toasters

toasters@lists.teaparty.net

1 participants
13531 discussions

Setting permissions on NTFS CIFS share, users not found?
by Ian Ehrenwald 22 Jan '19

22 Jan '19

Hello I am unsure if this is an AD or a ONTAP config problem, but I thought I'd ask. I have not run into this before. Brand new cluster (9.4P4), brand new SVM, pretty minimal config. # Standard issue create CIFS server, allow anyone to connect through default export -policy # Create a volume to test with, NTFS security, and a CIFS share on top of it MyCluster::> vserver cifs create -vserver MySvm -cifs-server MyNas -domain MyAdDomain.Business.com (joined it to MyAdDomain.Business.Com) MyCluster::> vserver export-policy rule create -policyname default -clientmatch 0.0.0.0/0 -rorule any -rwrule any -superuser any -vserver MySvm -protocol cifs MyCluster::> volume create -volume cifs_test -aggregate MyCluster_02_SATA_1 -size 1g -junction-path /cifs_test -security-style ntfs -vserver MySvm MyCluster::> vserver cifs share create -share-name cifs_test -path /cifs_test -vserver MySvm # Test AD SID resolution from the filer, forwards and backwards MyCluster::> set diagnostic MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -win-name MyUserName S-1-5-21-348434689-563360211-3986294115-29846 MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -sid S-1-5-21-348434689-563360211-3986294115-29846 MyAdDomain\MyUserName (Windows User) MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -win-name MyAdDomain\aGroupIamAmemberOf S-1-5-21-348434689-563360211-3986294115-1154 MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -sid S-1-5-21-348434689-563360211-3986294115-1154 MyAdDomain\aGroupIamAmemberOf (Windows Domain group) So far so good. CIFS share permission by default is Everyone/Full. NTFS permission by default is Everyone/Full. I am able to connect to the share at \\MyNas\cifs_test and create a directory. The test directory has permission of Everyone/Full as viewed by right clicking on the test directory, selecting Properties, and viewing the Security tab. If I click on Advanced, I see the Owner correctly set to MyUserName as defined in AD. The Permissions tab in the Advanced window has Allow/Everyone/Full Control. Now, here is the problem. if I click on 'Add', the Permission Entry window pops up and I need to Select A Principal. When I Select A Principal and enter a known-good username into the 'Enter the object name to select' field and click Check Names, I get 'An object with the following name cannot be found.. blahblahblah'. I've tried with multiple users, multiple groups, all with the same result. I know these objects (users, groups) exist. The 'From this location' box in the window that pops up is referencing MyAdDomain.Business.Com, and the Object Type is User/Group/Built In SP. Is this a failure of something in our AD environment and our workstations, or is this a failure somewhere in ONTAP land? I'm leaning towards something screwed up in our AD environment because of the diag secd test from above working, but I'm not sure. Any ideas? Ian Ehrenwald Senior Infrastructure Engineer Hachette Book Group, Inc. 1.617.263.1948 / ian.ehrenwald(a)hbgusa.com This may contain confidential material. If you are not an intended recipient, please notify the sender, delete immediately, and understand that no disclosure or reliance on the information herein is permitted. Hachette Book Group may monitor email to and from our network.

2 2

Re: Bandwidth Calculator for Exiting NetApp
by jordan slingerland 14 Jan '19

14 Jan '19

Again, may be the best option that I can think of...but will it really be equal to your total write rate? What if a block changes 32 times in 5 seconds. I think semi sync is going to be at best every 3 seconds (i am actually asking and confirming that) and thus all 32 of those writes may end up only being 1 or 2 blocks traversing circuit sm is using. --Jordan On Mon, Jan 14, 2019 at 12:36 PM Fenn, Michael <fennm(a)deshawresearch.com> wrote: > One thing you could do is to look at the write rate over time via your > favorite tool (statistics show, OCUM, OCI, Harvest, etc.). Assuming the > goal is to have async SnapMirror “keep up”, all writes effectively need to > be journaled to the remote site. The bandwidth required would correspond > to the total write rate. > > > > Thanks, > > Michael > > > > *From: *<toasters-bounces(a)teaparty.net> on behalf of jordan slingerland < > jordan.slingerland(a)gmail.com> > *Date: *Monday, January 14, 2019 at 11:14 AM > *To: *Basil <basilberntsen(a)gmail.com> > *Cc: *"toasters(a)teaparty.net" <toasters(a)teaparty.net> > *Subject: *Re: Bandwidth Calculator for Exiting NetApp > > > > Best way I can think of ,though,potentially async sm may have a higher > change rate dependent on work load and current sm schedule. > > > > For example, a block might change once every 5 seconds but snapmirror once > every hr will only catch 1 block change every hour. > > > > > > > > > > On Mon, Jan 14, 2019 at 10:40 AM Basil <basilberntsen(a)gmail.com> wrote: > > I use an older version of ontap (9.1) with the old fashioned snapmirror > (DP, not XDP), but basically the estimate should be based on the cumulative > snapshot delta, minus potential compression. > > > > Snapshot show-delta is the command to see the delta between any two > snapshots. > > > > On Mon, Jan 14, 2019 at 9:27 AM Mike Michalakis <mike(a)directit.com.cy> > wrote: > > I’m wondering how anyone approaches the following scenario: > > > > We have an existing NetApp system in place (ONTAP 9.4), currently taking > Snapshots of all the required volumes as per the required RPO objectives as > defined. > > > > The question is: > > There is now a requirement to implement a DR site using Asynchronous > Snapmirror, based on the current snapshots and rate of change, what is an > estimated bandwidth requirement to meet X RPO. > > > > What tools or options are available for completing such an exercise or the > methodology > > > > Thanks > > MikeM > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters > >

1 0

Bandwidth Calculator for Exiting NetApp
by Mike Michalakis 14 Jan '19

14 Jan '19

I’m wondering how anyone approaches the following scenario: We have an existing NetApp system in place (ONTAP 9.4), currently taking Snapshots of all the required volumes as per the required RPO objectives as defined. The question is: There is now a requirement to implement a DR site using Asynchronous Snapmirror, based on the current snapshots and rate of change, what is an estimated bandwidth requirement to meet X RPO. What tools or options are available for completing such an exercise or the methodology Thanks MikeM

4 3

would like to know the prons and cons between OCUM And Zenoss Monitoring tool
by Yuvaraja Shivaram 07 Jan '19

07 Jan '19

Hi All, Any one knows the pros and cons of OCUM and Zenoss monitoring tool.. just would like to know which is more beneficiaries either using OCUM or Zenoss tool for monitoring.. aiming to configure only netapp storage(C-Mode) not for heterogeneous storage's Please let us know if anyone's knows more about it, as I am new to Zenoss monitoring Tool. Regards Yuvaraja

5 4

DP to XDP conversion problems
by Peter D. Gray 04 Jan '19

04 Jan '19

Hi people, We are heavy users of snapmirror DR. We started to convert those relations to XDP from DP. We used: - break snapmirror - snapmirror release on source - snapmirror delete on target - wait (no idea what goes on behind the scenes here) - snapmirror create -destination-path <path> -type XDP -policy MirrorAllSnapshots -identity-preserve true - source-vserver <name> -source-cluster <name> - snapmirror resync -destination-path <path> This works a treat unless you have unprotected volumes. If there are source volumes flagged unprotected and therefore not on the destination vserver you appear to be doomed. We have found no way to ever resynmc the source to destination vservers. What you up wirth is something like: Cluster Source Destination State Status Policy Progress Size Lag SRC svm-esx: svm-esx-dr: Broken-off Idle MirrorAllSnapshots - 39GB - SRC svm-esx:esx_03 svm-esx-dr:esx_slinux_03 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_04 svm-esx-dr:esx_slinux_04 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_sscratch_00 svm-esx-dr:esx_sscratch_00 Uninitialized Idle MirrorAllSnapshots - - - SRC svm-esx:esx_sscratch_01 svm-esx-dr:esx_sscratch_01 Uninitialized Idle MirrorAllSnapshots - - - SRC svm-esx:esx_10 svm-esx-dr:esx_10 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_10 svm-esx-dr:esx_11 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_10 svm-esx-dr:esx_12 Broken-off Idle MirrorAllSnapshots - - - The above is hand edited so ignore any errors. You get the idea. No amount of stuffing around (and there has been a lot) has ever go this relationshp to work properly again. Anyine else seen this and/or have a solution. We have guessed that the unprotected flag is no longer supported which is annoying in itself. Regards, pdg Peter Gray Ph (direct): +61 2 4221 3770 Information Management & Technology Services Ph (switch): +61 2 4221 3555 University of Wollongong Fax: +61 2 4229 1958 Wollongong NSW 2522 Email: pdg(a)uow.edu.au Australia URL: http://pdg.uow.edu.au

3 2

Re: ONTAP 9.5RC1 and quota enforcement in flexgroups
by John Stoffel 22 Dec '18

22 Dec '18

And.... what was your error? Share the pain please? >>>>> "Mark" == Mark A via Toasters Allen <toasters(a)teaparty.net> writes: Mark> From: "Allen, Mark A" <maallen(a)lanl.gov> Mark> To: "toasters(a)teaparty.net" <toasters(a)teaparty.net> Mark> Date: Wed, 12 Dec 2018 23:01:39 +0000 Mark> Subject: Mark> Never mind! User error, user and tree quotas working as expected in flexgroup running 95RC1 Mark> Mark Mark> ----------------------------------- Mark> Toasters, Mark> I have a qtree for home directories in a FlexGroup. I’m testing 9.5RC1 quota enforcement and Mark> seeing mixed results. Mark> The tree type quota rule is enforced. Mark> But, the user type quota rules are not. Mark> Both default and userid specific user quotas are not enforced. The commands below are accepted Mark> without error and I see the disk limits in volume quota policy rule show and volume quota report. Mark> But, when I rsync a file over usage exceeds the limit. Any ideas? Mark> volume quota policy rule modify -vserver data -policy-name y_users -volume y_users_fg1 -type user Mark> -target "" -qtree users -disk-limit 3g Mark> volume quota resize… Mark> volume quota policy rule create -vserver data -policy-name y_users -volume y_users_fg1 -type user Mark> -target 12345 -qtree users -disk-limit 3g Mark> volume quota off/on… Mark> Mark Mark> _______________________________________________ Mark> Toasters mailing list Mark> Toasters(a)teaparty.net Mark> http://www.teaparty.net/mailman/listinfo/toasters

3 3

Creating a readonly user to monitor NetApp cluster via check_mk
by Sylvain Robitaille 20 Dec '18

20 Dec '18

Hello fellow toasters users ... We're in the process of deploying a pair of new CDOT filers and one of the things we'd like to setup with them is having check_mk (nagios and rrd, under the hood) monitor various attributes. We have a working instance at the moment using snmp to query the filers, but check_mk also provides a "plugin" that claims to work with the filer's web interface, so we'd like to examine that. To that end, I've setup a read-only user on the filer, that I intend will be able to access the web interface: security login create -vserver fc1-na -user-or-group-name nul_cmk \ -application http -authentication-method password -role readonly \ -comment "check_mk monitoring" The user shows up when I "show": fc1-na::> security login show -vserver fc1-na -user-or-group-name nul_cmk Vserver: fc1-na Second User/Group Authentication Acct Authentication Name Application Method Role Name Locked Method -------------- ----------- ------------- ---------------- ------ -------------- nul_cmk http password readonly no none The readonly role is unchanged from the OS default: fc1-na::> security login role show -vserver fc1-na -role readonly Role Command/ Access Vserver Name Directory Query Level ---------- ------------- --------- ----------------------------------- -------- fc1-na readonly DEFAULT readonly security none security login password all security login role show-user-capability all set all 5 entries were displayed. Trouble is that if I try to login to the web interface as that user, the browser stays "stuck" at the "Loading system details..." spinner widget. It's been there now for about two hours as I type this. Of course, check_mk's plugin logs a timeout while trying to access the interface. I fully suspect that I'm missing something, of course, but I'm afraid I haven't been able to find what that is. If someone out there has experience creating such a user for readonly access, a pointer to where I should be looking and/or documentation I should be reading would be hugely appreciated. (cli is preferred because it's easier to document what I've done that way, but if someone points me to resources in the web interface I'm sure I'll be able to find what I need at the cli.) -- ---------------------------------------------------------------------- Sylvain Robitaille syl(a)encs.concordia.ca Systems analyst / AITS Concordia University Faculty of Engineering and Computer Science Montreal, Quebec, Canada ----------------------------------------------------------------------

1 1

ONTAP 9.5RC1 and quota enforcement in flexgroups
by Allen, Mark A 12 Dec '18

12 Dec '18

Toasters, I have a qtree for home directories in a FlexGroup. I’m testing 9.5RC1 quota enforcement and seeing mixed results. The tree type quota rule is enforced. But, the user type quota rules are not. Both default and userid specific user quotas are not enforced. The commands below are accepted without error and I see the disk limits in volume quota policy rule show and volume quota report. But, when I rsync a file over usage exceeds the limit. Any ideas? volume quota policy rule modify -vserver data -policy-name y_users -volume y_users_fg1 -type user -target "" -qtree users -disk-limit 3g volume quota resize… volume quota policy rule create -vserver data -policy-name y_users -volume y_users_fg1 -type user -target 12345 -qtree users -disk-limit 3g volume quota off/on… Mark

1 1

what is the best practise to create LUNS in C-mode 9.4p2 version
by Yuvaraja Shivaram 11 Dec '18

11 Dec '18

Hi All, what is the best practice to create Luns in cmode (netapp)version 9.4p2.. by creating qtree and then on top of it creating luns (which will have options to change the security style..ntfs or unix) /vol/abc_vol/luns/dblog (by creating qtree "luns") OR vol/abc_vol/dblog (without creating qtree "luns").. just creating the luns without using qtree's in the path given.. Regards Yuvaraj

3 4

Local account from previous NetApp sometimes shows access on new NetApp
by Jeff Cleverley 10 Dec '18

10 Dec '18

Greetings, I'm seeing some odd behavior with user access on a share. I cannot reproduce the behavior on demand so I have not opened a case with NetApp. Environment - Older 7-mode filer name FAS with local user account named Foo. Newer CDOT filer named NEWFAS with local user account named Foo. We migrated data off FAS to NEWFAS, renamed FAS to OLDFAS, then renamed NEWFAS to FAS. The AD object FAS was removed and re-created for the original name. The same local accounts were set up on each filer. Problem - Because the local accounts on different filers have unique SIDs, the data copied came over with access permissions that usually show the SID for the Foo account (S-1-2-34-5...) I understand and am OK with this. What happens at a random time, and unknown reason is sometimes when using Windows Explorer to view properties, it occasionally shows OLDFAS\Foo instead of just the SID (S-1-2-34-5...) . I had a couple of people verify I wasn't crazy (my mother had me tested) and after checking properties on a couple of other files, it all went back to the SID. I'm at a loss to figure out how exploring to a share on FAS can occasionally figure out that the SID is for OLDFAS\Foo and correctly map a name when 99.9% of the time it only shows the SID. Thanks, Jeff -- ** Please note my email address has changed to jeff.cleverley(a)broadcom.com Jeff Cleverley Manufacturing Engineer 4380 Ziegler Road Building 1, Dock 1 Fort Collins, Colorado 80525 970-288-4611

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters