# Finish replacement reconstruction before closing an OpenZFS disk incident

> Follow the replacement through reconstruction and any concluding scrub before closing the incident.

- Canonical URL: https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:32:44+00:00
- Modified: 2026-10-15T13:36:15+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Follow the replacement through reconstruction and any concluding scrub before closing the incident.

## Potentially affected

This applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.

## DSE recommendation

DSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change.

## Article

Follow the replacement through reconstruction and any concluding scrub before closing the incident.

## Source facts

OpenZFS 2.3 describes device replacement as attaching the new device, waiting for reconstruction, and then detaching the old one. A replacement cancels an ongoing scrub. The new device must meet the documented minimum size for the mirror or RAID-Z configuration. Sequential reconstruction restores redundancy without verifying checksums during that stage and starts a scrub afterward; that sequential mode is not supported for RAID-Z. The command also provides a wait-for-completion option.

Source: [OpenZFS 2.3 — zpool replace](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html).

## Applicability

This applies to the OpenZFS 2.3 replacement command. It addresses completion and verification stages, not a claim that an arbitrary drive model or physical slot is a supported replacement.

## DSE recommendation

DSE recommends recording the failed device identity, replacement identity, pool layout, and selected reconstruction mode before the change. Keep the incident open through the required completion and health review, including any follow-on scrub. Have a second physical identification check before removing hardware. Avoid treating a command that was accepted as evidence that redundancy is restored. Escalate unexpected device sizes or pool errors before using any force option, and preserve the original status output for comparison.

## Verification

Rehearse replacement in a disposable pool using the intended mode. Observe reconstruction through completion and any subsequent scrub, then inspect pool status. Confirm the record can identify which physical device changed and whether unresolved errors remain before marking the rehearsal successful.

## Official reference

[OpenZFS 2.3 — zpool replace](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html). Reviewed October 15, 2026.

## Primary reference

- Name: OpenZFS 2.3 — zpool replace
- Authority: openzfs.github.io
- URL: https://openzfs.github.io/openzfs-docs/man/v2.3/8/zpool-replace.8.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Finish replacement reconstruction before closing an OpenZFS disk incident,” DSE Security, https://update.dsesecurity.com/updates/finish-replacement-reconstruction-before-closing-an-openzfs-disk-incident/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.