toasters January 2015

toasters@lists.teaparty.net

29 participants
18 discussions

cDOT security best practise reference?
by Martin 01 Apr '15

01 Apr '15

Hi, I've recently written a Netapp security policy for 7-mode Ontap. I used the TRs for reference: Data ONTAP Security Guidance - TR-3950 (November 2011) PCI-DSS Version 2.0 and Data ONTAP 8.1 TR-3996 (August 2012) Both of these are fairly old and not specific to cDOT. I've seen TR-4191 but that is specific to Windows File services: TR-4191 - Best Practices Guide for Clustered Data ONTAP 8.2.x Windows File Services Does anyone know of any best practise documents for cDOT whether Netapp or otherwise? Thanks Martin -- View this message in context: http://network-appliance-toasters.10978.n7.nabble.com/cDOT-security-best-pr… Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

9 13

DS2246 PSU removal unnoticed
by Momonth 27 Feb '15

27 Feb '15

Hi All, I've been testing a few monitoring scripts for cDOT and had to pull out some physical components on heads / disk shelves, I noticed the following: when a PSU removed from a DS2246 disk shelf, this fact is not visible for CLI tools like "alert" or "system health". Also Zephyr API calls of 'ses' category don't seem to have visibility on that. So currently there is one disk shelf running on a single PSU and cDOT is quite happy about it. The disk shelf has an amber light on and there was the following event log entry once the PSU was removed: 12/19/2014 11:05:15 na101node-1a WARNING ses.status.psWarning: DS2246 (S/N SHFHU1427000371) shelf 24 on channel 0b power warning for Power supply 1: not installed. This module is on the rear of the shelf at the bottom left. It's running cDOT 8.2.2 Did anyone have similar experience? Is it expected behavior. Cheers, Vladimir

4 7

IOPS Planning for the Deswizzle Process?
by Philbert Rupkins 10 Feb '15

10 Feb '15

Hello Toasters, We've unfortunately had to reduce the frequency of our volume snapmirror updates in order to allow for our destination aggregate to deswizzle. We highly prefer hourly volume snapmirror updates but it turns our our source volumes are large enough and/or have enough snapshots that the deswizzle process never completes on the destination aggregate. Our volume snapmirror destination aggregate is a single tray of SATA. Prior to reducing the frequency of snapmirror updates, the SATA aggregate was running at 90-100% utilization 24x7 with little to no IO to the filer from active clients. Needless to say, serving data from said aggregate was VERY SLOW despite the light IO (<300 IOPS) required by the clients sourcing their primary data from the SATA aggregate. We've done what we can to reduce the impact of deswizzling. Namely, cutting down on snapshots and reducing the volume size. I understand reducing volume size doesnt reduce the maxfiles setting which believe ultimately impact the amount of deswizzling necessary on the destination. I'm still digging into other options we can try but reducing the frequency of snapmirror updates seems to have the most impact. How does one plan for IOPs or disk utilization resulting from the deswizzle process? If I recall correctly, during our planning sessions with NetApp, our Netapp SE never touched on IOPs or number of spindles required to handle deswizzling while serving data from the same aggregate. In fact, I think our aggregates were size purely based on the amount of IO generated from active clients (not active clients + deswizzle). Thanks, Phil

2 3

CIFS and nfs test data
by Klise, Steve 31 Jan '15

31 Jan '15

Is there an app that can generate test data such as excel word ppt ? I know I can use Linux DD for generating Mullins of files. Need to do a Ndmp test between vendors. Sent from my iPhone

1 0

meta: yahoo/hotmail/aol list users and DMARC
by Tom Yates 31 Jan '15

31 Jan '15

**PLEASE DO NOT REPLY TO THE LIST ON THIS MATTER.** Following a query by an aol user who kept getting unsubscribed, I did some digging, and the list has a problem with respect to mail from yahoo/ hotmail/aol, and a few other smaller domains. As far as I can tell, as summarised at http://postmaster-blog.aol.com/2014/04/22/aol-mail-updates-dmarc-policy-to-… , a few fairly large email providers have unilaterally implemented a policy called DMARC, and are now rejecting inbound emails that don't meet the policy requirements. In brief, the requirements are based on the content of the From: (the Header-From, rather than the Envelope-From) header line, and basically amount to "no mail may be sent with a From: line that matches our domain, from outside our domain). Until recently, this meant that whenever a list user from an afflicted domain sent mail to the list, noone inside an afflicted domain would receive it, and a bouncee would be generated for each such user. Recently, list traffic went up enough that sufficient bounces were generated to unsubscribe everyone on the list who was subscribed from an afflicted domain (47 users, the vast majority from yahoo and hotmail). They can resubscribe, and some have, but they will still not see emails from users in DMARC'ed domains, and if the list has another busy period, they'll all be unsubscribed-by-bounce again. As far as I can tell, the only remedy is to reconfig the list so that the From: address is set to a generic address, probably toasters(a)teaparty.net, rather than the actual sender (as it is now). This will mean that misconfigured autoresponders will send to everyone on the list, rather than to the sender as they do now. Before you ask, no, I am not willing to set it my own address, and sort through all the bounces manually. I've polled the other lists I'm on, and most (90%) of them seem to be ignoring the problem. I think DMARC is a rather foolish attempt to make the contents of the From: header reliable (at least as regards domain name), and am therefore inclined to ignore it, and say to yahoo/AOL/hotmail users that they need to subscribe from a provider with a bit more clue. But as usual I will be guided by you lot in this. If anyone feels strongly that the list should be reconfigured as described above, please let me know in the next week or two. If you have strong feelings the other way, it would be useful for me to know that also. And if anyone knows more about this than I do, and is aware of errors in the above, I'd value an off-list email even more. -- Tom Yates - http://www.teaparty.net

1 1

tool to generate cifs I/O load
by Rhodes, Richard L. 30 Jan '15

30 Jan '15

I'm looking for a tool to generate a load onto a CIFS share from a Windows server. I see lots of comments out on the internet with folks using IOMETER to do this, but when I downloaded it I found that it doesn't support network shares. Any suggestions for a Windows tool to generate I/O onto a share? Thanks! Rick ----------------------------------------- The information contained in this message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately, and delete the original message.

8 7

CDOT domain joining with a prestaged account?
by Basil 29 Jan '15

29 Jan '15

Installing my first CDOT machine, and when we got to the point of joining the first CIFS SVM to the domain, we hit a snag. It looks like ontap expects to be creating the machine account. In 7-mode, if it finds an account where it wanted to create one, it would ask if we wanted to reuse that. In CDOT, it just failed. I'm checking to make sure it's not something else like credentials or access, but has anyone else tried this? What should happen in CDOT when you join a domain where the computer account already exists? Basil

2 2

Everything in a qtree?
by Rhodes, Richard L. 22 Jan '15

22 Jan '15

Hi, Back about 7 years ago when we purchased our first NetApp systems we hired a NetApp consultant to help us set them up. One of the things he told me was to always put everything in a qtree. Whether it's a cifs shares, nfs export, or luns . . . put them in a qtree. I have followed that practice. I think part of this was that our NetApp systems are for a particular application and we use snapvault for some of the backups (luns and cifs shares). This is all on OnTap v8 in 7-mode. As I'm about to create some CIFS shares for other uses, I'm wondering if this is a good practice. The new shares would be volume snapmirror'ed to a DR site, but no snapvault. Any opinions are appreciated. Thanks Rick ----------------------------------------- The information contained in this message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately, and delete the original message.

6 6

why flexpod use cluster os?
by Iluhes 21 Jan '15

21 Jan '15

if it is a 2 node cluster. Why use cluster os?

5 4

Failed disks...
by Camillo Gornati 20 Jan '15

20 Jan '15

Hello all… We have a FAS2040, with 2 shelves, which are not under support… One failed disk on shelf A, purchased disks, but i am afraid that will take about 1 week to receive them. What could happen if another disk fails (there is no more spares)? There is no DATA at all on SHELF B, should i get one disk from shelf B and put on A? If another disk goes bad, is it possible to make SHELF B takeover? Is it possible to destroy the aggr on shelf B and add it to shelf A so we would have 12 spares? What you guys would do ? Thanks in advance!

4 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters January 2015