Troubleshoot Issues with Fans on a FireSIGHT System

Introduction

This document discusses various troublesooting steps that you can follow to investigate an issue with fans on a Cisco FireSIGHT Management Center and FirePOWER appliance.

Symptom

A FireSIGHT system that has issues with fan may exhibit one of the following behaviors:

• System status LED is red or amber color.
• After turning on a FireSIGHT System, it creates excessive noise.
• A FireSIGHT Management Center displays the following health alert:

Module Hardware Alarms: FAN1 fan speed is running high.

 Or,

Module Hardware Alarms: FAN2 fan speed is running low.

Verification Steps

System LED and LCD Panel

• System status shows amber light when a fan crosses any critical or non-critical threshold.
• On a Series 3 FirePOWER appliance, the LCD panel's System Status mode displays fan status.

Note: If there is an issue with the fans on a Power Supply Unit (PSU), check the rear of the appliance. You may notice the Power Supply LED in red color.

Acoustic Noise Level

Depending on the hardware model of a FireSIGHT System, the noise level of a fan is different. Before you consider a fan is generating excessive noise, determine the acoustic noise level of the hardware model you are using. You can use a decibel meter to measure the actual noise level of your appliance.

RPM Level

If one of the fans stops working, all of the remaining fans run at 100% RPM to make sure that the heat in the chassis is staying under control. Thus the noise level of a system may increase. If you determine that the acoustic noise level of your appliance is very high, then run the following commands to determine if the system fans are working fine:

On a FireSIGHT Management Center,

admin@FireSIGHT:~$ sudo ipmitool sdr list | grep -i fan

System Fan 1A    | 7500 RPM          | ok
System Fan 2A    | 7100 RPM          | ok
System Fan 3A    | 7000 RPM          | ok
System Fan 4A    | 7200 RPM          | ok

Note: The above output is an example. An RPM level could be different depending on the hardware model you are using. Note that the status of each fan is shown as ok.

On a FirePOWER appliance,

> show fan-status 

------[ Hardware Fan Status ]-------

CPU1                      : Normal
CPU1                      : Normal
Mem1                      : Normal
Mem2                      : Normal
Sys1                      : Normal
Sys2                      : Normal

On the expert shell of a FirePOWER appliance,

> expert

admin@FirePOWER:~$ sudo ipmitool sdr list | grep -i fan

Processor 1 Fan  | 5544 RPM          | ok
Processor 2 Fan  | 5544 RPM          | ok
Memory Fan 2     | 4620 RPM          | ok
Memory Fan 1     | 4620 RPM          | ok
System Fan 1     | 5808 RPM          | ok
System Fan 2     | 4655 RPM          | ok

Troubleshoot

1. If the Cisco Engineering team identifies any bug on the hardware reporting system, a patch is developed and included in a recent release. Therefore, as a troubleshooting step, please update the software version of your FireSIGHT Systems to the latest software version.

2. If you still experience the issue, perform a cold boot of the appliance. A cold boot would include the following steps:

• Performing a graceful shutdown of the sensor.
• Disconnect the power cable from the appliance.
• Leave the appliance disconnected from the power for at least two minutes.
• Reconnect power after two minutes, and boot the appliance as you normally would.

After the appliance boots, the old health alerts should clear within 15 minutes.

Note: Performing a cold boot may resolve an issue, but it removes historical logs which could be helpful for root cause analysis.

3. If you receive new health alerts on fan status, generate a troubleshoot file and send this to Cisco TAC for analysis.

Related Documents

• Sourcefire Appliance Troubleshoot File Generation Procedures
• Health Alerts from Power Supply Unit of FireSIGHT System