used. There is very little performance change when using this RAID format. If any of the drives fails, the entire set of drives is unusable until the faulty drive is replaced. All data will be lost.
- RAID 0
- RAID 0 array is also referred to as striping. The FortiAnalyzer unit writes information evenly across all hard disks. The total space available is that of all the disks in the RAID array. There is no redundancy available. If any single drive fails, the data on that drive cannot be recovered. This RAID level is beneficial because it provides better performance, since the FortiAnalyzer unit can distribute disk writing across multiple disks. Minimum number of drives: 2
- RAID 1
- RAID 1 array is also referred to as mirroring. The FortiAnalyzer unit writes information to one hard disk, and writes a copy (a mirror image) of all information to all the other hard disks. The total disk space available is that of only one hard disk, as the others are solely used for mirroring. This provides redundant data storage with no single point of failure. Should any of the hard disks fail, there are backup hard disks available. Minimum number of drives: 2
- RAID 1 +Spare
- RAID 1 with hot spare (or RAID 1s) array uses one of the hard disks as a hot spare (a stand-by disk for the RAID). If a hard disk fails, within a minute of the failure, the hot spare is substituted for the failed drive, integrating it into the RAID array, and rebuilding the RAID’s data. When you replace the failed hard disk, the new hard disk becomes the new hot spare.
- RAID 5
A RAID 5 array employs striping with a parity check. Similar to RAID 0, the FortiAnalyzer unit writes information evenly across all drives but additional parity blocks are written on the same stripes. The parity block is staggered for each stripe. The total disk space is the total number of disks in the array, minus one disk for parity storage. For example, with four hard disks, the total capacity available is actually the total for three hard disks. RAID 5 performance is typically better with reading than with writing, although performance is degraded when one disk has failed or is missing. With RAID 5, one disk can fail without the loss of data. If a drive fails, it can be replaced and the FortiAnalyzer unit will restore the data on the new disk by using reference information from the parity volume.
Minimum number of drives: 3
Data protection: Single-drive failure
- RAID 5 +Spare
- RAID 5 with hot spare array uses one of the hard disks as a hot spare (a stand-by disk for the RAID). If a hard disk fails, within a minute of the failure, the hot spare is substituted for the failed drive, integrating it into the RAID array, and rebuilding the RAID’s data. When you replace the failed hard disk, the new hard disk becomes the new hot spare.
- RAID 6
- RAID 6 array is the same as a RAID 5 array with an additional parity block. It uses block-level striping with two parity blocks distributed across all member disks.
Minimum number of drives: 4
Data protection: Up to two disk failures.
- RAID 6 +Spare
- RAID 6 with hot spare array is the same as a RAID 5 with hot spare array with an additional parity block.
- RAID 10
RAID 10 (or 1+0), includes nested RAID levels 1 and 0, or a stripe (RAID 0) of mirrors (RAID 1). The total disk space available is the total number of disks in the array (a minimum of 4) divided by 2, for example:
- two RAID 1 arrays of two disks each
- three RAID 1 arrays of two disks each
- six RAID1 arrays of two disks each.
One drive from a RAID 1 array can fail without the loss of data; however, should the other drive in the RAID 1 array fail, all data will be lost. In this situation, it is important to replace a failed drive as quickly as possible.
Minimum number of drives: 4
Data protection: Up to two disk failures in each sub-array.
- RAID 50
RAID 50 (or 5+0) includes nested RAID levels 5 and 0, or a stripe (RAID 0) and stripe with parity (RAID 5). The total disk space available is the total number of disks minus the number of RAID 5 sub-arrays. RAID 50 provides increased performance and also ensures no data loss for the same reasons as RAID 5. One drive in each RAID 5 array can fail without the loss of data.
Minimum number of drives: 6
Data protection: Up to one disk failure in each sub-array.
- RAID 60
A RAID 60 (6+0) array combines the straight, block-level striping of RAID 0 with the distributed double parity of RAID 6.
Minimum number of drives: 8
Data protection: Up to two disk failures in each sub-array.
RAID support per FortiAnalyzer model
Table 4: RAID support per FortiAnalyzer model
| Model | RAID Type | RAID Level | Hot Swappable |
| FAZ-100C | – | – | – |
| FAZ-200D | – | – | – |
| FAZ-300D | Software RAID | Linear, 0, 1 | No |
| FAZ-400C | – | – | – |
| FAZ-1000C | Software RAID | Linear, 0, 1, 10 | No |
| FAZ-1000D | Software RAID | Linear, 0, 1, 10 | No |
| FAZ-3000D | Hardware RAID | 0, 1, 1 +Spare, 5, 5 +Spare, 6, 6 +Spare, 10, 50, 60 | Yes |
| FAZ-3000E | Hardware RAID | Yes |
Table 4: RAID support per FortiAnalyzer model (continued)
| Model | RAID Type | RAID Level | Hot Swappable |
| FAZ-3500E | Hardware RAID | Yes | |
| FAZ-3900E | Hardware RAID | Yes | |
| FAZ-4000B | Hardware RAID | 0, 5, 5 +Spare, 6, 6 +Spare, 10, 50, 60 | Yes |
| FAZ-VM | – | – | – |
| FAZ-VM64,
FAZ-VM64-HV |
– | – | – |
RAID disk status
The RAID management page displays the status of each disk in the RAID array. The possible disk states are:
- OK: The hard drive is functioning normally.
- Rebuilding: The FortiAnalyzer unit is writing data to a newly added hard drive in order to restore the hard drive to an optimal state. The FortiAnalyzer unit is not fully fault tolerant until rebuilding is complete.
- Initializing: The FortiAnalyzer unit is writing to all the hard drives in the device in order to make the array fault tolerant.
- Verifying: The FortiAnalyzer unit is ensuring that the parity data of a redundant drive is valid.
- Degraded: The hard drive is no longer being used by the RAID controller.
- Inoperable: One or more drives are missing from the FortiAnalyzer unit. The drive is no longer available to the operating system. Data on an inoperable drive cannot be accessed.
Hot swapping hard disks
If a hard disk on a FortiAnalyzer unit fails, it must be replaced. On FortiAnalyzer devices that support hardware RAID, the hard disk can be replaced while the FortiAnalyzer unit is still running, known as hot swapping. On FortiAnalyzer units with software RAID, the device must be shutdown prior to exchanging the hard disk.
To identify which hard disk failed, read the relevant log message in the Alert Message Console widget (see “Alert Messages Console widget” on page 55).
To hot-swap a hard disk on a device that supports hardware RAID, simply remove the faulty hard disk and replace it with a new one.
Electrostatic discharge (ESD) can damage FortiAnalyzer equipment. Only perform the procedures described in this document from an ESD workstation. If no such station is available, you can provide some ESD protection by wearing an anti-static wrist or ankle strap and attaching it to an ESD connector or to a metal part of a FortiAnalyzer chassis.
When replacing a hard disk, you need to first verify that the new disk has the same size as those supplied by Fortinet and has at least the same capacity as the old one in the FortiAnalyzer unit. Installing a smaller hard disk will affect the RAID setup and may cause data loss. Due to possible differences in sector layout between disks, the only way to guarantee that two disks have the same size is to use the same brand and model.
The size provided by the hard drive manufacturer for a given disk model is only an approximation. The exact size is determined by the number of sectors present on the disk.
The FortiAnalyzer unit will automatically add the new disk to the current RAID array. The status appears on the console. The RAID management page will display a green check mark icon for all disks and the RAID Status area will display the progress of the RAID re-synchronization/rebuild.
Adding new disks
Some FortiAnalyzer units have space to add more hard disks to increase your storage capacity.
To add more hard disks:
- Obtain the same disks as those supplied by Fortinet.
- Back up the log data on the FortiAnalyzer unit. You can also migrate the data to another FortiAnalyzer unit if you have one. Data migration reduces system down time and risk of data loss.
For information on data backup, see “Backing up the system” on page 49.
- If your device has hardware RAID, install the disks in the FortiAnalyzer unit while the FortiAnalyzer unit is running.
If your device has software RAID, shutdown the device (see “Shutdown” on page 52), install the disk or disks, then restart the device.
- Configure the RAID level.
If you have backed up the log data, restore the data. For more information, see “Restoring the configuration” on page 50.