Optional customizable storage
For many models of AppResponse 11 appliance, you have the option of configuring the system with reduced packet storage space in order to store more analysis data. Two modes are supported:
• Packet data priority mode (pktprio) is the default, and is similar to the configuration of the earlier Shark platform, maximizing packet storage and using a smaller retention time for other data.
• Metric priority mode (metprio) is similar to the configuration of the earlier AppResponse 9 platform, increasing the retention time of analysis modules including aggregates, probe, WTA, DB performance and VoIP, but reducing the packet storage accordingly. On the ARX-6000, metprio mode does not allow selection of a storage unit (EXP-300).
The AppResponse 11 appliances that support these modes are:
• ARX-3300
• ARX-3800
• ARX-4300
• ARX-5100
• ARX-6000
• SCAN-02170
• SCAN-04170
• SCAN-06170
• SCAN-08170
• VSCAN-0100
• VSCAN-0500
• VSCAN-2000
In each mode, the general behavior of the system is the same, but the location where packet and analysis data is stored changes, and the amount of space allocated for each type of analysis data and for packet data varies. If you have a lot of existing analysis data, the transition from pktprio to metprio could take a long time. The layout configuration process should preserve all analysis data, except that packet capture data on the destination data section will be lost.
Note: The transition of storage mode from pktprio to metprio is one-way and irreversible.
Note: Changing the RAID mode of a Storage Unit must be done prior to applying "metprio" mode. Before making any changes to the storage mode, you should evaluate any changes you may wish to make to the default RAID 0 setup on your packet storage units. Any RAID changes must be made before changing the storage mode. If you happen to do this in reverse order, you will need to perform a reinstall or do a factory reset from the web UI.
Note: For SCAN-06170 appliances, if a RAID6 48TB Storage Unit is selected as the metprio mode destination, packet_capture will not be used on that Storage Unit, and a second Storage Unit must be available in order to capture packets.
Note: For SCAN-08170 appliances, RAID6 48TB Storage Units are not valid selections for metprio mode. Any other Storage Unit in any other valid mode is usable.
Note: During the time the change from pktprio to metprio is in progress, you may see error messages displayed in the Web UI as a result of some background services stopping.
The configuration process is invoked via a CLI command, takes up to a few hours to run, and is followed by a mandatory reboot. After the reboot, various analysis components use the packet capture volume to store data, increasing their retention times. It is not possible to switch back to the original (default) mode. In order to change the storage mode (or to specify a different storage unit for metprio mode), either a factory reset or a full reinstallation is required, and the storage that was configured previously for metprio mode must be reinitialized.
VM deployments require a secondary disk in order to use packet capture or switch to metprio mode. The recommended sizes for the secondary disk are:
• VSCAN-0100: 100GB
• VSCAN-0500: 2TB
• VSCAN-2000: 8TB
If the secondary disk is not large enough, then any attempt to switch to metprio mode via the CLI will result in an error. If the secondary disk is too large, then the extra space will be unused.