toasters November 2006

toasters@lists.teaparty.net

53 participants
50 discussions

Start a nNew thread

7.2 stability
by Grey Friday 10 Jan '07

10 Jan '07

So what's the word on 7.2 ready for install or still hold off?

7 8

experiencing link breaks on filer hba's
by kunle windapo 30 Nov '06

30 Nov '06

hello, i have 2 FAS980C's in my SAN environment. Data on one is mirrored to the other. i have twice experienced link breaks on two of my hba's adapter 5b and 6b on both filers at the same time, the links come up at the same time after about 7mins. both times when this has happened, our Exchange server looses access to its SAN disk devices leading to a downtime. Has any body experienced this before, if so please HELP me prevent this from happening again. here is error log: Wed Nov 29 13:50:19 GMT [vhe-cl1-n1: scsitarget.ispfct.linkBreak:warning]: Link break detected on Fibre Channel target adapter 5b. Wed Nov 29 13:50:19 GMT [vhe-cl1-n2/vhe-cl1-n1: scsitarget.ispfct.globalLogout:CRITICAL]: FCP Target: Global Logout/Process Logout/Config Changed (from port 210000e08b1c3f12), aborting all SCSI commands Wed Nov 29 13:51:19 GMT [vhe-cl1-n1: scsitarget.ispfct.linkBreak:warning]: Link break detected on Fibre Channel target adapter 6b. Wed Nov 29 13:51:19 GMT [vhe-cl1-n2/vhe-cl1-n1: scsitarget.ispfct.globalLogout:CRITICAL]: FCP Target: Global Logout/Process Logout/Config Changed (from port 500a098e8647ae78), aborting all SCSI commands Wed Nov 29 13:55:05 GMT [vhe-cl1-n2/vhe-cl1-n1: scsitarget.ispfct.targetReset:CRITICAL]: FCP Target: Target Reset (from port 210000e08b1ae0fc), aborting all SCSI commands Wed Nov 29 13:55:05 GMT [vhe-cl1-n1: scsitarget.ispfct.targetReset:CRITICAL]: FCP Target: Target Reset (from port 210000e08b1ae0fc), aborting all SCSI commands Wed Nov 29 13:58:57 GMT [vhe-cl1-n2/vhe-cl1-n1: scsitarget.ispfct.globalLogout:CRITICAL]: FCP Target: Global Logout/Process Logout/Config Changed (from port 500a098c8647ae78), aborting all SCSI commands Wed Nov 29 13:58:57 GMT [vhe-cl1-n1: scsitarget.ispfct.linkUp:notice]: Link up on Fibre Channel target adapter 5b. Wed Nov 29 13:58:57 GMT [vhe-cl1-n1: scsitarget.ispfct.linkUp:notice]: Link up on Fibre Channel target adapter 5b. Wed Nov 29 13:58:57 GMT [vhe-cl1-n2/vhe-cl1-n1: scsitarget.ispfct.globalLogout:CRITICAL]: FCP Target: Global Logout/Process Logout/Config Changed (from port 500a098e8647ae78), aborting all SCSI commands Wed Nov 29 13:58:57 GMT [vhe-cl1-n1: scsitarget.ispfct.linkUp:notice]: Link up on Fibre Channel target adapter 6b. Wed Nov 29 13:58:57 GMT [vhe-cl1-n1: scsitarget.ispfct.linkUp:notice]: Link up on Fibre Channel target adapter 6b. Await responses. ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

2 1

RE: Intermittent "Permission denied" on NTFS qtree
by Glenn Walker 30 Nov '06

30 Nov '06

Enable the option (temporarily) 'cifs.trace_dc_connection'. The output (via screen\messages file) will help. It may not be an issue with complete connectivity drop, but the DC is definitely rejecting the RPC request to look up group membership (SamrGetAliasMembership). Glenn -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Borzenkov, Andrey Sent: Tuesday, November 28, 2006 4:40 AM To: Simon Vallet; toasters(a)mathworks.com Subject: RE: Intermittent "Permission denied" on NTFS qtree Hi, You apparently have some intermittent connectivity problems with DC. As for error messages - this indicates that the domain controller sometimes does not respond, or that connectivity with it was briefly interrupted, which somehow proves connectivity problem. Regards Andrey Borzenkov Senior system engineer IT Product Services Fujitsu Siemens Computers Russian Federation Telephone: +7(495)737-2723 Email: mailto:Andrey.Borzenkov@fujitsu-siemens.com Internet: http://www.fujitsu-siemens.com -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Simon Vallet Sent: Monday, November 27, 2006 6:09 PM To: toasters(a)mathworks.com Subject: Intermittent "Permission denied" on NTFS qtree Hi, we've been trying to solve an intermittent "Permission denied" access problem on a NTFS qtree for some time now, to no avail, so maybe some of you will have some advice. We have a CIFS- and NFS-exported NTFS qtree on a FAS3020 cluster running Data ONTAP 7.1.1. The PDC is a win2k3 server, and Unix users are managed via NIS. From time to time, legitimate users are refused access to certain files with a "Permission denied" message, especially when trying to access the qtree via NFS. These users *do* have permission to access the files in question as per NTFS ACLs -- in fact, when they retry to access the file a few minutes later, they are granted access. We're seing this problem since a bit more of a week now, and still have no clue what the cause of the problem could be... the SID cache seems to be a good suspect, but it's hard to tell; we've also thought of buggy win2k3 patches... In parallel, we're seing the following messages in the logs: CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. Has anybody experienced a similar problem ? Simon -- Simon Vallet Ingénieur Systèmes/Réseaux Genoscope / CNRG Tél. : 01 60 87 36 06 E-mail : svallet(a)genoscope.cns.fr

4 4

RE: snaplock enterprise / compliance
by Creek, Toby 30 Nov '06

30 Nov '06

As of ONTAP 7.1, you can have both Compliance and Enterprise licensed at the same time, but the aggr types are different. Licenses can be removed while data exists; you just can't create new SnapLock aggrs or lock files anymore. You'll need to perform a data migration to go from one to the other - vol copy is the recommended route to preserve immutability. You may need to check with your compliance officer or legal counsel to ensure that chain of custody is preserved via necessary documentation. Toby -- Toby Creek Carolinas District Systems Engineer Network Appliance(r) http://www.netapp.com/ Office: +1-919-476-5737 Mobile: +1-919-244-4595 -----Original Message----- From: Glenn Walker [mailto:ggwalker@mindspring.com] Sent: Wednesday, November 29, 2006 4:07 PM To: Willeke, Jochen; toasters(a)mathworks.com Subject: RE: snaplock enterprise / compliance You can only have one license on the filer at a time - If I recall correctly, there is no way to remove the license without first removing the data. This KB may help: http://now.netapp.com/Knowledgebase/solutionarea.asp?id=kb17082 However, it states that you can perform vol copy - perhaps it intends you to do this to another filer? Glenn -----Original Message----- From: owner-toasters(a)mathworks.com on behalf of Willeke, Jochen Sent: Wed 11/29/2006 11:54 AM To: toasters(a)mathworks.com Subject: snaplock enterprise / compliance Hi toasters, i have an R200 with snaplock_enterprise. There is already an aggregate using this feature. But now i want to convert from snaplock_enterprise to snaploch_compliance. Is there a way to do this? Can i just remove the snaplock_enterprise license and than add the snaplock_compliance license or will this cause any trouble? Best Regards Jochen

1 0

RE: Intermittent "Permission denied" on NTFS qtree
by Glenn Walker 30 Nov '06

30 Nov '06

More logs would be helpful - by default, the filer will try to 'improve' DC connectivity by searching every 4 hours. The last part of the logs that you posted may very well be that, or more likely it is trying to regain connectivity after an error (security context expiring is not something that is seen frequently - this is abnormal!). The biggest problems are the context expiring, the GSSAPI security context error (result of the security context expiring, no doubt), and the RPC rejection. I'm assuming that the RPC rejection and the GSSAPI errors are a direct result of the context expiration. Glenn -----Original Message----- From: Simon Vallet [mailto:svallet@genoscope.cns.fr] Sent: Wednesday, November 29, 2006 6:10 AM To: Glenn Walker Cc: Andrey.Borzenkov(a)fujitsu-siemens.com; toasters(a)mathworks.com Subject: Re: Intermittent "Permission denied" on NTFS qtree Hi, On Tue, 28 Nov 2006 07:41:58 -0500 "Glenn Walker" <ggwalker(a)mindspring.com> wrote: > Enable the option (temporarily) 'cifs.trace_dc_connection'. The output (via screen\messages file) will help. > > It may not be an issue with complete connectivity drop, but the DC is definitely rejecting the RPC request > to look up group membership (SamrGetAliasMembership). Apparently, there are some connectivity problems, but it seems they are quite random -- a trace of network traffic between the filer and the PDC reveals some unexpected TCP resets issued byt the DC : [...] filer -> DC [FIN,ACK] DC->filer [ACK] DC->filer [RST,ACK] [...] this shouldn't be a problem, since the filer requested a FIN anyway, but the time coincidence is troubling... Enabling cifs.trace_dc_connection and cifs.trace_login yields some more information: AUTH: notice- The context has expired. AUTH: notice- No error. AUTH: notice- Unexpected GSSAPI security context error. AUTH: notice- The context has expired. AUTH: notice- No error. CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. AUTH: Error looking up domain groups during login from 192.168.x.x:RPC_NT_CALL_FAILED (0xc002001b). and ten seconds later: AUTH: TraceLDAPServer- Starting AD LDAP server address discovery for domain.tld AUTH: TraceLDAPServer- Found 2 AD LDAP server addresses using generic DNS query. AUTH: TraceLDAPServer- AD LDAP server address discovery for domain.tld complete. 2 unique addresses found. AUTH: notice- Unexpected GSSAPI security context error. [...] This goes on for ten minutes, then the filer tries to locate a DC again, and then everything works fine again AUTH: TraceDC- Starting DC address discovery for domain. AUTH: TraceDC- Filer is not a member of a site. AUTH: TraceDC- Found 2 addresses using generic DNS query. AUTH: TraceDC- Starting WINS queries. AUTH: TraceDC- Found 2 BDC addresses through WINS. AUTH: TraceDC- Found 1 PDC addresses through WINS. AUTH: TraceDC- DC address discovery for PC complete. 2 unique addresses found. I'm not really sure of what *should* happen, but this definitely does *not* look good... I understand that a security context expires sometimes, but I wonder why it takes so long to re-negociate Simon

3 3

RE: Intermittent "Permission denied" on NTFS qtree
by George, Andrew 30 Nov '06

30 Nov '06

It's a long shot but...anything changed on the DC's recently? (Hotfixes, service packs, replacements)? -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Myles Uyema Sent: Thursday, 30 November 2006 3:31 AM To: Simon Vallet Cc: Glenn Walker; Andrey.Borzenkov(a)fujitsu-siemens.com; toasters(a)mathworks.com Subject: Re: Intermittent "Permission denied" on NTFS qtree This sort of reminds me of bug 147265 which I encountered a while back, but you said you're running 7.1.1, and the Bugs Online says it's fixed in that release. I would expect that ONTAP should acquire a new token if getting disconnected in such a manner... If you can take a packet trace between the filers and DC that might help support escalate the case quicker? I suppose you've already done that. On Wed, 29 Nov 2006, Simon Vallet wrote: Hi, On Tue, 28 Nov 2006 07:41:58 -0500 "Glenn Walker" <ggwalker(a)mindspring.com> wrote: > Enable the option (temporarily) 'cifs.trace_dc_connection'. The output (via screen\messages file) will help. > > It may not be an issue with complete connectivity drop, but the DC is > definitely rejecting the RPC request to look up group membership (SamrGetAliasMembership). Apparently, there are some connectivity problems, but it seems they are quite random -- a trace of network traffic between the filer and the PDC reveals some unexpected TCP resets issued byt the DC : [...] filer -> DC [FIN,ACK] DC->filer [ACK] DC->filer [RST,ACK] [...] this shouldn't be a problem, since the filer requested a FIN anyway, but the time coincidence is troubling... Enabling cifs.trace_dc_connection and cifs.trace_login yields some more information: AUTH: notice- The context has expired. AUTH: notice- No error. AUTH: notice- Unexpected GSSAPI security context error. AUTH: notice- The context has expired. AUTH: notice- No error. CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. AUTH: Error looking up domain groups during login from 192.168.x.x:RPC_NT_CALL_FAILED (0xc002001b). and ten seconds later: AUTH: TraceLDAPServer- Starting AD LDAP server address discovery for domain.tld AUTH: TraceLDAPServer- Found 2 AD LDAP server addresses using generic DNS query. AUTH: TraceLDAPServer- AD LDAP server address discovery for domain.tld complete. 2 unique addresses found. AUTH: notice- Unexpected GSSAPI security context error. [...] This goes on for ten minutes, then the filer tries to locate a DC again, and then everything works fine again AUTH: TraceDC- Starting DC address discovery for domain. AUTH: TraceDC- Filer is not a member of a site. AUTH: TraceDC- Found 2 addresses using generic DNS query. AUTH: TraceDC- Starting WINS queries. AUTH: TraceDC- Found 2 BDC addresses through WINS. AUTH: TraceDC- Found 1 PDC addresses through WINS. AUTH: TraceDC- DC address discovery for PC complete. 2 unique addresses found. I'm not really sure of what *should* happen, but this definitely does *not* look good... I understand that a security context expires sometimes, but I wonder why it takes so long to re-negociate Simon "This e-mail and any attachments to it (the "Communication") is, unless otherwise stated, confidential, may contain copyright material and is for the use only of the intended recipient. If you receive the Communication in error, please notify the sender immediately by return e-mail, delete the Communication and the return e-mail, and do not read, copy, retransmit or otherwise deal with it. Any views expressed in the Communication are those of the individual sender only, unless expressly stated to be those of Australia and New Zealand Banking Group Limited ABN 11 005 357 522, or any of its related entities including ANZ National Bank Limited (together "ANZ"). ANZ does not accept liability in connection with the integrity of or errors in the Communication, computer virus, data corruption, interference or delay arising from or in respect of the Communication."

1 0

snaplock enterprise / compliance
by Willeke, Jochen 29 Nov '06

29 Nov '06

Hi toasters, i have an R200 with snaplock_enterprise. There is already an aggregate using this feature. But now i want to convert from snaplock_enterprise to snaploch_compliance. Is there a way to do this? Can i just remove the snaplock_enterprise license and than add the snaplock_compliance license or will this cause any trouble? Best Regards Jochen

2 1

Intermittent "Permission denied" on NTFS qtree
by Simon Vallet 28 Nov '06

28 Nov '06

Hi, we've been trying to solve an intermittent "Permission denied" access problem on a NTFS qtree for some time now, to no avail, so maybe some of you will have some advice. We have a CIFS- and NFS-exported NTFS qtree on a FAS3020 cluster running Data ONTAP 7.1.1. The PDC is a win2k3 server, and Unix users are managed via NIS. From time to time, legitimate users are refused access to certain files with a "Permission denied" message, especially when trying to access the qtree via NFS. These users *do* have permission to access the files in question as per NTFS ACLs -- in fact, when they retry to access the file a few minutes later, they are granted access. We're seing this problem since a bit more of a week now, and still have no clue what the cause of the problem could be... the SID cache seems to be a good suspect, but it's hard to tell; we've also thought of buggy win2k3 patches... In parallel, we're seing the following messages in the logs: CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. Has anybody experienced a similar problem ? Simon -- Simon Vallet Ingénieur Systèmes/Réseaux Genoscope / CNRG Tél. : 01 60 87 36 06 E-mail : svallet(a)genoscope.cns.fr

2 1

RE: simple SAN?!
by Learmonth, Peter 26 Nov '06

26 Nov '06

Hi Fred What virtual HBA/driver would you configure in the VM? To my understanding, the only virtual HBA available are VMLSILogic and VMBusLogic. It's been that way for a long time. This isn't to say VMware couldn't invent a new VMHBA or integrate virtual port functionality into the VMLSILogic implementation. I'm just not sure what you would gain from it. One of the main points of the VM architecture is to not have to worry about what drivers you need in the VM. Another thing that comes to mind is that you couldn't use VMFS (for the VM's disk), since with a virtual FC port would talk directly to LUNs. This becomes more like RDM, and again, I don't see what you gain. It occurred to me to see what VMware had to say. The only occurrence of "NPIV" on their site yields the following: http://www.vmware.com/pdf/esx_lun_security.pdf So, from their perspective, it seems the gain from NPIV is security. It also look like this is not a shipping product/feature. Share and enjoy! Peter ________________________________ From: Fred Grieco [mailto:fredgrieco@yahoo.com] Sent: Thursday, November 23, 2006 4:50 AM To: Davies,Matt; Willeke, Jochen; toasters(a)mathworks.com Subject: Re: simple SAN?! I'm pretty sure you can use FC to the VMs if you use virtual ports or NPIV. http://storagemagazine.techtarget.com/magLogin/1,291245,sid35_gci1228666 ,00.html This is a little like "NAT" for fibre channel. It also requires sophisticated cards and switches. Fred ----- Original Message ---- From: "Davies,Matt" <MDAVIES(a)generalatlantic.com> To: "Willeke, Jochen" <Jochen.Willeke(a)wincor-nixdorf.com>; toasters(a)mathworks.com Sent: Thursday, November 23, 2006 6:24:50 AM Subject: RE: simple SAN?! On the VMware side, as far as I understand you can only use FC to the physical machine, not to a virtual machine, as the VM's do not support FC. I believe you can still use VCB with Iscsi, it just needs a bit more scripting, I would check out the VMware discussion groups on the VMware website, I have always found them very helpful. Cheers Matt ________________________________ From: Willeke, Jochen [mailto:Jochen.Willeke@wincor-nixdorf.com] Sent: 23 November 2006 11:07 To: Davies,Matt; toasters(a)mathworks.com Subject: RE: simple SAN?! We already use ISCSI, but we aer thinking about VMWare and VMWare has some nice features (e.g. VCB) which need an FC-SAN. Thanks anyway Jochen ________________________________ From: Davies,Matt [mailto:MDAVIES@generalatlantic.com] Sent: Thursday, November 23, 2006 11:59 AM To: Willeke, Jochen; toasters(a)mathworks.com Subject: RE: simple SAN?! If you are looking at low cost san, I would go Iscsi, as long as everything you need on Iscsi is on Gig ethernet ports, it should work fine. Cheers Matt ________________________________ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Willeke, Jochen Sent: 23 November 2006 10:11 To: toasters(a)mathworks.com Subject: simple SAN?! Hi, as we use not too much SAN at our site i am not really used to this topic. Yesterday i read an article about "simple SAN". "Simple SAN" seems to mean as an plug-n-play solution. But what about the components espacially the SAN-switches? Do we see really new (and cheap :D) SAN-switches or only old products "reassembled" as a solution for small companies. Regards Jochen __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: simple SAN?!
by Glenn Walker 26 Nov '06

26 Nov '06

You can use SD\SM with FC-SAN as well as iSCSI using software initiator or hardware initiator (QLogic 4010C for example). I'm not aware if using VMWare with guest OSs places any further limitations on this. Glenn -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Holloway, Chris Sent: Thursday, November 23, 2006 1:42 PM To: Julio Calderon; Willeke, Jochen; Davies,Matt; toasters(a)mathworks.com Subject: RE: simple SAN?! You may also want to be aware of the limitations as to when and where you can use SnapDrive and SnapManager products with the guest machines. Essentially you can only use SD and SM if you are using a software iSCSI initiator. Any other methods (and as far as I know this includes raw device mapping) and you won't be able to use them. Chris -----Original Message----- From: owner-toasters(a)mathworks.com on behalf of Julio Calderon Sent: Thu 23/11/2006 18:07 To: Willeke, Jochen; Davies,Matt; toasters(a)mathworks.com Cc: Subject: RE: simple SAN?! You should be able to levereage nfs for vmware -----Original Message----- From: Willeke, Jochen [mailto:Jochen.Willeke@wincor-nixdorf.com] Sent: Thu Nov 23 03:25:26 2006 To: Davies,Matt; toasters(a)mathworks.com Subject: RE: simple SAN?! We already use ISCSI, but we aer thinking about VMWare and VMWare has some nice features (e.g. VCB) which need an FC-SAN. Thanks anyway Jochen ________________________________ From: Davies,Matt [mailto:MDAVIES@generalatlantic.com] Sent: Thursday, November 23, 2006 11:59 AM To: Willeke, Jochen; toasters(a)mathworks.com Subject: RE: simple SAN?! If you are looking at low cost san, I would go Iscsi, as long as everything you need on Iscsi is on Gig ethernet ports, it should work fine. Cheers Matt ________________________________ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Willeke, Jochen Sent: 23 November 2006 10:11 To: toasters(a)mathworks.com Subject: simple SAN?! Hi, as we use not too much SAN at our site i am not really used to this topic. Yesterday i read an article about "simple SAN". "Simple SAN" seems to mean as an plug-n-play solution. But what about the components espacially the SAN-switches? Do we see really new (and cheap :D) SAN-switches or only old products "reassembled" as a solution for small companies. Regards Jochen Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Employees of the company are expressly required not to make defamatory statements and not to infringe or authorize any infringement of copyright or any other legal right by email communications. Any such communication is contrary to company policy and outside the scope of the employment of the individual concerned. The company will not accept any liability in respect of such communication, and the employee responsible will be personally liable for any damages or other liability arising.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters November 2006