toasters July 2018

toasters@lists.teaparty.net

13 participants
8 discussions

Creating a readonly user to monitor NetApp cluster via check_mk
by Sylvain Robitaille 20 Dec '18

20 Dec '18

Hello fellow toasters users ... We're in the process of deploying a pair of new CDOT filers and one of the things we'd like to setup with them is having check_mk (nagios and rrd, under the hood) monitor various attributes. We have a working instance at the moment using snmp to query the filers, but check_mk also provides a "plugin" that claims to work with the filer's web interface, so we'd like to examine that. To that end, I've setup a read-only user on the filer, that I intend will be able to access the web interface: security login create -vserver fc1-na -user-or-group-name nul_cmk \ -application http -authentication-method password -role readonly \ -comment "check_mk monitoring" The user shows up when I "show": fc1-na::> security login show -vserver fc1-na -user-or-group-name nul_cmk Vserver: fc1-na Second User/Group Authentication Acct Authentication Name Application Method Role Name Locked Method -------------- ----------- ------------- ---------------- ------ -------------- nul_cmk http password readonly no none The readonly role is unchanged from the OS default: fc1-na::> security login role show -vserver fc1-na -role readonly Role Command/ Access Vserver Name Directory Query Level ---------- ------------- --------- ----------------------------------- -------- fc1-na readonly DEFAULT readonly security none security login password all security login role show-user-capability all set all 5 entries were displayed. Trouble is that if I try to login to the web interface as that user, the browser stays "stuck" at the "Loading system details..." spinner widget. It's been there now for about two hours as I type this. Of course, check_mk's plugin logs a timeout while trying to access the interface. I fully suspect that I'm missing something, of course, but I'm afraid I haven't been able to find what that is. If someone out there has experience creating such a user for readonly access, a pointer to where I should be looking and/or documentation I should be reading would be hugely appreciated. (cli is preferred because it's easier to document what I've done that way, but if someone points me to resources in the web interface I'm sure I'll be able to find what I need at the cli.) -- ---------------------------------------------------------------------- Sylvain Robitaille syl(a)encs.concordia.ca Systems analyst / AITS Concordia University Faculty of Engineering and Computer Science Montreal, Quebec, Canada ----------------------------------------------------------------------

1 1

vol clone split
by Chris Hague 12 Oct '18

12 Oct '18

Hi Toasters, I have a number of volumes running from a common snapshot and would like to split them out. All these volumes are snapmirrored to our DR site. However, when I try to perform a vol clone split, it complains about an in-use snapshot. Reading further, it appears that the split will delete all snapshots, so doesn't like the snapmirror snap. What is the best way to split these volumes? Ideally without having to re-baseline \ lose my snapmirror destination volume \ snaps. ONTAP v9.1P2 Error below; Time Node Severity Event ------------------- ---------------- ------------- --------------------------- 8/30/2017 09:02:17 filer1 INFORMATIONAL mgmtgwd.jobmgr.jobcomplete.failure: Job "Clone Split" [id 6716] (Split vol1) completed unsuccessfully: Volume has locked snapshots (1). 8/30/2017 09:02:17 filer1 DEBUG wafl.config.req.error: Config request 'VV_CONFIG_REQ_CLONE_SPLIT_START' by WAFL for volume vol1 is not being processed because of the error: '387 - CR_VV_VOLUME_SNAPSHOTS'. 8/30/2017 09:02:17 filer1 NOTICE wafl.vv.clone.splitBusySnap: Volume 'vol1 has locked snapshots, not splitting. KR, Chris.

4 8

Re: SnapMirror Bi-directional possible?
by Michael Bergman 26 Jul '18

26 Jul '18

On 2018-07-24 23:35, Scott M Gelb via Toasters wrote: > For the same data set, bi-directional, you might want to POC Peer Software. > They PeerSync bi-directional and also have PeerLink which locks files on > either side while keeping in sync. FPOLICY is used for real time event > notification without file scans. Locks files... Well, if you can live with that, then *maybe* it's viable. But cumbersome and slow. Now, in many use cases w.r.t. NFS (which is what is used by the Applications to *do* something with that data right?) the problems which such locking incur can be devastating in practice. If it's just some ppl browsing files manually, then sure -- go ahead. But with many heavy application systems it's just not acceptable. So the whole things falls over in any case. This might not be detectable in a PoC; race conditions. It's a bogmire of ifs and buts. In a way normal one-directional SM also "locks" (or rather, makes not-available) files and dirs in the RO target volume. In a certain way. So if you run applications intensely on the RO copy (target FlexVol) via NFS there is always a short moment when inodes are shifted at the updates. This is absolutely unavoidable, but what will happen to the App is then 'Stale NFS file handle'. Ka-boom. So then you go into the complexity of trying to asynchronously time the app chain to not run (in certain ways at least) at the exact second(s) this shift inside the inode structure happens. And then you give up. Been there, done that. /M

5 4

mirror one volume read/write across snapmirror?
by John Stoffel 26 Jul '18

26 Jul '18

>>>>> "Scott" == Scott M Gelb via Toasters <toasters(a)teaparty.net> writes: Scott> From: Scott M Gelb <scottgelb(a)yahoo.com> Scott> To: "toasters(a)teaparty.net" <toasters(a)teaparty.net>, Eric Peng <epeng(a)esri.com> Scott> Date: Tue, 24 Jul 2018 21:34:46 +0000 (UTC) Scott> Subject: Re: SnapMirror Bi-directional possible? Scott> For the same data set, bi-directional, you might want to POC Peer Software. Scott> They PeerSync bi-directional and also have PeerLink which locks files on either Scott> side while keeping in sync. FPOLICY is used for real time event notification Scott> without file scans. And from my experience with fpolicy and CommVault for HSM (Archiving of old files) it's fragile as all hell and not reliable. When fpolicy goes down... all hell will break loose. And what happens when you have two different people editing the same file at seperate sites? Last edit wins? This way lies sanity... you need a cluster aware filesystems. Of course people will point out that you have the same problem with NFS if you edit the same file from two seperate clients at the same site. It just silently uses the last one to write is the answer. But for remote sites with fpolicy, I'm sure it will be even more fragile. John

1 0

Max volume count per node
by Alexander Griesser 26 Jul '18

26 Jul '18

Hey there, does anyone know what the real implication of the max volume count per node setting on the FAS systems is good for? Is there any chance that this limit gets raised on newer OnTap releases or is there any secret flag to raise it (knowing that support would not want to see that)? Best, Alexander Griesser Head of Systems Operations ANEXIA Internetdienstleistungs GmbH E-Mail: AGriesser(a)anexia-it.com<mailto:AGriesser@anexia-it.com> Web: http://www.anexia-it.com<http://www.anexia-it.com/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

3 4

Re: SnapMirror Bi-directional possible?
by Klise, Steve 24 Jul '18

24 Jul '18

You can also look at somthing like DFS or a global name space like panzura. I believe they can do multiple copies but have some hardware requirements. On July 24, 2018 at 4:40:09 PM PDT, Mike Gossett <cmgossett(a)gmail.com> wrote: You could look at metrocluster, potentially Sent from my mobile phone > On Jul 24, 2018, at 5:53 PM, Eric Peng <epeng(a)esri.com> wrote: > > Thanks all, for confirming that bi-directional SnapMirror on the *same* volume is not possible. We're still in the requirements gathering/planning part of the project, so we have some time to figure this out. This would be for keeping user profiles in sync between 2 different sites. I may take a look at that PeerSync software. > > Eric > > -----Original Message----- > From: toasters-bounces(a)teaparty.net [mailto:toasters-bounces@teaparty.net] On Behalf Of Michael Bergman > Sent: Tuesday, July 24, 2018 3:07 PM > To: Toasters <toasters(a)teaparty.net> > Subject: Re: SnapMirror Bi-directional possible? > >> On 2018-07-24 23:35, Scott M Gelb via Toasters wrote: >> For the same data set, bi-directional, you might want to POC Peer Software. >> They PeerSync bi-directional and also have PeerLink which locks files >> on either side while keeping in sync. FPOLICY is used for real time >> event notification without file scans. > > Locks files... Well, if you can live with that, then *maybe* it's viable. > > But cumbersome and slow. Now, in many use cases w.r.t. NFS (which is what is used by the Applications to *do* something with that data right?) the problems which such locking incur can be devastating in practice. If it's just some ppl browsing files manually, then sure -- go ahead. > > But with many heavy application systems it's just not acceptable. So the whole things falls over in any case. This might not be detectable in a PoC; race conditions. It's a bogmire of ifs and buts. > > In a way normal one-directional SM also "locks" (or rather, makes > not-available) files and dirs in the RO target volume. In a certain way. So if you run applications intensely on the RO copy (target FlexVol) via NFS there is always a short moment when inodes are shifted at the updates. This is absolutely unavoidable, but what will happen to the App is then 'Stale NFS file handle'. Ka-boom. So then you go into the complexity of trying to asynchronously time the app chain to not run (in certain ways at least) at the exact second(s) this shift inside the inode structure happens. > > And then you give up. Been there, done that. > > /M > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.teaparty.net_mailma… > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters _______________________________________________ Toasters mailing list Toasters(a)teaparty.net http://www.teaparty.net/mailman/listinfo/toasters

1 0

SnapMirror Bi-directional possible?
by Eric Peng 24 Jul '18

24 Jul '18

Just wanted to do a quick sanity check, is there any way to have SnapMirror replication go both directions between sites? We are running cDOT 9.x at both locations. I came across some older posts (several years ago) that seem to indicate that bi-directional snapmirror would not be possible. Just wondering if this might have changed with cDOT 9.x capabilities? Thanks, Eric

5 4

Mac OS X, SMB NTFS, and chmod/chown
by Ehrenwald, Ian 12 Jul '18

12 Jul '18

Hello I have users on Mac OS X that are unable to uncompress zip files in SMB shares which sit on top of NTFS security style volumes. I hadn't heard of this problem until I started migrating my users to new shares, previously they were all on UNIX security style volumes. If I am understanding my users correctly, they can reliably reproduce this problem this way: - In Finder, right click on a folder on a share, select Compress - Zip file is created successfully on share - Double click on Zip file that was created - Mac OS X archiver utility pops up an error box, "Unable to expand (zip name) into (target dir). (Error 13 - Permission denied). Examining the Zip file from the command line shows that it is a fully formed file, no corruption, etc. When I attempt to uncompress the Zip file using the command line on the same machine that created it, I can see that unzip is attempting to chmod the files and directories and getting a Permission Denied error back from the svm. Output: UserMachine:z TheUser$ unzip 3\:14\:18.zip Archive: 3:14:18.zip creating: 3:14:18/ chmod (directory attributes) error: Permission denied inflating: 3:14:18/FileNameXYZ.FC3.idml fchmod (file attributes) error: Permission denied creating: __MACOSX/ chmod (directory attributes) error: Permission denied creating: __MACOSX/3:14:18/ chmod (directory attributes) error: Permission denied inflating: __MACOSX/3:14:18/._FileNameXYZ.FC3.idml fchmod (file attributes) error: Permission denied inflating: 3:14:18/FileNameABC.ai fchmod (file attributes) error: Permission denied inflating: __MACOSX/3:14:18/._FileNameABC.ai fchmod (file attributes) error: Permission denied inflating: 3:14:18/FileNameLMN.png fchmod (file attributes) error: Permission denied inflating: __MACOSX/3:14:18/._FileNameLMN.png fchmod (file attributes) error: Permission denied inflating: 3:14:18/FileNameXYZ.FC3.indd fchmod (file attributes) error: Permission denied inflating: __MACOSX/3:14:18/._FileNameXYZ.FC3.indd fchmod (file attributes) error: Permission denied warning: cannot set permissions for __MACOSX/3:14:18/ Permission denied warning: set times/attribs failed for __MACOSX/3:14:18/ warning: cannot set permissions for __MACOSX/ Permission denied warning: set times/attribs failed for __MACOSX/ warning: cannot set permissions for 3:14:18/ Permission denied warning: set times/attribs failed for 3:14:18/ UserMachine:z TheUser$ This does make sense, since SMB/CIFS doesn't really understand UNIX ownership and attributes. Is the solution setting the security style of the volume to Mixed? Reading in detail about it at https://whyistheinternetbroken.wordpress.com/2017/01/24/mixed-perceptions-m… makes it seem like that's the right path to follow, but before I start down that trail I wanted to see what other people have done in this situation. Thanks for your help. Ian Ehrenwald Senior Infrastructure Engineer Hachette Book Group, Inc. 1.617.263.1948 / ian.ehrenwald(a)hbgusa.com This may contain confidential material. If you are not an intended recipient, please notify the sender, delete immediately, and understand that no disclosure or reliance on the information herein is permitted. Hachette Book Group may monitor email to and from our network.

7 14

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters July 2018