RAID Management
RAID helps to divide data storage over multiple disks, providing increased data reliability. For FortiAnalyzer devices containing multiple hard disks, you can configure the RAID array for capacity, performance, and/or availability.
Supported RAID levels
FortiAnalyzer units with multiple hard drives can support the following RAID levels:
Linear RAID
A Linear RAID array combines all hard disks into one large virtual disk. The total space available in this option is the capacity of all disks used. There is very little performance change when using this RAID format. If any of the drives fails, the entire set of drives is unusable until the faulty drive is replaced. All data will be lost.
RAID 0
A RAID 0 array is also referred to as striping. The FortiAnalyzer unit writes information evenly across all hard disks. The total space available is that of all the disks in the RAID array. There is no redundancy available. If any single drive fails, the data on that drive cannot be recovered. This RAID level is beneficial because it provides better performance, since the FortiAnalyzer unit can distribute disk writing across multiple disks. l Minimum number of drives: 2
RAID 1
A RAID 1 array is also referred to as mirroring. The FortiAnalyzer unit writes information to one hard disk, and writes a copy (a mirror image) of all information to all other hard disks. The total disk space available is that of only one hard disk, as the others are solely used for mirroring. This provides redundant data storage with no single point of failure. Should any of the hard disks fail, there are backup hard disks available.
- Minimum number of drives: 2
- Data protection: Single-drive failure
One write or two reads are possible per mirrored pair. RAID 1 offers redundancy of data. A rebuild is not required in the event of a drive failure. This is the simplest RAID storage design with the highest disk overhead.
RAID 1s
A RAID 1 with hot spare array uses one of the hard disks as a hot spare (a stand-by disk for the RAID). If a hard disk fails, within a minute of the failure the hot spare is substituted for the failed drive, integrating it into the RAID array and rebuilding the RAID’s data. When you replace the failed hard disk, the new hard disk is used as the new hot spare. The total disk space available is the total number of disks minus two.
RAID 5
A RAID 5 array employs striping with a parity check. Similar to RAID 0, the FortiAnalyzer unit writes information evenly across all drives but additional parity blocks are written on the same stripes. The parity block is staggered for each stripe. The total disk space is the total number of disks in the array, minus one disk for parity storage. For example, with four hard disks, the total capacity available is actually the total for three hard disks. RAID 5 performance is typically better with reading than with writing, although performance is degraded when one disk has failed or is missing. With RAID 5, one disk can fail without the loss of data. If a drive fails, it can be replaced and the FortiAnalyzer unit will restore the data on the new disk by using reference information from the parity volume.
- Minimum number of drives: 3
- Data protection: Single-drive failure
RAID 5s
A RAID 5 with hot spare array uses one of the hard disks as a hot spare (a stand-by disk for the RAID). If a hard disk fails, within a minute of the failure, the hot spare is substituted for the failed drive, integrating it into the RAID array, and rebuilding the RAID’s data. When you replace the failed hard disk, the new hard disk is used as the new hot spare. The total disk space available is the total number of disks minus two.
RAID 6
A RAID 6 array is the same as a RAID 5 array with an additional parity block. It uses block-level striping with two parity blocks distributed across all member disks.
l Minimum number of drives: 4 l Data protection: Up to two disk failures.
RAID 6s
A RAID 6 with hot spare array is the same as a RAID 5 with hot spare array with an additional parity block.
RAID 10
RAID 10 (or 1+0), includes nested RAID levels 1 and 0, or a stripe (RAID 0) of mirrors (RAID 1). The total disk space available is the total number of disks in the array (a minimum of 4) divided by 2, for example:
- 2 RAID 1 arrays of two disks each, l 3 RAID 1 arrays of two disks each, l 6 RAID1 arrays of two disks each.
One drive from a RAID 1 array can fail without the loss of data; however, should the other drive in the RAID 1 array fail, all data will be lost. In this situation, it is important to replace a failed drive as quickly as possible.
- Minimum number of drives: 4 l Data protection: Up to two disk failures in each sub-array.
RAID 50
RAID 50 (or 5+0) includes nested RAID levels 5 and 0, or a stripe (RAID 0) and stripe with parity (RAID 5). The total disk space available is the total number of disks minus the number of RAID 5 sub-arrays. RAID 50 provides increased performance and also ensures no data loss for the same reasons as RAID 5. One drive in each RAID 5 array can fail without the loss of data.
- Minimum number of drives: 6
RAID 60
A RAID 60 (6+ 0) array combines the straight, block-level striping of RAID 0 with the distributed double parity of RAID 6.
- Minimum number of drives: 8 l Data protection: Up to two disk failures in each sub-array.
Configuring the RAID level
To configure the RAID level:
- Go to System Settings > RAID Management.
- Click Change in the RAID Level The RAID Settings dialog box is displayed.
- From the RAID Level list, select a new RAID level, then click OK.
The FortiAnalyzer unit reboots. Depending on the selected RAID level, it may take a significant amount of time to generate the RAID array.
Monitoring RAID status
To view the RAID status, go to System Settings > RAID Management. The RAID Management pane displays the RAID level, status, and disk space usage. It also shows the status, size, and model of each disk in the RAID array.
| Summary | Shows summary information about the RAID array. |
| Graphic | Displays the position and status of each disk in the RAID array. Hover the cursor over each disk to view details. |
| RAID Level | Displays the selected RAID level.
Click Change to change the selected RAID level. When you change the RAID settings, all data is deleted. |
| Status | Displays the overall status of the RAID array. |
| Disk Space Usage | Displays the total size of the disk space, how much disk space is used, and how much disk space is free. |
| Disk Management | Shows information about each disk in the RAID array. |
| Disk Number | Identifies the disk number for each disk. |
| Disk Status | Displays the status of each disk in the RAID array. l Ready: The hard drive is functioning normally.
l Rebuilding: The FortiAnalyzer unit is writing data to a newly added hard drive in order to restore the hard drive to an optimal state. The FortiAnalyzer unit is not fully fault tolerant until rebuilding is complete. l Initializing: The FortiAnalyzer unit is writing to all the hard drives in the device in order to make the array fault tolerant. l Verifying: The FortiAnalyzer unit is ensuring that the parity data of a redundant drive is valid. l Degraded: The hard drive is no longer being used by the RAID controller. l Inoperable: One or more drives are missing from the FortiAnalyzer unit. The drive is no longer available to the operating system. Data on an inoperable drive cannot be accessed. |
| Size (GB) | Displays the size, in GB, of each disk. |
| Disk Model | Displays the model number of each disk. |
Swapping hard disks
If a hard disk on a FortiAnalyzer unit fails, it must be replaced. On FortiAnalyzer devices that support hardware RAID, the hard disk can be replaced while the unit is still running – known as hot swapping. On FortiAnalyzer units with software RAID, the device must be shutdown prior to exchanging the hard disk.
To identify which hard disk failed, read the relevant log message in the Alert Message Console widget. See Alert Messages Console widget on page 163.
Electrostatic discharge (ESD) can damage FortiAnalyzer equipment. Only perform the procedures described in this document from an ESD workstation. If no such station is available, you can provide some ESD protection by wearing an anti-static wrist or ankle strap and attaching it to an ESD connector or to a metal part of a FortiAnalyzer chassis.
When replacing a hard disk, you need to first verify that the new disk is the same size as those supplied by Fortinet and has at least the same capacity as the old one in the FortiAnalyzer unit. Installing a smaller hard disk will affect the RAID setup and may cause data loss. Due to possible differences in sector layout between disks, the only way to guarantee that two disks have the same size is to use the same brand and model.
The size provided by the hard drive manufacturer for a given disk model is only an approximation. The exact size is determined by the number of sectors present on the disk.
To hot swap a hard disk on a device that supports hardware RAID:
- Remove the faulty hard disk.
- Install a new disk.
The FortiAnalyzer unit automatically adds the new disk to the current RAID array. The status appears on the console. The RAID Management pane displays a green checkmark icon for all disks and the RAID Status area displays the progress of the RAID re-synchronization/rebuild.
Adding hard disks
Some FortiAnalyzer units have space to add more hard disks to increase your storage capacity.
Fortinet recommends you use the same disks as those supplied by Fortinet. Disks of other brands will not be supported by Fortinet. For information on purchasing extra hard disks, contact your Fortinet reseller.
To add more hard disks:
- Obtain the same disks as those supplied by Fortinet.
- Back up the log data on the FortiAnalyzer unit.
You can also migrate the data to another FortiAnalyzer unit, if you have one. Data migration reduces system down time and the risk of data loss.
- Install the disks in the FortiAnalyzer unit.
If your unit supports hot swapping, you can do so while the unit is running. Otherwise the unit must be shut down first. See Unit Operation widget on page 163 for information.
- Configure the RAID level. See Configuring the RAID level on page 174.
- If you backed up the log data, restore it.