ExtraHop Rescue Media Guide

The ExtraHop rescue media is a utility that enables you to recover, repair, or reset your ExtraHop system and settings.

Boot into the rescue media interface

For physical appliances, make sure that the rescue media is inserted into the ExtraHop appliance.

If you want to rescue an appliance through a later version of rescue media than what is currently attached to the appliance, you can create new rescue media or boot into the rescue media interface through virtual media. For more information, see Appendix A: Download and create rescue media and Appendix D: Boot into the rescue media interface through virtual rescue media.

To connect through iDRAC, see the Configure the iDRAC Remote Access Console guide.

  1. Restart the appliance from a console, serial, or iDRAC connection through one of the methods listed below, in the following recommended order
    • Log into the Admin UI through the command-line interface, and restart the system with the restart system command. It can take up to two minutes for the system to restart.
    • Press the power button once without holding, wait a few minutes for the system to shut down, and then press the power button again to restart the appliance.
    • Press and hold the power button until the appliance turns off. Then, press the power button again to restart the appliance. This method should only be tried if the previous methods are unresponsive, as a forced reboot can cause data loss.
  2. When the system reboots, follow the instructions on the screen to access the Boot Manager. The steps vary by the hardware manufacturing release. From the Boot Manager menu, select the option for the BIOS boot menu.
  3. Depending on your rescue media type, select to boot from either DVD ROM or USB. Do not select to boot from the NIC or the hard drive.
  4. The rescue media interface should appear. Select ExtraHop Rescue CD or ExtraHop Rescue USB and then press ENTER.

Recover the ExtraHop system after a crash

The system recovery option enables you to recover your ExtraHop system after an upgrade or restart failure, while maintaining your data and customizations. This option first attempts to replace the current system firmware with an existing backup. If no backup is available, the current system firmware is replaced with a verified version provided on the rescue media.

  1. From the Select Menu Option screen, select ExtraHop System Recovery and then press ENTER.
  2. Select Yes at the prompt to confirm that you want to recover the previous firmware installation.
  3. If no previous firmware is available, you will be prompted to replace the firmware with the firmware on the rescue media. Type Y and then press ENTER.
    Note:System recovery can take up to 45 minutes to complete.
  4. When prompted, press ENTER.
  5. Select Yes to reboot and press ENTER.
The appliance reboots, performs initialization of the system hardware, and then launches the ExtraHop firmware.

Reset the ExtraHop system to factory defaults

To install a copy of the ExtraHop system firmware, and remove all existing data and license information, you can reset the appliance to factory defaults.

  1. From the Select Menu Option screen, select ExtraHop System Factory Reset and press ENTER.
  2. Select Yes at the prompt to confirm that all data will be deleted and then press ENTER.
  3. You can perform a secure wipe of the ExtraHop appliance by selecting Yes and then pressing ENTER.
    Note:A secure wipe can take several hours to complete.
  4. When the installation is complete, select Reboot and then press ENTER to restart the system.
The appliance reboots, performs initialization of the system hardware, and then launches the ExtraHop firmware. Configure the system settings according to the deployment guide for the appliance.

Reset the ExtraHop administrator password

If you have forgotten your ExtraHop password for the Admin UI, you can reset the password to the system default. Then, you can log into the Admin UI for the appliance with the default password and change the default password to a secure password that you select.

Before completing these steps, return to the BIOS Boot Manager and select the option to boot from the system hard drive.

  1. From the Select Menu Option screen, select Reset Settings Menu and then press ENTER.
  2. Select Reset Password and then press ENTER.
  3. At the prompt to apply the change, press ENTER.
  4. Select Return to Main and then select OK and then press ENTER.
  5. Select Reboot and then press ENTER.
  6. Select OK and then press ENTER.

Perform a secure delete of all system data

You can permanently remove all of the data and customizations from your ExtraHop appliance. Select this option if you plan on disconnecting the ExtraHop appliance and want to securely remove all of your data.

Note:This process can take up to 90 minutes on an ExtraHop Discover appliance and up to 4 hours on an Explore appliance.
  1. From the Select Menu Option screen, select Wipe/Reset Menu.
  2. Select Run Secure Wipe and then select OK.
  3. Select the wipe pattern from the following options:
    • 1-pass Quick Fill with 0x00 - writes zeros to every sector of every disk on the appliance.
    • 1-pass One Random Pass - writes random bits to every sector of every disk on the appliance.
    • 3-pass DoD 5220.22-M - writes random bits to every sector of every disk on the appliance, then writes zeros to every sector of every disk on the appliance, and then writes ones to every sector of every disk on the appliance. Finally, a verification pass is performed.
  4. Select OK and then press ENTER.
The appliance reboots, performs initialization of the system hardware, and then launches the ExtraHop firmware.

Repair the file system

You can check the file system for errors and replace the existing firmware on the appliance with the version of the firmware that is on the rescue media. This option will remove your data and any customizations.

Warning:This procedure will remove your data and any customizations.
  1. From the Select Menu Option screen, select Repair File System, and then press ENTER.
  2. Select Yes at the prompt to check for file system errors, and then press ENTER.
The appliance reboots, performs initialization of the system hardware, and then launches the ExtraHop firmware. Configure the system settings according to the deployment guide for the appliance.

Rollback to a previous version of firmware

If a firmware update fails, you can replace the existing firmware on the appliance with the version of the firmware that is on the rescue media.

Warning:This procedure will remove your data and any customizations.
  1. From the Select Menu Option screen, select Roll Back Firmware, and then press ENTER.
  2. Select the type of installation you want to perform:
    • Full Roll Back
    • Restore Missing/Corrupted Files
  3. Select OK and then press ENTER.

Upgrade from RAID 0 to RAID 10

The ExtraHop system is configured by default with RAID 0 and four installed four drives. On the EH8000 and EDA 6100, you can purchase an additional four drives for the EH8000 and two drives for the EDA 6100 from ExtraHop and upgrade to a RAID 10 configuration.

Insert the new drives, starting with slots 4 and reboot the appliance. Then, follow the instructions in this guide to boot into the rescue media.
  1. From the Select Menu Option screen, select Advanced RAID Features and then press ENTER.
  2. Select Yes to begin migration.
    Note:After the migration process is complete, log into the ExtraHop Admin UI and verify that the disks states are online and functioning properly.
  3. Log into the ExtraHop Admin UI.
  4. In the Appliance Settings section, click Disks.
  5. In the Drive Map section, verify that all of the disks in the image are green.
  6. In the Firmware section, verify that the Status field displays Optimal. If the disks on the drive map are not all green and the RAID status is not optimal, see the Repair a Degraded RAID10 Configuration guide.
After you upgrade your RAID configuration, we recommend that you configure system health notifications. For more information, see the Notifications section of the ExtraHop Admin UI Guide

Appendix A: Download and create rescue media

All physical ExtraHop appliances come with either a Rescue CD or USB, which is in the drive. If you have misplaced the drive or want to rescue the system with a later version of ExtraHop firmware, you can download the rescue media and create a recovery CD or USB.

Note:If you do not have physical access to the appliance (for example, if the appliance is located in a remote datacenter or if it is a virtual appliance), you will not be able to attach new rescue media physically. However, you can download the latest rescue media locally and then boot into the rescue media interface through the virtual media. For more information, see Appendix D: Boot into the rescue media interface through virtual rescue media.

Create a rescue CD

  1. Log into the Customer Support Portal.
  2. In the Downloads section, click Utilities.
  3. Select the CD rescue media that is appropriate for your appliance model, and click Download.
    Note:For the Explore appliance, contact ExtraHop Support.
  4. Burn the .iso file to a CD according to the instructions for your CD-ROM.

Create a rescue USB

  1. Log into the Customer Support Portal.
  2. In the Downloads section, click Utilities.
  3. Select the USB rescue media that is appropriate for your appliance model, and click Download.
    Note:For the Explore appliance, contact ExtraHop Support.
  4. Copy the .img file to a USB flash drive through one of the following methods.
    • For Linux or Mac OS, run the following command from a terminal: dd if=<file location> of=<location of root block device>.
    • For Windows, copy the .img file with a utility such as Win32 Disk Imager.

Appendix B: Hardware tests

Hardware tests are performed before the ExtraHop appliance has shipped and should be performed after an appliance replacement or upgrade.

Cable the hardware for testing

  1. Connect the 10GB ports on the same interface card to each other with a fiber optic cable.
  2. Connect interface 1 to interface 2, and then connect interface 3 to interface 4 with Ethernet cables.

Run the hardware tests

  1. Boot into the rescue media interface.
  2. From the Select Menu Option screen, select Hardware Tests, and then press ENTER.
  3. From the Select Hardware Tests to Run screen, select the tests you want to run. By default, the first seven test are selected and marked with an asterisk. To select or deselect a test, highlight the area to the left of the test, and press ENTER.
  4. Select OK and press ENTER.
  5. As each test completes, the page will pause to enable you to view the results. Press PAGE UP or PAGE DOWN on your keyboard to scroll through the information.
  6. When you are finished reading the results, press any key, and then press Q on your keyboard to proceed to the next test.

Hardware test types

The following table provides information about the hardware tests that are available on the ExtraHop appliance.

Test Description Test Time
Firmware Verifies that the firmware version is correct by checking the MD5 sums on both the base firmware and the ExtraHop firmware. 5 seconds
Hard Drives Performs a test of all hard drives in the appliance. 5 to 10 seconds
Raid Controller Checks the RAID statistics and gives a summary of any errors. 5 seconds
Card Slot Placement Verifies that additional SSL and 10G cards are installed in the correct slots. 5 seconds
SSL Offload Turns on the card and performs two decryption tests. 5 seconds
NICs (Detection) Checks the appliance to ensure the number of detected interfaces matches the number of interfaces on the appliance. The result displays the number of interfaces detected and whether the detection test has passed. 5 to 10 seconds
NICs (Send/Receive) Verifies that the interfaces are working by sending and receiving data through the NICs. 1 minutes
Extended Hard Drive Test Performs a thorough test of the hard drive. This test can take up to 24 hours and checks every sector of every hard drive for errors. Run this test separately and only if there were errors in the previous hard drive tests. Up to 24 hours

Interpreting hardware test results

The following table provides information about how to resolve hardware tests failures.

If the steps in the Resolution column are unsuccessful, contact ExtraHop Support.
Test Failure Description Resolution
Firmware If a firmware test fails, the firmware or base image file might be corrupt. Return to the rescue media interface, and select ExtraHop System Recovery. If this option fails, return to the rescue media interface, and select ExtraHop System Factory Reset.
Hard Drives If the hard drive test fails, the drive might not be present or the drive might not be secure inside the slot. Seat the drive correctly in the slot and run the test again. If the error persists, contact ExtraHop Support to replace the drive.
Raid Controller If the RAID controller test fails, the drives might not be present or the drives might not be secure inside the slots. Seat the drive correctly in the slots and run the test again. If the error persists, contact ExtraHop Support to replace the drives.
Card Slot Placement If the card slot placement test fails, the output shows a slot mismatch for the 10G or SSL cards. Designated slots vary by appliance model. To verify the designated slots, refer to your appliance documentation. If you have trouble replacing the cards in the correct slots, contact ExtraHop Support.
SSL Offload If the SSL offload test fails, the SSL card was not initialized properly or it might be in the incorrect slot. Ensure that the SSL card is in the correct slot. If you have trouble replacing the cards in the correct slots, contact ExtraHop Support.
NICs (Detection) The output of the NIC detection test is a list of fiber interfaces and Ethernet interfaces on the ExtraHop appliance. Ensure that the number of detected interfaces matches the number of interfaces on the ExtraHop appliance. If one or more interfaces are not listed, ensure that all network interfaces and cards are present. If they are present and the system does not detect them, contact ExtraHop Support.
NICs (Send/Receive) Ensure that the number of detected interfaces matches the number of interfaces on the ExtraHop appliance. If one or more interfaces are not listed, ensure that all network interfaces and cards are present. If they are present and the system does not detect them, contact ExtraHop Support. Ensure that the cables are properly connected and restart the ExtraHop system. If the error persists, read the output to determine whether traffic was unable to send or receive. If there is no traffic, the NIC might be defective. To replace a defective NIC, contact ExtraHop Support.
Extended Hard Drive Test   Contact ExtraHop Support

Appendix C: Memory tests

If you experienced an error during the boot process after a firmware update or scheduled restart, the BIOS might have detected missing memory DIMMs. To identify the issue, reboot the system and perform the following memory tests. The memory test will cycle through all 36GB to 128GB of memory on the appliance.

When you boot into the rescue media, select Memory Test and press ENTER.
Note:The memory tests run infinitely and must be stopped manually. After you verify that the installed amount of memory matches the amount displayed in the results for each test, restart the system.

Any detected errors display automatically, similar to the following example:

Memory Initialization Warning: Memory size may be reduced.
MEMTEST lane failure detected on DIMM A2
MEMTEST failure - The following DIMM has been disabled by BIOS: DIMM A2
MEMTEST failure - The following DIMM has been disabled by BIOS: DIMM A5

If any errors are detected contact ExtraHop Support.

Appendix D: Boot into the rescue media interface through virtual rescue media

If you want to rescue an appliance through a later version of rescue media than what is currently attached to the appliance, you can create a new rescue CD or USB. However, if you do not have physical access to the appliance (for example, if the appliance is located in a remote datacenter or if it is a virtual appliance), you will not be able to attach new rescue media physically. In this case, you can download the latest rescue media locally and then boot into the rescue media interface through the virtual media.

  1. Download the rescue media.
    1. Log into the Customer Support Portal.
    2. Under Downloads, click Rescue media.
    3. Download the rescue CD file that is appropriate for your appliance model.
  2. Connect to the iDRAC virtual console.
    For information about connecting to the iDRAC virtual console, see the Configure the iDRAC Remote Access Console guide.
  3. On the iDRAC virtual console, click Virtual Media > Connect Virtual Media.
  4. Click Virtual Media > Map CD/DVD.
  5. Browse to the directory you downloaded the rescue media to and select the .iso file you downloaded.
  6. In the Virtual Media - Map CD/DVD dialog box, click Map Device.
  7. Click Next Boot > Virtual CD/DVD/ISO.
  8. Click Power > Power Cycle System (cold boot).
  9. In the Power Control dialog box, click Yes.
  10. On the rescue media interface, select ExtraHop Rescue CD and then press ENTER.
The Select Menu Option screen appears.
Published 2017-02-17 23:58