{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "item": { "id": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "slug": "finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident", "url": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident.md", "json": "https://update.dsesecurity.com/api/v1/posts/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/" }, "title": "Finish replacement reconstruction before closing an OpenZFS disk incident", "summary": "Follow the replacement through reconstruction and any concluding scrub before closing the incident.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:32:44+00:00", "modified_at": "2026-10-15T13:36:15+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 243, "potentially_affected": "This applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.", "dse_recommendation": "DSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change.", "primary_source": { "name": "OpenZFS 2.3 — zpool replace", "url": "https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html", "published_on": null, "authority": "openzfs.github.io" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Follow the replacement through reconstruction and any concluding scrub before closing the incident.

\n

Source facts

\n

OpenZFS 2.3 describes device replacement as attaching the new device, waiting for reconstruction, and then detaching the old one. A replacement cancels an ongoing scrub. The new device must meet the documented minimum size for the mirror or RAID-Z configuration. Sequential reconstruction restores redundancy without verifying checksums during that stage and starts a scrub afterward; that sequential mode is not supported for RAID-Z. The command also provides a wait-for-completion option.

\n

Source: OpenZFS 2.3 — zpool replace.

\n

Applicability

\n

This applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.

\n

DSE recommendation

\n

DSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change. Keep the incident open through the required completion and health review, including any follow-on scrub. Have a second physical identification check before removing hardware. Avoid treating a command that was accepted as evidence that redundancy is restored. Escalate unexpected device sizes or pool errors before using any force option, and preserve the original status output for comparison.

\n

Verification

\n

Rehearse replacement in a disposable pool using the intended mode. Observe reconstruction through completion and any subsequent scrub, then inspect pool status. Confirm the record can identify which physical device changed and whether unresolved errors remain before marking the rehearsal successful.

\n

Official reference

\n

OpenZFS 2.3 — zpool replace. Reviewed October 15, 2026.

", "content_text": "Follow the replacement through reconstruction and any concluding scrub before closing the incident.\nSource facts\nOpenZFS 2.3 describes device replacement as attaching the new device, waiting for reconstruction, and then detaching the old one. A replacement cancels an ongoing scrub. The new device must meet the documented minimum size for the mirror or RAID-Z configuration. Sequential reconstruction restores redundancy without verifying checksums during that stage and starts a scrub afterward; that sequential mode is not supported for RAID-Z. The command also provides a wait-for-completion option.\nSource: OpenZFS 2.3 — zpool replace.\nApplicability\nThis applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.\nDSE recommendation\nDSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change. Keep the incident open through the required completion and health review, including any follow-on scrub. Have a second physical identification check before removing hardware. Avoid treating a command that was accepted as evidence that redundancy is restored. Escalate unexpected device sizes or pool errors before using any force option, and preserve the original status output for comparison.\nVerification\nRehearse replacement in a disposable pool using the intended mode. Observe reconstruction through completion and any subsequent scrub, then inspect pool status. Confirm the record can identify which physical device changed and whether unresolved errors remain before marking the rehearsal successful.\nOfficial reference\nOpenZFS 2.3 — zpool replace. Reviewed October 15, 2026.", "content_markdown": "Follow the replacement through reconstruction and any concluding scrub before closing the incident.\n\n## Source facts\n\nOpenZFS 2.3 describes device replacement as attaching the new device, waiting for reconstruction, and then detaching the old one. A replacement cancels an ongoing scrub. The new device must meet the documented minimum size for the mirror or RAID-Z configuration. Sequential reconstruction restores redundancy without verifying checksums during that stage and starts a scrub afterward; that sequential mode is not supported for RAID-Z. The command also provides a wait-for-completion option.\n\nSource: [OpenZFS 2.3 — zpool replace](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html).\n\n## Applicability\n\nThis applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.\n\n## DSE recommendation\n\nDSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change. Keep the incident open through the required completion and health review, including any follow-on scrub. Have a second physical identification check before removing hardware. Avoid treating a command that was accepted as evidence that redundancy is restored. Escalate unexpected device sizes or pool errors before using any force option, and preserve the original status output for comparison.\n\n## Verification\n\nRehearse replacement in a disposable pool using the intended mode. Observe reconstruction through completion and any subsequent scrub, then inspect pool status. Confirm the record can identify which physical device changed and whether unresolved errors remain before marking the rehearsal successful.\n\n## Official reference\n\n[OpenZFS 2.3 — zpool replace](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "url": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Finish replacement reconstruction before closing an OpenZFS disk incident", "item": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/#article", "identifier": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "url": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/", "headline": "Finish replacement reconstruction before closing an OpenZFS disk incident", "description": "Follow the replacement through reconstruction and any concluding scrub before closing the incident.", "abstract": "Follow the replacement through reconstruction and any concluding scrub before closing the incident.", "articleBody": "Follow the replacement through reconstruction and any concluding scrub before closing the incident.\nSource facts\nOpenZFS 2.3 describes device replacement as attaching the new device, waiting for reconstruction, and then detaching the old one. A replacement cancels an ongoing scrub. The new device must meet the documented minimum size for the mirror or RAID-Z configuration. Sequential reconstruction restores redundancy without verifying checksums during that stage and starts a scrub afterward; that sequential mode is not supported for RAID-Z. The command also provides a wait-for-completion option.\nSource: OpenZFS 2.3 — zpool replace.\nApplicability\nThis applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.\nDSE recommendation\nDSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change. Keep the incident open through the required completion and health review, including any follow-on scrub. Have a second physical identification check before removing hardware. Avoid treating a command that was accepted as evidence that redundancy is restored. Escalate unexpected device sizes or pool errors before using any force option, and preserve the original status output for comparison.\nVerification\nRehearse replacement in a disposable pool using the intended mode. Observe reconstruction through completion and any subsequent scrub, then inspect pool status. Confirm the record can identify which physical device changed and whether unresolved errors remain before marking the rehearsal successful.\nOfficial reference\nOpenZFS 2.3 — zpool replace. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:32:44+00:00", "dateModified": "2026-10-15T13:36:15+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Finish replacement reconstruction before closing an OpenZFS disk incident" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 243, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OpenZFS 2.3 — zpool replace", "url": "https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html" } } ] } }