Shulou(Shulou.com)06/02 Report--

1. Fault description

This case is the storage vmware exsi virtualization platform of HP P2000, which is composed of 10 lT hard drives in RAID-5, of which disk 6 is a hot spare. Due to the failure, two disks of the RAID-5 disk array are offline, showing a yellow light on two hard drives. Detected by the user's maintenance personnel, the faulty hard drive should be a physical fault, which is shown as: the serial number cannot be read and the hard drive cannot be recognized on the SAS expansion card.

two。 Data backup and repair

After the failure occurred, the user engineer contacted our company, and after detailed consultation, we learned that the fault was relatively serious, so we must bring the RAID-5 disk array to our company for testing to detect whether each member disk of RAID-5 is a physical fault (head damage or disk scratch) or a logical fault. Due to the emergency, the engineer immediately began to prepare for the test after receiving the original offer. Connect the identifiable good disk to the North Asia mirror server and use WinHex to do sector-level mirroring. at the same time, detect the unrecognized bad disk.

First of all, the bad disk is connected to the external SAS expansion card, and after power up, the hard disk motor can be judged by the working sound of the hard disk, but the magnetic head does not seek operation, so try to separate the hard disk PCB to clean the oxidation part of the HDA component, and the fault remains the same after the PCB is restored. So communicate with the customer to replace the good PCB of the No. 6 hot spare disk to the faulty disk for tentative repair, and then replace the ROM chip on the faulty disk PCB to the good PCB of the No. 6 disk after the hard disk rotates and the head seek sound is normal, but at the end of the seek, there is an obvious knock sound, so it is judged that the magnetic head may be damaged. After communicating with the user, try to use the good head in the No. 6 hot spare to replace the failed disk to read the data. After the fault disk is opened and replaced in the clean room, the fault disk is connected to the professional hard disk maintenance work for inspection, and it is found that the fault disk can not be identified and the data can not be read.

Because the user has two faulty disks, the previous attempt to repair is one of them, communicate with the customer again to try to repair the other faulty disk. Like the previous faulty disk, the fault of this disk is still head damage, because the user's HP OEM disk is expensive, so try to buy the same model of ST hard drive online to replace the head. After the head replacement of the hard disk is completed, the device can recognize the hard disk normally, so all sectors of the failed disk are fully mirrored to a backup disk of the same capacity.

3. Reassemble RAID-5 steps

[judge start sector] after all the hard disks have been mirrored, you can reorganize them. Open 9 disks with WinHex (hot spare does not need to be reorganized), and parse the image file into disk first. You can see that the 0 sectors of these 9 disks are marked with "55 AA", as shown in figure 1.

Figure 1

The result of the search is shown in figure 2. The type of partition is indicated at 0x01C2H, and "05" is shown here, indicating that this is an extended partition. Therefore, from sector 0, this is an abnormal MBR partition structure.

Figure 2

Continue to look down according to figure 1, and find the sign of "55 AA" on disk 9 and 8 respectively. The query result of disk 9 is shown in figure 3. This is a normal MBR partition whose value at 0x01C6 represents the header pointing to the next sector GPT.

Figure 3

The query result of disk 8 is shown in figure 4. The value at 0x01C6 indicates that it points to the next sector. But the next sector is clearly not the head of the GPT.

Figure 4

From this, it can be determined that disk 9 is the first disk, and disk 8 may be the last one. The sector in which the GPT partition is located starts at sector 172032, so it is preliminarily determined that the starting sector for LUN is 172032 sector.

[judge stripe size] stripe, also known as block, is the basic unit of RAID data processing. Different RAID have different band sizes. There is one check area in one stripe group of RAID-5, and the size of one check area is equal to the size of one stripe. According to this point, this RAID-5 case is analyzed. If you are not familiar with VMFS's file system, you can determine the stripe size by comparison. If there is a significant difference between the check area in a band group and the non-check area in this band group, you can find the stripe size by checking and comparing it with WinHex. In this case, it is determined that a stripe is 1024 sectors.

[judge RAID-5 member disk order] divide a record into a stripe size according to 1024 sectors, as shown in figure 5. And 9 disks jump to the same record 283123.

Figure 5

When all 9 disks are located in the same position, the direction of the check area can be judged by comparison, and then the trend of the whole RAID-5 can be judged. It has been determined that disk 9 is the first disk, put disk 9 in the first position, and then you can determine the direction, as shown in figure 6 (drive9 is the fourth disk). It is determined that RAID-5 is in the left direction, and the disk order is 9, 2, 3, 4, 10, 10, 1, 7, 8, and 5.

Figure 6

The previous content preliminarily determined that the starting sector of the LUN is 172032 sectors. Use WinHex to jump to 172032 sectors and observe the actual situation of each hard disk. If sector 172032 is the starting sector of the LUN, then disk 5 in the stripe to which this sector belongs should be the check area, but this strip shows that disk 8 is the check area. According to the left direction of the RAID-5 in this case, the check area of disk 5 should be in sector 172032-1024 171008, that is, the previous stripe. Jump to sector 171008 and find that the check area is disk 5. Therefore, it can be determined that the starting sector of the LUN is 171008 sectors.

[reassemble RAID-5] use professional recovery tools to group according to the determined inventory order and add it, as shown in figure 7. Select RAID-5,Stripe size 512KB, left out of step.

Figure 7

Click Build to reorganize. After grouping, since the data starts from 10248192 sectors, if the professional recovery tool does not have the function to jump to this sector, then the newly assembled RAID must perform another Build reorganization operation with a file. The starting sector (Start sectors) of the RAID is selected as 8192, and the file can choose any starting sector and size (Count sectors), as shown in figures 8 and 9, and figure 10 is a grouped RAID-5.

Figure 8

Figure 9

Figure 10

4. Handing over data

After the whole RAID-5 is rebuilt, the business of our company will contact the user for acceptance of the data, and the user will confirm that the data is fine. After signing the acceptance contract, the complete RAID-5 data can be handed over. When handing over, the data will be handed over to the new disk brought by the user according to the request of the user. The recovered data will be kept on our server for 3 days, after which the data will be automatically destroyed by the system.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.