Prior to risky uninstall, pull one disk of raid 1 as a fallback?

[barrelrider]

I have to deal with a windows 2003 std server that has not been taken care of for years. It has an old, unsupported version of McAfee anti virus enterprise installed on it that is intermittently going nuts and taking over the cpu. I need to uninstall it. McAfee regards the software as end of life and is not available as a resource.

I am concerned that when I uninstall the anti virus software it could make a mess and possibly result in a server that won't boot or something of that order. There are backups from ntbackup of the server, but there is no way to test a restore short of just doing it.

The server is an IBM eServer xSeries 226 with hardware raid 1 (two mirrored disks). I was wondering if a fairly safe approach to this uninstall event would be to remove one disk prior to the uninstall, and if all succeeds, reintroduce the disk. On the other hand, if the uninstall results in a broken server, I could remove the disk that participated in the uninstall, and then boot from the disk that was pulled before the uninstall. Is this a reasonable approach?

I have never pulled a disk from this box so I don't really know what "it" will do when in the scenario above I reintroduce the 2nd disk. I suppose at boot time a screen would appear asking which disk it should 'go' with?

It's using Adaptec AIC-7902B HostRAID, with Adaptec AIC-7902B Ultra320 SCSI.

I not a raid wiz that's for sure, so I don't know if what I asked above is completely absurd, or reasonable. Thanks for any help!

 

[Nebulocity]

Take my recommendation with a grain of salt. I work in IT and deal with much the same situation that you are dealing with...in fact, it could be considered "typical": ie "We have no one to support this 'old and busted' system, and you're the system admin, so you can take it". Yay for being "voluntold" instead of "volunteered".

Do you plan to move this server to a virtual environment, by chance? If so, I would wait until you can do a conversion from disk to virtual disk, so you have a virtual server that is exactly the same as this one.

What I would do, given the situation and our lack of expertise with RAID, would be to power down the server and then remove one disk, then power the server back up. Does it boot well? The reason I'd say this is so that you can verify that the system WILL boot off of 1 of the mirrored disks without throwing errors prior/during/after boot.

If that works, I'd proceed with your recommendation.

I'm assuming that you spoke with Mcafee, and they told you that it was past end of life? Try calling them again to see if they'll give you an answer on what the recommended uninstall procedures are for the software. I know that with Norton (at least with client systems), you have to run a special executable to get rid of it completely (which we push out via MS SCCM in our environment at work, so we can call on it whenever we need to decommission a workstation or server).

I know that this wasn't an "answer", but sometimes we gain insight from a second opinion of the issue. If it helps, great!

 

[tokencode]

I would recommend imaging your RAID array to another external drive rather than pulling a drive from the mirror set. I theory your plan would work, but breaking the mirror can be risky, I would be worried that the controller would might re-mirror the "bad" drive to the good one when you replace it if there was a problem.

 

[barrelrider]

Hi Nebulocity

I've never heard the term "voluntold" before - perfect!

In this case the server is not on the way to become a vm. The box is old enough that it deserves retirement, but not till we get that plan in place. This is an interim, make it work for another year fix.

I had thought too that I should make an experimental solo disk experiment, just to make sure that it would come up with a single disk. I have not had issues with that before, but that has intel raid, and ide not scsi.

I do have the McAfee manual de-install process in hand. I expect it will work fine, but I have to be prepared for a worst case scenario.

Thanks for your input!

 

[barrelrider]

I might take that approach. What I'm uncertain about re an external hdd image, is how tricky it might be to apply it to the server if the un-install fails.

I have imaged disks before, but only in simple scenarios: create an image of IDE disk A on IDE disk B; remove A, install B, boot B, ok.

I am just not sure how it would go to create the image on IDE disk B, and if the software un-install fails, somehow apply the image on disk B to the SCSI raid array. Is that a routine process that I simply have not explored? If so...I will explore because at the very least it would be an ideal #2 fallback, or even primary fallback.

 

[Nebulocity]

I would go with TokenCode's suggestion them, since it won't be converted to a virtual environment. I use NetApp's products exclusively, even in my SharePoint and SQL servers (SnapManager/SnapDrive), and take a snapshot (image) of the OS and data drives prior to any configuration changes on the server (well, at least major ones). It's saved my rear in many occasions!

 

[barrelrider]

Thanks everyone. I decided to do it a bit old school and made an ASR backup of the servers (and data backups as well) before uninstalling the problematic software. Luckily the uninstall was not difficult and I didn't need to use the backup. I know ASR backups are perhaps not ideal, but the other solutions would have been more experimental, and I had to do this today.