toasters March 2015

toasters@lists.teaparty.net

33 participants
27 discussions

NetApp API authentication
by Edward Rolison 01 Mar '16

01 Mar '16

Having started to review some of our filer automation scripts, I'm starting to look in a bit more detail at the API. My first conclusion is - the perl SDK doesn't actually seem to do anything much - it seems to be a reimplementation of LWP and and XML Parser. Given I have LWP and XML::Twig installed, and am making API calls just fine, is there anything I'm missing here? Aside from that though - authentication types. I currently use ssh public-private key pairs, in a trusted account on a management station to enable 'doing stuff' with filers. It _looks_ like my only option with the API is to create a designated service account, and assign permissions... and then embed a username and password in a script somewhere. That just doesn't sit well with me - I like what ssh-agent will do in 'unlocking' key files, and I don't like embedding (potentially privileged) usernames and passwords ... anywhere. Does anyone have a better solution than a couple of designated API users (privileged and read only) with a file somewhere embedding their username and password? Does anyone have a better approach?

5 5

cluster mode 8.2.3 / 8.3 dynamic home directory change
by Tomlinson, Thomas 30 Jun '15

30 Jun '15

Hi Toasters, I just stumbled upon a change in 8.2.3/8.3 with respect to the dynamic home shares and curious to get other folks views on it. Currently we make extensive use of the traditional static 7mode home directory share, cifs.homedir (\\filername\cifs.homedir<file:///\\filername\cifs.homedir>). This is further referenced behind DFS as a single link name with multiple targets. It works great, allows for all users to have a static username defined in AD, allows migration of filers without massive user updates, DR, etc. So life is good, or as good as it can be managing windows home directories. We're now slowly staring to lifecycle 7mode clusters to cmode, which has had a few hiccups, but I expected that . Prior to 8.2.3, you can replicate 7mode home directory functionality perfectly, even making up whatever static name you want. Fast forward to just recently when I was configuring a small cluster at a remote location. 8.2.3, sure slap that on. Configure the dynamic home directories, sure,errr.... no. A seemingly innocent entry in the release notes for 8.2.3 states that static names are no longer acceptable. A previously configured static share is brought forward and continues to function but you can no longer create new ones. Any new dynamic home share has to have the username in it (%w or %u). Needless to say this is a major change to our environment. Automation changes, massive AD updates (close to a nightmare with our IT organization) and a complete invalidation of our DFS namespace structure for home directories. Is anyone else similarly affected by this? I'm struggling to understand what twisted logic guided this coding decision. Thomas Tomlinson Thomas.tomlinson(a)supervalu.com<mailto:Thomas.tomlinson@supervalu.com> Desk: 208-685-8404 Cel: 208-991-3704

6 8

Snapmirror relationships
by Jeff Cleverley 02 Apr '15

02 Apr '15

Greetings, We have to split a cluster and one shelf will go to one site, and the rest go to another site. The single shelf (DS4243, 2 TB SATA) comprising 2 aggregates and 11 volumes will get moved to a different NetApp. The shelf will end up on a system with new names and no aliases can be used. There are some variable moving parts so I need a sanity check. FilerA 7.3.7 - owner of the one shelf FilerB 8.1.2P4 - soon to be owner of the one shelf I've setup a snapmirror with a daily cron update that goes from FilerA to FilerB. This seems OK. If we can get the shelf owners to split the same day the other moves, I'm just going to move the shelf, change ownership, import the aggregate/volumes, create cifs shares, and update the snapvault relationship. If they insist on moving before that, I have to break the mirrors after a final sync, rename the current snapmirror destination volumes, update snapvault relationships and create cifs shares. This seems OK. Now the questions :-) 1. Are there any issues associated with this process with the OS differences or snapmirror not keeping filesystem security type, share, permissions, etc? 2. If I have to split the shelf later, I want to add it to FilerB and make that shelf the production shelf. This is a short term solution and the heads and shelves are not supported. Is there a graceful way to sync back to the DS4243 shelf? I don't want to disrupt the CIFS users very much. 3. Any other glaring issues that stand out? Thanks, Jeff -- Jeff Cleverley IT Engineer 4380 Ziegler Road Fort Collins, Colorado 80525 970-288-4611

6 7

cDOT security best practise reference?
by Martin 01 Apr '15

01 Apr '15

Hi, I've recently written a Netapp security policy for 7-mode Ontap. I used the TRs for reference: Data ONTAP Security Guidance - TR-3950 (November 2011) PCI-DSS Version 2.0 and Data ONTAP 8.1 TR-3996 (August 2012) Both of these are fairly old and not specific to cDOT. I've seen TR-4191 but that is specific to Windows File services: TR-4191 - Best Practices Guide for Clustered Data ONTAP 8.2.x Windows File Services Does anyone know of any best practise documents for cDOT whether Netapp or otherwise? Thanks Martin -- View this message in context: http://network-appliance-toasters.10978.n7.nabble.com/cDOT-security-best-pr… Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

9 13

snapdirve and cluster OS...how to connect to storage system
by Iluhes 30 Mar '15

30 Mar '15

I have FC SVM and trying to setup a snapdrive and not able to do it security login create -username snapdrive -application ontapi -authmethod password -role vsadmin -vserver san1 network interface create -vserver san1 -lif san1-lif -firewall-policy mgmt -address 10.10.10.10 -netmask 255.255.255.0 -role data -data-protocol none -home-node NETAPP1 -home-port e0j snapdrive config set snapdrive san1 Password for snapdrive: Retype password: 0003-400 Admin error: Aggregate not assigned for the storage system: san1

2 4

RE: Toasters Digest, Vol 44, Issue 34
by Woods, Bill 30 Mar '15

30 Mar '15

The shelves/disk must be unowned from the original filer and owned by the new filer when you are moving from one filer to another. Regards, Bill -----Original Message----- From: toasters-bounces(a)teaparty.net [mailto:toasters-bounces@teaparty.net] On Behalf Of toasters-request(a)teaparty.net Sent: Friday, March 27, 2015 11:04 PM To: toasters(a)teaparty.net Subject: Toasters Digest, Vol 44, Issue 34 Send Toasters mailing list submissions to toasters(a)teaparty.net To subscribe or unsubscribe via the World Wide Web, visit http://www.teaparty.net/mailman/listinfo/toasters or, via email, send a message with subject or body 'help' to toasters-request(a)teaparty.net You can reach the person managing the list at toasters-owner(a)teaparty.net When replying, please edit your Subject line so it is more specific than "Re: Contents of Toasters digest..." Today's Topics: 1. Re: Snapmirror relationships (Jeff Cleverley) 2. RE: Snapmirror relationships (Gelb, Scott) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Mar 2015 16:05:07 -0600 From: Jeff Cleverley <jeff.cleverley(a)avagotech.com> To: "Parisi, Justin" <Justin.Parisi(a)netapp.com> Cc: "<Toasters(a)teaparty.net>" <Toasters(a)teaparty.net> Subject: Re: Snapmirror relationships Message-ID: <CAANBop0oKE6+mA4R81jMVbD1iVZDkjA2uE9Wrf8Eb+AixtvDeQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Justin and Steve, Thanks for the information about the shares and also the cifsconfig_share.cfg file. The location I primarily support does very little CIFS. The group I inherited uses a lot of CIFS. I'm having to get up to speed on some things. The AD will be the same so that won't be a problem. I expected I would have to create shares since the FilerB volume names don't match the originals. I'll double check the security on both sides and make sure those are the same. It seems this should work either way I do it, but things don't always work as I planned them :-) Jeff On Fri, Mar 27, 2015 at 2:22 PM, Parisi, Justin <Justin.Parisi(a)netapp.com> wrote: > If you want to retain the shares, copy the file in /vol/vol0/etc > called cifsconfig_share.cfg. > > That file basically runs commands at boot that creates the shares: > > # cat cifsconfig_share.cfg > > #Generated automatically by cifs commands > > > cifs shares -add "ETC$" "/etc" -comment "Remote Administration" > > cifs access "ETC$" S-1-5-32-544 Full Control > > cifs shares -add "HOME" "/vol/vol0/home" -comment "Default Share" > > cifs access "HOME" S-NONE "nosd" > > cifs shares -add "C$" "/" -comment "Remote Administration" > > cifs access "C$" S-1-5-32-544 Full Control > > cifs shares -add "CIFS" "/vol/cifs" -comment "CIFS" > > cifs access "CIFS" S-NONE "nosd" > > If you have shares in that file already on the destination filer, > append the new shares. > > If you want to load the shares without rebooting after you add the > ones you want, use the source command. > > parisi-7mode> source /vol/vol0/etc/cifsconfig_share.cfg > > There is already a share named ETC$. > > 1 share(s) have been successfully modified > > There is already a share named HOME. > > 1 share(s) have been successfully modified > > There is already a share named C$. > > 1 share(s) have been successfully modified > > There is already a share named CIFS. > > 1 share(s) have been successfully modified > > > Snapmirror is a block for block copy of files, which includes > permissions/ACLs. If using the same domain, no issues. > > From: <Klise>, Steve <Steve.Klise(a)wwt.com> > Date: Friday, March 27, 2015 at 4:10 PM > To: Jeff Cleverley <jeff.cleverley(a)avagotech.com>, "Toasters(a)teaparty.net" > <Toasters(a)teaparty.net> > Subject: RE: Snapmirror relationships > > Not sure about the security on the volumes, but the NTFS perms > should follow, as long as its in the same AD domain, but the shares > won?t follow; you will have to recreate the shares. I would update > the disk/shelf firmware prior personally. > > > > *From:* toasters-bounces(a)teaparty.net [ > mailto:toasters-bounces@teaparty.net <toasters-bounces(a)teaparty.net>] > *On Behalf Of *Jeff Cleverley > *Sent:* Friday, March 27, 2015 12:55 PM > *To:* <Toasters(a)teaparty.net> > *Subject:* Snapmirror relationships > > > > Greetings, > > > > We have to split a cluster and one shelf will go to one site, and the > rest go to another site. The single shelf (DS4243, 2 TB SATA) > comprising 2 aggregates and 11 volumes will get moved to a different > NetApp. The shelf will end up on a system with new names and no > aliases can be used. There are some variable moving parts so I need a sanity check. > > > > FilerA 7.3.7 - owner of the one shelf > > FilerB 8.1.2P4 - soon to be owner of the one shelf > > > > I've setup a snapmirror with a daily cron update that goes from FilerA > to FilerB. This seems OK. If we can get the shelf owners to split > the same day the other moves, I'm just going to move the shelf, change > ownership, import the aggregate/volumes, create cifs shares, and > update the snapvault relationship. > > > > If they insist on moving before that, I have to break the mirrors > after a final sync, rename the current snapmirror destination volumes, > update snapvault relationships and create cifs shares. This seems OK. > > > > Now the questions :-) > > > > 1. Are there any issues associated with this process with the OS > differences or snapmirror not keeping filesystem security type, share, > permissions, etc? > > > > 2. If I have to split the shelf later, I want to add it to FilerB and > make that shelf the production shelf. This is a short term solution > and the heads and shelves are not supported. Is there a graceful way > to sync back to the DS4243 shelf? I don't want to disrupt the CIFS users very much. > > > > 3. Any other glaring issues that stand out? > > > > Thanks, > > > > Jeff > > > > > > > -- > > Jeff Cleverley > IT Engineer > > 4380 Ziegler Road > Fort Collins, Colorado 80525 > 970-288-4611 > -- Jeff Cleverley IT Engineer 4380 Ziegler Road Fort Collins, Colorado 80525 970-288-4611

1 0

NFSv4/krb against an AD without a CIFS license
by Edward Rolison 27 Mar '15

27 Mar '15

Trying to configure NFSv4 and Kerberos - have managed it several times now with boxes that are on the domain, but for various reasons, this one doesn't have a CIFS license. I'm getting an error: "unable to setup kerberos for NFS could not set up active directory KDC" After entering my administrator account in "nfs setup". Can anyone point me in the direction of what I'm missing here? (Am wondering if it's some variant of needing a machine account created to act as a service principal, or something else is going wrong). Thanks, Ed.

2 2

Re: snapmirror can notquiesced or broken
by Basil 26 Mar '15

26 Mar '15

These are qtree snapmirrors, yeah? What are you trying to do? Make the targets r/w? Or resync? On Wed, Mar 25, 2015 at 7:51 PM, Iluhes <iluhes(a)yahoo.com> wrote: > From source files XXX (XXX-repl is the replicatin IP) > > Source Destination > State Lag Status > XXX:/vol/zzz/vol06 YYY:/vol/zzz/vol06 Source 151:17:27 Idle > XXX:/vol/zzz/vol52 YYY:/vol/zzz/vol52 Source 151:17:30 Idle > XXX:/vol/zzz/vol53 YYY:/vol/zzz/vol53 Source 151:17:30 Idle > XXX:/vol/zzz/vol56 YYY:/vol/zzz/vol56 Source 151:17:28 Idle > XXX:/vol/zzz/vol58 YYY:/vol/zzz/vol58 Source 151:17:30 Idle > XXX:/vol/zzz/vol60 YYY:/vol/zzz/vol60 Source 151:17:29 Idle > XXX:/vol/zzz/vol62 YYY:/vol/zzz/vol62 Source 151:17:27 Idle > XXX:/vol/zzz/vol64 YYY:/vol/zzz/vol64 Source 151:17:28 Idle > XXX:/vol/zzz/vol66 YYY:/vol/zzz/vol66 Source 151:17:29 Idle > XXX:/vol/zzz/vol68 YYY:/vol/zzz/vol68 Source 151:17:29 Idle > XXX:/vol/test1/test1_q YYY:/vol/test1/test1_q Source > 00:00:30 Idle > XXX:/vol/vol1/yyy YYY:/vol/vol1/yyy Source 00:17:30 > Idle > > Destination YYY (notice that some of the existing once are still in sync) > > Source Destination > State Lag Status > XXX-rep.fnfis.com:/vol/zzz/vol06 YYY:/vol/zzz/vol06 Snapmirrored > 151:16:34 Pending > XXX-rep.fnfis.com:/vol/zzz/vol52 YYY:/vol/zzz/vol52 Snapmirrored > 151:16:37 Pending > XXX-rep.fnfis.com:/vol/zzz/vol53 YYY:/vol/zzz/vol53 Snapmirrored > 151:16:37 Pending > XXX-rep.fnfis.com:/vol/zzz/vol56 YYY:/vol/zzz/vol56 Snapmirrored > 151:16:35 Pending > XXX-rep.fnfis.com:/vol/zzz/vol58 YYY:/vol/zzz/vol58 Snapmirrored > 151:16:37 Pending > XXX-rep.fnfis.com:/vol/zzz/vol60 YYY:/vol/zzz/vol60 Snapmirrored > 151:16:36 Pending > XXX-rep.fnfis.com:/vol/zzz/vol62 YYY:/vol/zzz/vol62 Snapmirrored > 151:16:34 Pending > XXX-rep.fnfis.com:/vol/zzz/vol64 YYY:/vol/zzz/vol64 Snapmirrored > 151:16:35 Pending > XXX-rep.fnfis.com:/vol/zzz/vol66 YYY:/vol/zzz/vol66 Snapmirrored > 151:16:36 Transferring > XXX-rep.fnfis.com:/vol/zzz/vol68 YYY:/vol/zzz/vol68 Snapmirrored > 151:16:36 Pending > XXX-rep.fnfis.com:/vol/test1/test1_q YYY:/vol/test1/test1_q > Snapmirrored 00:00:37 Idle > XXX-rep.fnfis.com:/vol/vol1/yyy YYY:/vol/vol1/yyy > Snapmirrored 00:16:37 Idle > XXX-rep.fnfis.com:/vol/vol1/nnn YYY:/vol/vol1/nnn > Snapmirrored 151:16:37 Idle > > > > > > On Wednesday, March 25, 2015 6:44 PM, Basil <basilberntsen(a)gmail.com> > wrote: > > > Please output the results of snapmirror status (on both filers) as well as > snap list volname for a volume you can't break. > > On Wed, Mar 25, 2015 at 7:22 PM, Jeff Bryer <bryer(a)sfu.ca> wrote: > > We have had similar issues with SnapVault (7-mode). Some times we could > work around it by disabling > SnapVault and aborting the process. Other times we had to create a new > relationship and a new baseline. > > We haven't seen any issues so far on c-mode, and we have lost connectivity > between the cluster peers. > > ----- Original Message ----- > From: "Iluhes" <iluhes(a)yahoo.com> > To: "Toasters" <toasters(a)teaparty.net> > Sent: Wednesday, March 25, 2015 3:25:52 PM > Subject: snapmirror can notquiesced or broken > > snapmirror quiesce: cannot connect to source filer > > I can clearly connect to source filer and network connectivity is restored > but snapmirrors are stuck and cannot be broken or anything done to them > What do I do > > > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters > > > > >

3 4

snapmirror can notquiesced or broken
by Iluhes 25 Mar '15

25 Mar '15

snapmirror quiesce: cannot connect to source filer I can clearly connect to source filer and network connectivity is restoredbut snapmirrors are stuck and cannot be broken or anything done to themWhat do I do

3 3

All Flash FAS?
by Philbert Rupkins 20 Mar '15

20 Mar '15

Hi Toasters, Curious if anybody has experience with an all flash FAS deployment? We currently utilize Flash Cache and Flash Pool backed by SAS 15K and 10K drives but are considering an all flash FAS solution for our next system. What prompted you to go with an all flash config versus leveraging flash as a cache tier? What size SSD's are you using? Not interested in an E-series array as we depend upon the features of ONTAP. Also not interested in fronting an E-series array with an ONTAP system. I am aware of the 96 disk per stack limitation that goes along with FAS and flash. Cheers! -Phil

4 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters March 2015