toasters

toasters@lists.teaparty.net

3 participants
13513 discussions

Audit logs for CIFS events
by Ian Ehrenwald 20 Oct '18

20 Oct '18

Good afternoon Is anyone making use of cDOT auditing capabilities on CIFS shares? I've set up a demo implementation to toy around with and the log output leaves something to be desired, in terms of immediate usefulness/understandability. I was hoping for something that I could hand off to an end user when they ask "why did file X get moved to directory Y?". My demo auditing policy only has file-ops enabled, and the demo share (on NTFS volume) I am testing auditing with has advanced auditing permissions Create Files/Write Data, Create Folders/Append Data, Delete Subfolders and Files, Delete, Change Permissions, and Take Ownership enabled against my demo user. When I connect to this share as the demo user and create a directory, copy a file into it, create a subdirectory, move the file into this subdirectory, I do indeed get logging events I can view with Windows Event Viewer. Technically auditing is working. However, it is difficult to actually put together a chain of events based on the logged information with just my single user access, nevermind thousands of users across hundreds of shares. What are other people using to make sense of this audit data? Exporting via XML instead of EVTX and feeding it to.. something? Custom parsers? Spending hours with the awful Event Viewer and filters when your boss's boss wants an explanation for why files moved? :) Ian Ehrenwald Senior Infrastructure Engineer Hachette Book Group, Inc. 1.617.263.1948 / ian.ehrenwald(a)hbgusa.com

5 8

Cluster lifs not consistent anymore after upgrade from 9.3 to 9.4
by Florian Schmid 18 Oct '18

18 Oct '18

Hello, I have upgraded our two node cluster from 9.3P7 to 9.4P2, because we got a new AFF system, which needed version 9.4. Since the upgrade, I have the problem, that I'm not able any more to revert one cluster lif on both nodes. For both nodes, it is the same cluster lif! Here our cluster lifs (already with the new AFF system): network interface show -vserver Cluster Logical Status Network Current Current Is Vserver Interface Admin/Oper Address/Mask Node Port Home ----------- ---------- ---------- ------------------ ------------- ------- ---- Cluster aff-01_clus1 up/up 169.254.45.231/16 aff-01 e0a true aff-01_clus2 up/up 169.254.43.102/16 aff-01 e0b true aff-02_clus1 up/up 169.254.173.54/16 aff-02 e0a true aff-02_clus2 up/up 169.254.163.234/16 aff-02 e0b true fas-01_clus1 up/up 169.254.4.144/16 fas-01 e0c false fas-01_clus2 up/up 169.254.130.246/16 fas-01 e0c true fas-01_clus3 up/up 169.254.131.229/16 fas-01 e0b true fas-01_clus4 up/up 169.254.168.120/16 fas-01 e0d true fas-02_clus1 up/up 169.254.89.228/16 fas-02 e0b false fas-02_clus2 up/up 169.254.106.140/16 fas-02 e0c true fas-02_clus3 up/up 169.254.26.197/16 fas-02 e0b true fas-02_clus4 up/up 169.254.4.232/16 fas-02 e0d true As you can see here, both lifs fas-01_clus1 and fas-02_clus1 are not at home. When I try to revert them or migrate to their home port, I get the same error. Migrating the lif to a different port is possible without any problems: network interface revert -vserver Cluster -lif fas-01_clus1 Error: command failed: LIF "fas-01_clus1" failed to migrate: failed to move cluster/node-mgmt LIF. network interface migrate -vserver Cluster -lif fas-01_clus1 -destination-node fas-01 -destination-port e0a Error: command failed: LIF "fas-01_clus1" failed to migrate: failed to move cluster/node-mgmt LIF. I have checked the physical port e0a and haven't found any issues and it was working nicely before... I even made a cluster switch upgrade two weeks before and I was able to revert all ports. I have disabled the port e0a, disabled the switch port and checked cable. Nothing changed. Here the port config: network port show -node fas-01 -port e0a -instance Node: fas-01 Port: e0a Link: up MTU: 9000 Auto-Negotiation Administrative: true Auto-Negotiation Operational: true Duplex Mode Administrative: auto Duplex Mode Operational: full Speed Administrative: auto Speed Operational: 10000 Flow Control Administrative: none Flow Control Operational: none MAC Address: 00:a0:98:3a:52:13 Port Type: physical Interface Group Parent Node: - Interface Group Parent Port: - Distribution Function: - Create Policy: - Parent VLAN Node: - Parent VLAN Port: - VLAN Tag: - Remote Device ID: sw1 IPspace Name: Cluster Broadcast Domain: Cluster MTU Administrative: 9000 Port Health Status: healthy Ignore Port Health Status: false Port Health Degraded Reasons: - network port show -node fas-01 -port e0c -instance Node: fas-01 Port: e0c Link: up MTU: 9000 Auto-Negotiation Administrative: true Auto-Negotiation Operational: true Duplex Mode Administrative: auto Duplex Mode Operational: full Speed Administrative: auto Speed Operational: 10000 Flow Control Administrative: none Flow Control Operational: none MAC Address: 00:a0:98:3a:52:15 Port Type: physical Interface Group Parent Node: - Interface Group Parent Port: - Distribution Function: - Create Policy: - Parent VLAN Node: - Parent VLAN Port: - VLAN Tag: - Remote Device ID: sw2 IPspace Name: Cluster Broadcast Domain: Cluster MTU Administrative: 9000 Port Health Status: healthy Ignore Port Health Status: false Port Health Degraded Reasons: - Port e0c is working without any problems. I made now some more tests and I found a strange issue with the cluster ping command. Nodes fas-02, aff-01 and aff-02 behave the same, all of them get the correct cluster addresses from network interface table, only fas-01 doesn't get any addresses here: Example with fas-02: cluster ping-cluster -node fas-02 Host is fas-02 Getting addresses from network interface table... Cluster aff-01_clus1 169.254.45.231 aff-01 e0a Cluster aff-01_clus2 169.254.43.102 aff-01 e0b Cluster aff-02_clus1 169.254.173.54 aff-02 e0a Cluster aff-02_clus2 169.254.163.234 aff-02 e0b Cluster fas-01_clus1 169.254.4.144 fas-01 e0c Cluster fas-01_clus2 169.254.130.246 fas-01 e0c Cluster fas-01_clus3 169.254.131.229 fas-01 e0b Cluster fas-01_clus4 169.254.168.120 fas-01 e0d Cluster fas-02_clus1 169.254.89.228 fas-02 e0c Cluster fas-02_clus2 169.254.106.140 fas-02 e0c Cluster fas-02_clus3 169.254.26.197 fas-02 e0b Cluster fas-02_clus4 169.254.4.232 fas-02 e0d Local = 169.254.89.228 169.254.106.140 169.254.26.197 169.254.4.232 Remote = 169.254.45.231 169.254.43.102 169.254.173.54 169.254.163.234 169.254.4.144 169.254.130.246 169.254.131.229 169.254.168.120 Cluster Vserver Id = 4294967293 Ping status: ................................ Basic connectivity succeeds on 32 path(s) Basic connectivity fails on 0 path(s) Here the example from fas-01: cluster ping-cluster -node fas-01 Host is fas-01 Getting addresses from network interface table... Getting addresses from sitelist... Local = 169.254.4.144 169.254.130.246 Remote = 169.254.89.228 169.254.106.140 169.254.45.231 169.254.43.102 169.254.173.54 169.254.163.234 Cluster Vserver Id = 4294967293 Ping status: ............ Basic connectivity succeeds on 12 path(s) Basic connectivity fails on 0 path(s) As you see here, fas-01 is missing a lot of addresses here and wasn't able to them from network interface table at all. When I explicit enable -use-sitelist true , I see the same behavior on all nodes, even on the new ones... Has someone from you ever had such an issue? My problem is, that the FAS system is not in support anymore and I can't create a ticket at NetApp. Hopefully someone can help here?! Best Regards Florian Schmid

2 4

7m -> cDOT question
by Ian Ehrenwald 18 Oct '18

18 Oct '18

Good afternoon I have a single node FAS2520 with 12x3t SATA internally running 8.2 7-mode at a remote site. I need to upgrade it to cDOT to match the rest of our environment. If I (roughly): - Purchase a second-hand DS4243 filled with disk - Attach this shelf to the FAS2520, create aggregate - Move the data volumes from the internal disk to this external shelf - Copy the cDOT bundle to the filer - Shut down the filer, disconnect the external shelf - Reboot the filer, wipe the config, 'install new software first' from the boot menu Would I then be able to reconnect the external shelf with the moved volumes and import them to cDOT? The reason I need to go this route is because there is not enough bandwidth and time at the site to SnapMirror the data to our data center and then suck it back down. I took a look at the 7mtt to do something like this but it looks like no matter the copy-free mode used, it still requires a separate controller running cDOT to attach the moved shelves to. Any other better options/ideas? Ian Ehrenwald Senior Infrastructure Engineer Hachette Book Group, Inc. 1.617.263.1948 / ian.ehrenwald(a)hbgusa.com

4 5

AFF Post Process Compression?
by Philbert Rupkins 17 Oct '18

17 Oct '18

Hello Toasters, I've come across several docs that make it clear that both secondary and adaptive post-process compression are not compatible with AFF systems. I have yet to find an explanation for this. Does anybody know why? My best guess is it will shorten the life of the SSD's. We have several large deduped-but-not-compressed volumes we're migrating from 8.1.4 7-Mode to AFF systems running ONTAP 9.2. I was hoping to run post-process compression on these volumes once cutover to the 9.2 system to reap additional savings. I'm currently looking into enabling compression before cutting the volumes over to ONTAP9. However, each volume has 70+ snapshots associated with them and I see best practices for compression suggest removing as many snpashots as possible before running the post-process job. Thank you, Phil

4 7

Regarding Configuration of NVE and NSE ...encryption in cmode
by Yuvaraja Shivaram 16 Oct '18

16 Oct '18

Hi All, what are all the challenges we face during in installation? heard about it will have some performance issue, so much load it put on filer end? and does it takes any of the space from filer end? for saving keys in OKM.. and anyone has good doc for the same.. Regards Yuvaraj

2 1

vol clone split
by Chris Hague 12 Oct '18

12 Oct '18

Hi Toasters, I have a number of volumes running from a common snapshot and would like to split them out. All these volumes are snapmirrored to our DR site. However, when I try to perform a vol clone split, it complains about an in-use snapshot. Reading further, it appears that the split will delete all snapshots, so doesn't like the snapmirror snap. What is the best way to split these volumes? Ideally without having to re-baseline \ lose my snapmirror destination volume \ snaps. ONTAP v9.1P2 Error below; Time Node Severity Event ------------------- ---------------- ------------- --------------------------- 8/30/2017 09:02:17 filer1 INFORMATIONAL mgmtgwd.jobmgr.jobcomplete.failure: Job "Clone Split" [id 6716] (Split vol1) completed unsuccessfully: Volume has locked snapshots (1). 8/30/2017 09:02:17 filer1 DEBUG wafl.config.req.error: Config request 'VV_CONFIG_REQ_CLONE_SPLIT_START' by WAFL for volume vol1 is not being processed because of the error: '387 - CR_VV_VOLUME_SNAPSHOTS'. 8/30/2017 09:02:17 filer1 NOTICE wafl.vv.clone.splitBusySnap: Volume 'vol1 has locked snapshots, not splitting. KR, Chris.

4 8

FLI & Windows Clusters
by Chris Hague 10 Oct '18

10 Oct '18

Hi All, We have been using Foreign LUN Import to migrate 3rd party storage systems into CDOT. So far, we have been shutting down servers to perform the cutover. However we are now due to migrate some multiple node SQL clusters and looking at the possibility of using windows failover cluster manager to make these migrations non-disruptive. i.e. Failover node 1 resources to node 2 FLI node 1 LUN's & re-zone Failover node 2 resources to node 1 FLI node 2 LUN's & re-zone We are worried that if we fail over each windows node, migrate it's disks using FLI and change the zoning. When we failover the next node which still has direct access to the 3rd party storage, any writes made will not go through the LUN import relationship on CDOT and potentially cause corruption. Can anyone offer any advice on this? Many Thanks, Chris. This email is being sent by a subsidiary of Arthur J. Gallagher Holdings (UK) Limited, part of the Arthur J. Gallagher & Co. global group of companies. For details of the registered office, company number and, where applicable, regulated status of our subsidiaries, please visit https://www.ajginternational.com/legal-regulatory-information/. We are the data controller of any personal information you provide to us or personal information that has been provided to us by a third party. We collect and process information about you in order to arrange insurance policies and to process claims. Your information is also used for business purposes such as fraud prevention and detection and financial management. This may involve sharing your information with third parties such as insurers, reinsurers, other brokers, claims handlers, loss adjusters, credit reference agencies, service providers, professional advisors, our regulators, police and government agencies or fraud prevention agencies. We may record telephone calls to help us monitor and improve the service we provide. For further information on how your information is used and your rights in relation to your information please see our privacy notice at https://www.ajginternational.com/Privacy-Policy/. If you are providing personal data of another individual to us, you must tell them you are providing their information to us and show them a copy of this notice. Where you are obtaining a non-consumer policy of (re)insurance, or cover for additional risks or renewal under an existing policy, you are required to make a fair presentation of the risk to a (re)insurer which discloses every material circumstance which you know or ought to know relating to the risk to be insured. A circumstance is material if it would influence the judgment of a prudent insurer in determining whether to provide insurance for the risk and, if so, on what terms. Disclosure must be reasonably clear and accessible to a prudent insurer and made in good faith. The aforementioned duty of disclosure is the applicable duty under the laws of England and Wales. If your policy is not subject to English law you are expected to disclose risk information in accordance with the requirements of the applicable law. In such circumstances we expect you will disclose risk information at least equal to the standard required under English law and where the applicable law requires you to disclose information over and above the level required under English law you will provide such information in accordance with that law. Where you are obtaining a consumer policy of insurance, you must read each question and answer honestly and fully and must take reasonable care to not make a misrepresentation. Failure to comply with the above disclosure requirements, as they apply to you, could mean that your policy of (re)insurance is void, its terms are materially altered or that (re)insurers are not liable to pay all or part of your claim(s). If you are in any doubt as to your obligations you should ask your usual contact. This e-mail and any attachments are CONFIDENTIAL and may contain legally privileged information. If you are not the intended recipient of this e-mail message, please telephone or e-mail us immediately, delete this message from your system and do not read, copy, distribute, disclose or otherwise use this e-mail message and any attachments. Although the above company has taken reasonable precautions to ensure this e-mail and any attachments are free of any virus or other defect that may affect your computer, it is the responsibility of the recipient to ensure that it is virus free and the above company does not accept any responsibility for any loss or damage arising in any way from its use.

4 3

Regarding Alerts configuration in C-Mode - Netapp
by Yuvaraja Shivaram 01 Oct '18

01 Oct '18

Hi All, Do you have list of alerts which are eligible for P1, P2, P3, P4 If we talk in alerts - > Critical, Fatal, Error, Warning.types of alerts, is any one has got any Excel sheet ? please let me on the same.. Regards Yuvaraja

1 0

small clarification on adding NTP servers to netapp 7 mode and c-mode
by Yuvaraja Shivaram 27 Sep '18

27 Sep '18

Hi all, Can we add new NTP servers to 7 mode and C-mode on Fly without disrupting any protocols... infact NTP servers are being decommissioned in future, so wanted to add the new NTP servers before decommissioned...so what is the best practise to add the same.... is there any disconnects happens to cifs protocols...? Regards Yuvaraja

2 1

Copying NTFS Data with Orphaned SIDs
by Stephen Stocke 12 Sep '18

12 Sep '18

Hi We’re migrating some data from Windows file servers to CIFS shares on a 9.1p13 cluster (NTFS security style on the vols). We’re getting errors on some files and folders using Robocopy and the common thread seems to be objects with orphaned SIDs for the owner or DACL entries. We’ve tried other tools with the same results. Robocopy to another Windows file share works fine. Has anyone else seen this behaviour? We’re assuming that the CIFS server is stopping the copy because it can’t resolve the SID. Is there any way to control that behaviour and just wrtie the DACL with the unresolved SID? Thanks Steve

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters