toasters January 2015

toasters@lists.teaparty.net

29 participants
18 discussions

cDOT security best practise reference?
by Martin 01 Apr '15

01 Apr '15

Hi, I've recently written a Netapp security policy for 7-mode Ontap. I used the TRs for reference: Data ONTAP Security Guidance - TR-3950 (November 2011) PCI-DSS Version 2.0 and Data ONTAP 8.1 TR-3996 (August 2012) Both of these are fairly old and not specific to cDOT. I've seen TR-4191 but that is specific to Windows File services: TR-4191 - Best Practices Guide for Clustered Data ONTAP 8.2.x Windows File Services Does anyone know of any best practise documents for cDOT whether Netapp or otherwise? Thanks Martin -- View this message in context: http://network-appliance-toasters.10978.n7.nabble.com/cDOT-security-best-pr… Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

9 13

DS2246 PSU removal unnoticed
by Momonth 27 Feb '15

27 Feb '15

Hi All, I've been testing a few monitoring scripts for cDOT and had to pull out some physical components on heads / disk shelves, I noticed the following: when a PSU removed from a DS2246 disk shelf, this fact is not visible for CLI tools like "alert" or "system health". Also Zephyr API calls of 'ses' category don't seem to have visibility on that. So currently there is one disk shelf running on a single PSU and cDOT is quite happy about it. The disk shelf has an amber light on and there was the following event log entry once the PSU was removed: 12/19/2014 11:05:15 na101node-1a WARNING ses.status.psWarning: DS2246 (S/N SHFHU1427000371) shelf 24 on channel 0b power warning for Power supply 1: not installed. This module is on the rear of the shelf at the bottom left. It's running cDOT 8.2.2 Did anyone have similar experience? Is it expected behavior. Cheers, Vladimir

4 7

IOPS Planning for the Deswizzle Process?
by Philbert Rupkins 10 Feb '15

10 Feb '15

Hello Toasters, We've unfortunately had to reduce the frequency of our volume snapmirror updates in order to allow for our destination aggregate to deswizzle. We highly prefer hourly volume snapmirror updates but it turns our our source volumes are large enough and/or have enough snapshots that the deswizzle process never completes on the destination aggregate. Our volume snapmirror destination aggregate is a single tray of SATA. Prior to reducing the frequency of snapmirror updates, the SATA aggregate was running at 90-100% utilization 24x7 with little to no IO to the filer from active clients. Needless to say, serving data from said aggregate was VERY SLOW despite the light IO (<300 IOPS) required by the clients sourcing their primary data from the SATA aggregate. We've done what we can to reduce the impact of deswizzling. Namely, cutting down on snapshots and reducing the volume size. I understand reducing volume size doesnt reduce the maxfiles setting which believe ultimately impact the amount of deswizzling necessary on the destination. I'm still digging into other options we can try but reducing the frequency of snapmirror updates seems to have the most impact. How does one plan for IOPs or disk utilization resulting from the deswizzle process? If I recall correctly, during our planning sessions with NetApp, our Netapp SE never touched on IOPs or number of spindles required to handle deswizzling while serving data from the same aggregate. In fact, I think our aggregates were size purely based on the amount of IO generated from active clients (not active clients + deswizzle). Thanks, Phil

2 3

CIFS and nfs test data
by Klise, Steve 31 Jan '15

31 Jan '15

Is there an app that can generate test data such as excel word ppt ? I know I can use Linux DD for generating Mullins of files. Need to do a Ndmp test between vendors. Sent from my iPhone

1 0

meta: yahoo/hotmail/aol list users and DMARC
by Tom Yates 31 Jan '15

31 Jan '15

**PLEASE DO NOT REPLY TO THE LIST ON THIS MATTER.** Following a query by an aol user who kept getting unsubscribed, I did some digging, and the list has a problem with respect to mail from yahoo/ hotmail/aol, and a few other smaller domains. As far as I can tell, as summarised at http://postmaster-blog.aol.com/2014/04/22/aol-mail-updates-dmarc-policy-to-… , a few fairly large email providers have unilaterally implemented a policy called DMARC, and are now rejecting inbound emails that don't meet the policy requirements. In brief, the requirements are based on the content of the From: (the Header-From, rather than the Envelope-From) header line, and basically amount to "no mail may be sent with a From: line that matches our domain, from outside our domain). Until recently, this meant that whenever a list user from an afflicted domain sent mail to the list, noone inside an afflicted domain would receive it, and a bouncee would be generated for each such user. Recently, list traffic went up enough that sufficient bounces were generated to unsubscribe everyone on the list who was subscribed from an afflicted domain (47 users, the vast majority from yahoo and hotmail). They can resubscribe, and some have, but they will still not see emails from users in DMARC'ed domains, and if the list has another busy period, they'll all be unsubscribed-by-bounce again. As far as I can tell, the only remedy is to reconfig the list so that the From: address is set to a generic address, probably toasters(a)teaparty.net, rather than the actual sender (as it is now). This will mean that misconfigured autoresponders will send to everyone on the list, rather than to the sender as they do now. Before you ask, no, I am not willing to set it my own address, and sort through all the bounces manually. I've polled the other lists I'm on, and most (90%) of them seem to be ignoring the problem. I think DMARC is a rather foolish attempt to make the contents of the From: header reliable (at least as regards domain name), and am therefore inclined to ignore it, and say to yahoo/AOL/hotmail users that they need to subscribe from a provider with a bit more clue. But as usual I will be guided by you lot in this. If anyone feels strongly that the list should be reconfigured as described above, please let me know in the next week or two. If you have strong feelings the other way, it would be useful for me to know that also. And if anyone knows more about this than I do, and is aware of errors in the above, I'd value an off-list email even more. -- Tom Yates - http://www.teaparty.net

1 1

tool to generate cifs I/O load
by Rhodes, Richard L. 30 Jan '15

30 Jan '15

I'm looking for a tool to generate a load onto a CIFS share from a Windows server. I see lots of comments out on the internet with folks using IOMETER to do this, but when I downloaded it I found that it doesn't support network shares. Any suggestions for a Windows tool to generate I/O onto a share? Thanks! Rick ----------------------------------------- The information contained in this message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately, and delete the original message.

8 7

CDOT domain joining with a prestaged account?
by Basil 29 Jan '15

29 Jan '15

Installing my first CDOT machine, and when we got to the point of joining the first CIFS SVM to the domain, we hit a snag. It looks like ontap expects to be creating the machine account. In 7-mode, if it finds an account where it wanted to create one, it would ask if we wanted to reuse that. In CDOT, it just failed. I'm checking to make sure it's not something else like credentials or access, but has anyone else tried this? What should happen in CDOT when you join a domain where the computer account already exists? Basil

2 2

Everything in a qtree?
by Rhodes, Richard L. 22 Jan '15

22 Jan '15

Hi, Back about 7 years ago when we purchased our first NetApp systems we hired a NetApp consultant to help us set them up. One of the things he told me was to always put everything in a qtree. Whether it's a cifs shares, nfs export, or luns . . . put them in a qtree. I have followed that practice. I think part of this was that our NetApp systems are for a particular application and we use snapvault for some of the backups (luns and cifs shares). This is all on OnTap v8 in 7-mode. As I'm about to create some CIFS shares for other uses, I'm wondering if this is a good practice. The new shares would be volume snapmirror'ed to a DR site, but no snapvault. Any opinions are appreciated. Thanks Rick ----------------------------------------- The information contained in this message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately, and delete the original message.

6 6

why flexpod use cluster os?
by Iluhes 21 Jan '15

21 Jan '15

if it is a 2 node cluster. Why use cluster os?

5 4

Failed disks...
by Camillo Gornati 20 Jan '15

20 Jan '15

Hello all… We have a FAS2040, with 2 shelves, which are not under support… One failed disk on shelf A, purchased disks, but i am afraid that will take about 1 week to receive them. What could happen if another disk fails (there is no more spares)? There is no DATA at all on SHELF B, should i get one disk from shelf B and put on A? If another disk goes bad, is it possible to make SHELF B takeover? Is it possible to destroy the aggr on shelf B and add it to shelf A so we would have 12 spares? What you guys would do ? Thanks in advance!

4 3

RHEL Kerberos root
by Edward Rolison 20 Jan '15

20 Jan '15

I'm hoping some of you fine folk can help my search for enlightenment. I'm working on getting Kerberos deployed across my environment. Our big stumbling point appears to be RHEL 5 and Kerberos root users. Specifically - RHEL5 hardcodes 'nfs' as a service principal to be used by 'root' for accessing an NFS mount. We've been looking at various different solutions, like creating an NFS user with uid 0, or (somehow) trying to map nfs <=> root on the filer. But was wondering - does anyone have a kerberized RHEL 5 environment? How are you handling root access? We've got RHEL 6 sorted, probably, because it looks like you can simply cut down your keytab to have 'just' root, which is then used for mounting/access etc.

1 0

cmod failover group
by Iluhes 14 Jan '15

14 Jan '15

Hi Folks,Do the failover group get generated by netapp intial install?Somehow I have a group call "0ba_fg" on the node that is called 06b. Looks like someone made a typo.But most importantly: It look like the policy for node mgmt IP only have 1 node in it, is that right? Should the second node be in the policy for mgmt1 for each node?the way it is setup now, will it failover? Logical Home Failover FailoverVserver Interface Node:Port Policy Group-------- --------------- --------------------- --------------- ---------------06a clus1 06a:e0a nextavail system-defined clus2 06a:e0c nextavail system-defined mgmt1 06a:e0M nextavail 06a_fg Failover Targets: 06a:e0M06b clus1 06b:e0a nextavail system-defined clus2 06b:e0c nextavail system-defined mgmt1 06b:e0M nextavail 0ba_fg FailoverGroup Node Port------------------- ----------------- ----------06a_fg 06a e0M0ba_fg 06b e0M

2 4

new cdot NFS vserver. NFS mount point hang on I/O
by Iluhes 14 Jan '15

14 Jan '15

Hi Folks,New cdot isntall, new NFS vserver. NFS shares can be mounted OK on linnux and solaris clients.I can mkdir and touch files. Copy or move or DD or any I/O operation completly hangs the mount point, the process cannot be Control-C, and kill -9 does not even help

5 16

Is it possible to copy a qtree to its own volume?
by Basil 13 Jan '15

13 Jan '15

I'm trying to take a qtree and move it into its own flexvol (7 mode). It has millions of small files, so robocopy or ndmpcopy are taking too long for the final pre-cutover sync of the migration. So far, the best option I can come up with is to use qtree snapmirror to copy it into a qtree in a new volume and share that qtree, however this isn't clean, and qtree snapmirror still has to span the filesystem. My other considered option was to use a volume snapmirror and then delete everything but the qtree that I need to keep on the destination volume once it's been split off, however this still leaves me with a cifs share pointing to a qtree instead of a volume. At least it would be a block copy instead of a filesystem copy, though. Anyone have any ideas? Basil

5 9

Lots of low water mark CPs on idle filer
by Edward Rolison 09 Jan '15

09 Jan '15

I've got a set of 4 filers, who have all - pretty much concurrently - decided to start racking up the 'low water mark' consistency points. E.g. wafl_susp -w is clocking up quite quickly, giving me as many as 10/sec. I think this may have caused my filers to get into a tizzy and crash, but I have two more that are still doing it. (I'm not 100% sure, because once they 'came up' the problem is gone ... for now). But anyway - these boxes have very little on them - they're not in service yet, so they only have a couple of vfilers and associated vol0s. So there is -literally- nothing happening, storage wise. The only activity is fairly regular ssh polling for performance stats/usual DFM activity. So can anyone give me a suggestion as to how to check why these might be running out of memory? I can stop the performance collection I guess, but that's been running fine for months. (And is also doing so on around another 40 filer heads, so I don't _think_ it's a problem!) They're 2240-4s, with a single shelf in a HA pair. I have 2 'pairs' (4 controllers) and the two that I've rebooted are fine again. The ones I'm looking at are dev, so I've held off doing so because I'd rather figure out what's going wrong instead.

3 3

what is CMOD command to do "fcp show initiator"
by Iluhes 08 Jan '15

08 Jan '15

Guys, please help"fcp show initiator" in CMOD

4 5

"fcp show initiator" CMOD
by Iluhes 08 Jan '15

08 Jan '15

What the command in CMOD to show "fcp show initiator"

2 1

Cyber Liability and Data Breach insurance Coverage
by Mike Linett 02 Jan '15

02 Jan '15

Hi: We have spoken to our business insurance brokers about cyber liability and data breach insurance and they assure us that our internal storage is covered, but they will not cover data stored in a 'cloud provider' against cyber liability and Data Breach. Has anyone found a commercial insurance package that provides cyber liability and data breach coverage for data located on a commercial service like Salesforce.com? Thanks, Mike Michael Linett Zerowait Corp. 302 996 9408 NetApp and SimplStor hardware, service and support around the world -USA,UK, & Australia 2013 Exporter of the Year

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters January 2015