toasters August 2015

toasters@lists.teaparty.net

24 participants
16 discussions

NetApp API authentication
by Edward Rolison 01 Mar '16

01 Mar '16

Having started to review some of our filer automation scripts, I'm starting to look in a bit more detail at the API. My first conclusion is - the perl SDK doesn't actually seem to do anything much - it seems to be a reimplementation of LWP and and XML Parser. Given I have LWP and XML::Twig installed, and am making API calls just fine, is there anything I'm missing here? Aside from that though - authentication types. I currently use ssh public-private key pairs, in a trusted account on a management station to enable 'doing stuff' with filers. It _looks_ like my only option with the API is to create a designated service account, and assign permissions... and then embed a username and password in a script somewhere. That just doesn't sit well with me - I like what ssh-agent will do in 'unlocking' key files, and I don't like embedding (potentially privileged) usernames and passwords ... anywhere. Does anyone have a better solution than a couple of designated API users (privileged and read only) with a file somewhere embedding their username and password? Does anyone have a better approach?

5 5

cifs_other_ops and cifs_ops
by Rhodes, Richard L. 01 Sep '15

01 Sep '15

I'm looking at the Performance Manager graph for a volume that is a CIFS share. It graph has 4 stats: cifs_read_ops, cifs_write_ops, cifs_other_ops, cifs_ops. CIfs_reads_ops and Cifs_write_ops are VERY few totaling only 0-30/sec, but mostly at 0. Cifs_other_ops is a constant 130/s to 180/s, but NEVER dropping below a floor of 130/s. Cifs_ops is similar to Cifs_other_ops, but somewhat higher. The help metrics don't exactly help explain these. Q) What is cifs_other_ops and cifs_ops? Q) What would a CIFS client be doing to cause few reads/writes, but lots of cifs_other_ops and cifs_ops? For example, at one point I have these values: cifs_read_ops 3 cifs_write_ops 28 cifs_other_ops 135 cifs_ops 160 Thanks Rick ----------------------------------------- The information contained in this message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately, and delete the original message.

3 2

RE: Questions about Cert CAs with software updates in CDOT
by Vanderyt, Jeff 28 Aug '15

28 Aug '15

We use http to do the software loads. We use one of OnCommand servers we have, which have self-signed certs. We temporarily disable https, and pull the code onto the controllers: system node image get–node *–package http://x.x.x.x:8080/ontap/image_name This has worked for through going from 8.1 and up to 8.2.3P3. ********************************************************** Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues

2 1

Questions about Cert CAs with software updates in CDOT
by Tony Bar 28 Aug '15

28 Aug '15

Toasters - This is a new one to me, but I'm sure my customer here isn't the only one out there who issues self-signed certs with custom names. Has anyone else run into this before and if so, what did you have to do to resolve? We've tried doing a symlink from her cert to the expected name/path but that doesn't help. Is there perhaps a hidden option like "-k -O" in Unix application "curl" or an alternate method for downloading the updates? Output of what I'm seeing below, any help would be appreciated: <clustername>::> system node image update -node <cluster>-01 -package https://<webhost>/util/83P2_q_image.tgz<https://monitor1.sjc1.prod.ce/util/83P2_q_image.tgz> -replace-package true Install Failed. Failed to download package from https://<webhost>/util/83P2_q_image.tgz<https://monitor1.sjc1.prod.ce/util/83P2_q_image.tgz>. Error: Problem with the SSL CA cert (path? access rights?) : error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none Error: command failed: Install Failed. Failed to download package from https://<webhost>/util/83P2_q_image.tgz<https://monitor1.sjc1.prod.ce/util/83P2_q_image.tgz>. Error: Problem with the SSL CA cert (path? access rights?) : error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none We do not have access to FTP or TFTP options, the customer is a financial services company so their network is pretty locked down without many (if any) options to work with. Thanks again! Anthony Bar tbar(a)berkcom.com<mailto:tbar@berkcom.com> (650) 207-5368 www.berkcom.com<http://www.berkcom.com/>

3 3

cDOT: CN1610 interconnehct switch monitoring
by Momonth 28 Aug '15

28 Aug '15

Hi, I wonder what you guys employ for cDOT interconnect switches monitoring? I assume SNMP is the way to go, maybe you can share some scripts with this community? Cheers, Vladimir

1 0

Deswizzle
by Mike Michalakis 25 Aug '15

25 Aug '15

Hi I have a storage system that is under stress, and as luck has it I need to added more stress by loading it with a large cifs related volume, this is a transition from a 7-Mode ontap system Every time we complete the transition, the system spikes disks 100%, cpu 100%, etc. On the perfstat we see deswizzling running. This is a normal operation every time a snapmirror break-off occurs, that is the deswizzle part of the equation.. When we take this volume offline, operations go back to normal. My question, what is the result of disabling deswizzle is the short term, do I look functionality, e.g. vol move? To turn off deswizzle: Nodeshell*> options wafl.deswizzle.enable off To turn on deswizzle: Nodeshell*> options wafl.deswizzle.enable on Backround: FAS3210, C-Dot 8.2.3, SAS disks

9 18

RBAC - Capabilities
by Philbert Rupkins 25 Aug '15

25 Aug '15

Hello Toasters, The DATA ONTAP documentation notes the following in regard to "cli" related capabilities: ---begin doc----- cli-* grants the specified role the capability to execute all supported CLI commands. cli- cmd* grants the specified role the capability to execute all commands associated with the CLI command cmd. For example, the following command grants the specified role the capability to execute all vol commands: useradmin role modify status_gatherer -a cli-vol* ------end doc---- Based on this info, I know that granting cli-vol* grant the role the capability to execute all commands associated with the CLI command vol. I found another KB article that instructs me to grant the cli-vol (no asterisk) capability to a role. Is there a difference between "cli-vol" and "cli-vol*" ? Thanks, Phil

1 0

Checksums for array LUNs
by Basil 22 Aug '15

22 Aug '15

Does anyone have any advice regarding checksums for array LUNs? My understanding is that AZCS saves you about 12% capacity but requires more filer CPU utilization for reads. What kind of impact does it have?

2 2

OCUM 6.2
by Sayla, Mustafa 18 Aug '15

18 Aug '15

I recently installed OCUM 6.2 and performance manager appliances in our environment. After few days I have started receiving the following messages from both our production and DR cluster every 15 minutes. I have checked the cluster but I don't see anything wrong with it. Any ideas? "Trigger Condition - The cluster (cluster name and IP) is not reachable. Cluster (cluster name) performance events have stopped being sent by Performance Manager server (oncommand server name) This condition could be caused by a communication issue between Unified Manager and Performance Manager, or between Performance Manager and cluster (cluster name)" Mustafa Sayla Visit us on the Web at mesirowfinancial.com This communication may contain privileged and/or confidential information. It is intended solely for the use of the addressee. If you are not the intended recipient, you are strictly prohibited from disclosing, copying, distributing or using any of this information. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. Confidential, proprietary or time-sensitive communications should not be transmitted via the Internet, as there can be no assurance of actual or timely delivery, receipt and/or confidentiality. This is not an offer, or solicitation of any offer to buy or sell any security, investment or other product.

4 12

What vserver group-mapping in cDOT 8.3 does?
by Borzenkov, Andrei 07 Aug '15

07 Aug '15

All documents I can find (including multi-protocol FAQ) say that group mapping is not supported. Then what "vserver group-mapping" does and when these mappings are applied? TIA -andrei

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters August 2015