toasters December 2014

toasters@lists.teaparty.net

19 participants
12 discussions

cDOT security best practise reference?
by Martin 01 Apr '15

01 Apr '15

Hi, I've recently written a Netapp security policy for 7-mode Ontap. I used the TRs for reference: Data ONTAP Security Guidance - TR-3950 (November 2011) PCI-DSS Version 2.0 and Data ONTAP 8.1 TR-3996 (August 2012) Both of these are fairly old and not specific to cDOT. I've seen TR-4191 but that is specific to Windows File services: TR-4191 - Best Practices Guide for Clustered Data ONTAP 8.2.x Windows File Services Does anyone know of any best practise documents for cDOT whether Netapp or otherwise? Thanks Martin -- View this message in context: http://network-appliance-toasters.10978.n7.nabble.com/cDOT-security-best-pr… Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

9 13

DS2246 PSU removal unnoticed
by Momonth 27 Feb '15

27 Feb '15

Hi All, I've been testing a few monitoring scripts for cDOT and had to pull out some physical components on heads / disk shelves, I noticed the following: when a PSU removed from a DS2246 disk shelf, this fact is not visible for CLI tools like "alert" or "system health". Also Zephyr API calls of 'ses' category don't seem to have visibility on that. So currently there is one disk shelf running on a single PSU and cDOT is quite happy about it. The disk shelf has an amber light on and there was the following event log entry once the PSU was removed: 12/19/2014 11:05:15 na101node-1a WARNING ses.status.psWarning: DS2246 (S/N SHFHU1427000371) shelf 24 on channel 0b power warning for Power supply 1: not installed. This module is on the rear of the shelf at the bottom left. It's running cDOT 8.2.2 Did anyone have similar experience? Is it expected behavior. Cheers, Vladimir

4 7

meta: yahoo/hotmail/aol list users and DMARC
by Tom Yates 31 Jan '15

31 Jan '15

**PLEASE DO NOT REPLY TO THE LIST ON THIS MATTER.** Following a query by an aol user who kept getting unsubscribed, I did some digging, and the list has a problem with respect to mail from yahoo/ hotmail/aol, and a few other smaller domains. As far as I can tell, as summarised at http://postmaster-blog.aol.com/2014/04/22/aol-mail-updates-dmarc-policy-to-… , a few fairly large email providers have unilaterally implemented a policy called DMARC, and are now rejecting inbound emails that don't meet the policy requirements. In brief, the requirements are based on the content of the From: (the Header-From, rather than the Envelope-From) header line, and basically amount to "no mail may be sent with a From: line that matches our domain, from outside our domain). Until recently, this meant that whenever a list user from an afflicted domain sent mail to the list, noone inside an afflicted domain would receive it, and a bouncee would be generated for each such user. Recently, list traffic went up enough that sufficient bounces were generated to unsubscribe everyone on the list who was subscribed from an afflicted domain (47 users, the vast majority from yahoo and hotmail). They can resubscribe, and some have, but they will still not see emails from users in DMARC'ed domains, and if the list has another busy period, they'll all be unsubscribed-by-bounce again. As far as I can tell, the only remedy is to reconfig the list so that the From: address is set to a generic address, probably toasters(a)teaparty.net, rather than the actual sender (as it is now). This will mean that misconfigured autoresponders will send to everyone on the list, rather than to the sender as they do now. Before you ask, no, I am not willing to set it my own address, and sort through all the bounces manually. I've polled the other lists I'm on, and most (90%) of them seem to be ignoring the problem. I think DMARC is a rather foolish attempt to make the contents of the From: header reliable (at least as regards domain name), and am therefore inclined to ignore it, and say to yahoo/AOL/hotmail users that they need to subscribe from a provider with a bit more clue. But as usual I will be guided by you lot in this. If anyone feels strongly that the list should be reconfigured as described above, please let me know in the next week or two. If you have strong feelings the other way, it would be useful for me to know that also. And if anyone knows more about this than I do, and is aware of errors in the above, I'd value an off-list email even more. -- Tom Yates - http://www.teaparty.net

1 1

new cdot NFS vserver. NFS mount point hang on I/O
by Iluhes 14 Jan '15

14 Jan '15

Hi Folks,New cdot isntall, new NFS vserver. NFS shares can be mounted OK on linnux and solaris clients.I can mkdir and touch files. Copy or move or DD or any I/O operation completly hangs the mount point, the process cannot be Control-C, and kill -9 does not even help

5 16

Cyber Liability and Data Breach insurance Coverage
by Mike Linett 02 Jan '15

02 Jan '15

Hi: We have spoken to our business insurance brokers about cyber liability and data breach insurance and they assure us that our internal storage is covered, but they will not cover data stored in a 'cloud provider' against cyber liability and Data Breach. Has anyone found a commercial insurance package that provides cyber liability and data breach coverage for data located on a commercial service like Salesforce.com? Thanks, Mike Michael Linett Zerowait Corp. 302 996 9408 NetApp and SimplStor hardware, service and support around the world -USA,UK, & Australia 2013 Exporter of the Year

2 1

where are folks planning to migrate their storage spending to in the new year?
by Fletcher Cocquyt 30 Dec '14

30 Dec '14

Happy holidays and 2015! Curious, where are folks planning to migrate their storage spending to in the new year? Here we have new agreements with several cloud vendors - "unlimited cloud storage" - so mgmt's expectation is we somehow stop buying netapp and move to cloud storage. I've had very mixed performance (throughput drops off drastically) and reliability results with initial tests mounting cloud datastores (using rsync to archive server data - anyone had better results?) Given our VMware centric workloads, I'd be leaning towards investing in local, 10G connected server storage with an eye towards VSAN Are there other vendors with a compelling story (SSD/cache) you are considering to migrate to? We are on latest vmware 5.5, ontap 7.1.2 and Dell 620/720 vmware clusters. thanks for any feedback, tips!

2 1

Conflicting Recommendations?
by Philbert Rupkins 30 Dec '14

30 Dec '14

Toasters, It appears the following documents conflict with one another when it comes to recommendations for the value of Net.TcpipHeapMax in ESXi. ---------------------------- *How to configure VMware vSphere 5.x for Data ONTAP 7.3 and 8.x* https://kb.netapp.com/support/index?page=content&id=1013275 Net.TcpipHeapMax For vSphere 5.0/5.1 set 128 For vSphere 5.5 set 512 *TR3749 - NetApp Storage Best Practices for VMWare vSphere* http://www.netapp.com/us/media/tr-3749.pdf "While the NetApp best practice remains to set Net.TcpipHeapMax at the maximum value of 128MB, tests have shown ESXi 5 to be less sensitive to depletion of TCP/IP heap memory." ---------------------------- It seems that TR3749 may be out of date (last update 2011) as it doesnt distinguish between vSphere 5.0/5.1 and 5.5. To my knowledge, the 128MB maximum TCP/IP heap size is applicable to vsphere 5.0 and 5.1. I believe 5.5 increases this maximum to 512MB. I assume the current recommendation for vSphere 5.5 against a filer running ONTAP 8.1.4 7-Mode is 512MB. Can somebody confirm? Is there a best practices doc like TR3749 for vSphere 5.5 in a 7-mode environment? Thanks, Phil

3 4

Re: new cdot NFS vserver. NFS mount point hang on I/O
by Jeff VanDeRyt 22 Dec '14

22 Dec '14

not sure what version you are on, but our fastpath comment reminded me of a entry in the Clustered Data ONTAP® 8.2.1 Release Notes: ---------- Disabling fast path in some networking environments Fast path is enabled by default in all nodes in the cluster. However, you might have to disable fast path in certain environments in which fast path does not function optimally. About this task IP fast path is a mechanism that uses the network interface of an inbound request to send the response quickly by bypassing a routing table lookup. Fast path is enabled by default for all TCP and NFS over UDP connections. You might have to disable fast path if you are working in configurations of Cisco vPC, HP NIC teaming, or asymmetric routing environments. Steps 1. From the nodeshell, enter the following command: options nodescope.reenabledoptions ip.fastpath 2. To disable fast path, enter the following command: options ip.fastpath.enable off For more information, see the bug ID 494396 in Bugs Online on the NetApp Support Site at support.netapp.com/NOW/cgi-bin/bol. ---------- IP Fast path feature is incompatible with some networking environments http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=494396 ********************************************************** Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues

1 0

CIFS and NFS file names
by scl＠virginia.edu 12 Dec '14

12 Dec '14

Hi folks, We recently copied some netapp volumes to a non-netapp file server via NFS and rsync. Unfortunately we have now converted a lot of file names that were created via CIFS on the Netapp using a variety of character sets, such as Arabic, Cyrillic, Persian, etc. As I understand it, a Netapp keeps two file names for each file/folder. The CIFS filename is 16 bit Unicode while the NFS filename is "literal" 8 bit characters (i.e., not UTF-8). I presume that when a file is created on the Netapp via CIFS that the Netapp creates both the CIFS filename and a NFS filename. When we copied the volumes via NFS and rsync, the NFS names were copied over, so we "lost" the CIFS names. Is there any algorithm or procedure that we can use to convert these 8 bit "NFS" names to their equivalent 16 bit Unicode names? Ultimately we need to convert to UTF-8 which is what the destination file server uses for file names (both NFS and CIFS use the same UTF-8 filename). We have turned off CIFS access to the Netapps, and I would like to avoid turning it back on, but I may have no other way to retrieve the original 16 bit unicode names. The Netapp volumes are Unix security style and were accessed both by NFS and CIFS. Some files were originally created via NFS, some by CIFS. And unfortunately, some CIFS filenames had non-English character sets. Here are some sample NFS filenames. I have no idea what the corresponding CIFS filenames are or what character set. :31K4J00 :44O8K00 :5J0TA00 :8QLDT00 :BQLDT00 :EA0IL00 :FA0IL00 These look like the result of a hash, so there may be no way to convert back to CIFS 16bit Unicode. Steve Losen scl(a)virginia.edu

3 2

Time to Update Health Summary on MyAutoSupport
by Philbert Rupkins 11 Dec '14

11 Dec '14

Toasters, After initiating a manual "WEEKLY_LOG" autosupport, how long does it take for your MyAutoSupport site to update? Specifically, the "Health Summary" section that includes the High (red), Medium (amber) and low (yellow) status indicators. The Health Summary section of MyAutoSupport is really helpful. We regularly use the Health Summary to determine when we need to perform disk/shelf firmware upgrades. However, after performing a disk/shelf firmware upgrade the Health Summary section only appears to get updated on Sunday. Even performing a manual "autosupport.doit WEEKLY_LOG" doesnt seem to update the Health Summary section w/in 24 hours - we have to wait until Sunday to see the updated Health Summary. Just wondering if this is similar to your experience as well. Thank you! Phil

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters December 2014