toasters

toasters@lists.teaparty.net

3 participants
13514 discussions

RE: Intermittent "Permission denied" on NTFS qtree
by Glenn Walker 30 Nov '06

30 Nov '06

Enable the option (temporarily) 'cifs.trace_dc_connection'. The output (via screen\messages file) will help. It may not be an issue with complete connectivity drop, but the DC is definitely rejecting the RPC request to look up group membership (SamrGetAliasMembership). Glenn -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Borzenkov, Andrey Sent: Tuesday, November 28, 2006 4:40 AM To: Simon Vallet; toasters(a)mathworks.com Subject: RE: Intermittent "Permission denied" on NTFS qtree Hi, You apparently have some intermittent connectivity problems with DC. As for error messages - this indicates that the domain controller sometimes does not respond, or that connectivity with it was briefly interrupted, which somehow proves connectivity problem. Regards Andrey Borzenkov Senior system engineer IT Product Services Fujitsu Siemens Computers Russian Federation Telephone: +7(495)737-2723 Email: mailto:Andrey.Borzenkov@fujitsu-siemens.com Internet: http://www.fujitsu-siemens.com -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Simon Vallet Sent: Monday, November 27, 2006 6:09 PM To: toasters(a)mathworks.com Subject: Intermittent "Permission denied" on NTFS qtree Hi, we've been trying to solve an intermittent "Permission denied" access problem on a NTFS qtree for some time now, to no avail, so maybe some of you will have some advice. We have a CIFS- and NFS-exported NTFS qtree on a FAS3020 cluster running Data ONTAP 7.1.1. The PDC is a win2k3 server, and Unix users are managed via NIS. From time to time, legitimate users are refused access to certain files with a "Permission denied" message, especially when trying to access the qtree via NFS. These users *do* have permission to access the files in question as per NTFS ACLs -- in fact, when they retry to access the file a few minutes later, they are granted access. We're seing this problem since a bit more of a week now, and still have no clue what the cause of the problem could be... the SID cache seems to be a good suspect, but it's hard to tell; we've also thought of buggy win2k3 patches... In parallel, we're seing the following messages in the logs: CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. Has anybody experienced a similar problem ? Simon -- Simon Vallet Ingénieur Systèmes/Réseaux Genoscope / CNRG Tél. : 01 60 87 36 06 E-mail : svallet(a)genoscope.cns.fr

4 4

RE: snaplock enterprise / compliance
by Creek, Toby 30 Nov '06

30 Nov '06

As of ONTAP 7.1, you can have both Compliance and Enterprise licensed at the same time, but the aggr types are different. Licenses can be removed while data exists; you just can't create new SnapLock aggrs or lock files anymore. You'll need to perform a data migration to go from one to the other - vol copy is the recommended route to preserve immutability. You may need to check with your compliance officer or legal counsel to ensure that chain of custody is preserved via necessary documentation. Toby -- Toby Creek Carolinas District Systems Engineer Network Appliance(r) http://www.netapp.com/ Office: +1-919-476-5737 Mobile: +1-919-244-4595 -----Original Message----- From: Glenn Walker [mailto:ggwalker@mindspring.com] Sent: Wednesday, November 29, 2006 4:07 PM To: Willeke, Jochen; toasters(a)mathworks.com Subject: RE: snaplock enterprise / compliance You can only have one license on the filer at a time - If I recall correctly, there is no way to remove the license without first removing the data. This KB may help: http://now.netapp.com/Knowledgebase/solutionarea.asp?id=kb17082 However, it states that you can perform vol copy - perhaps it intends you to do this to another filer? Glenn -----Original Message----- From: owner-toasters(a)mathworks.com on behalf of Willeke, Jochen Sent: Wed 11/29/2006 11:54 AM To: toasters(a)mathworks.com Subject: snaplock enterprise / compliance Hi toasters, i have an R200 with snaplock_enterprise. There is already an aggregate using this feature. But now i want to convert from snaplock_enterprise to snaploch_compliance. Is there a way to do this? Can i just remove the snaplock_enterprise license and than add the snaplock_compliance license or will this cause any trouble? Best Regards Jochen

1 0

RE: Intermittent "Permission denied" on NTFS qtree
by Glenn Walker 30 Nov '06

30 Nov '06

More logs would be helpful - by default, the filer will try to 'improve' DC connectivity by searching every 4 hours. The last part of the logs that you posted may very well be that, or more likely it is trying to regain connectivity after an error (security context expiring is not something that is seen frequently - this is abnormal!). The biggest problems are the context expiring, the GSSAPI security context error (result of the security context expiring, no doubt), and the RPC rejection. I'm assuming that the RPC rejection and the GSSAPI errors are a direct result of the context expiration. Glenn -----Original Message----- From: Simon Vallet [mailto:svallet@genoscope.cns.fr] Sent: Wednesday, November 29, 2006 6:10 AM To: Glenn Walker Cc: Andrey.Borzenkov(a)fujitsu-siemens.com; toasters(a)mathworks.com Subject: Re: Intermittent "Permission denied" on NTFS qtree Hi, On Tue, 28 Nov 2006 07:41:58 -0500 "Glenn Walker" <ggwalker(a)mindspring.com> wrote: > Enable the option (temporarily) 'cifs.trace_dc_connection'. The output (via screen\messages file) will help. > > It may not be an issue with complete connectivity drop, but the DC is definitely rejecting the RPC request > to look up group membership (SamrGetAliasMembership). Apparently, there are some connectivity problems, but it seems they are quite random -- a trace of network traffic between the filer and the PDC reveals some unexpected TCP resets issued byt the DC : [...] filer -> DC [FIN,ACK] DC->filer [ACK] DC->filer [RST,ACK] [...] this shouldn't be a problem, since the filer requested a FIN anyway, but the time coincidence is troubling... Enabling cifs.trace_dc_connection and cifs.trace_login yields some more information: AUTH: notice- The context has expired. AUTH: notice- No error. AUTH: notice- Unexpected GSSAPI security context error. AUTH: notice- The context has expired. AUTH: notice- No error. CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. AUTH: Error looking up domain groups during login from 192.168.x.x:RPC_NT_CALL_FAILED (0xc002001b). and ten seconds later: AUTH: TraceLDAPServer- Starting AD LDAP server address discovery for domain.tld AUTH: TraceLDAPServer- Found 2 AD LDAP server addresses using generic DNS query. AUTH: TraceLDAPServer- AD LDAP server address discovery for domain.tld complete. 2 unique addresses found. AUTH: notice- Unexpected GSSAPI security context error. [...] This goes on for ten minutes, then the filer tries to locate a DC again, and then everything works fine again AUTH: TraceDC- Starting DC address discovery for domain. AUTH: TraceDC- Filer is not a member of a site. AUTH: TraceDC- Found 2 addresses using generic DNS query. AUTH: TraceDC- Starting WINS queries. AUTH: TraceDC- Found 2 BDC addresses through WINS. AUTH: TraceDC- Found 1 PDC addresses through WINS. AUTH: TraceDC- DC address discovery for PC complete. 2 unique addresses found. I'm not really sure of what *should* happen, but this definitely does *not* look good... I understand that a security context expires sometimes, but I wonder why it takes so long to re-negociate Simon

3 3

RE: Intermittent "Permission denied" on NTFS qtree
by George, Andrew 30 Nov '06

30 Nov '06

It's a long shot but...anything changed on the DC's recently? (Hotfixes, service packs, replacements)? -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Myles Uyema Sent: Thursday, 30 November 2006 3:31 AM To: Simon Vallet Cc: Glenn Walker; Andrey.Borzenkov(a)fujitsu-siemens.com; toasters(a)mathworks.com Subject: Re: Intermittent "Permission denied" on NTFS qtree This sort of reminds me of bug 147265 which I encountered a while back, but you said you're running 7.1.1, and the Bugs Online says it's fixed in that release. I would expect that ONTAP should acquire a new token if getting disconnected in such a manner... If you can take a packet trace between the filers and DC that might help support escalate the case quicker? I suppose you've already done that. On Wed, 29 Nov 2006, Simon Vallet wrote: Hi, On Tue, 28 Nov 2006 07:41:58 -0500 "Glenn Walker" <ggwalker(a)mindspring.com> wrote: > Enable the option (temporarily) 'cifs.trace_dc_connection'. The output (via screen\messages file) will help. > > It may not be an issue with complete connectivity drop, but the DC is > definitely rejecting the RPC request to look up group membership (SamrGetAliasMembership). Apparently, there are some connectivity problems, but it seems they are quite random -- a trace of network traffic between the filer and the PDC reveals some unexpected TCP resets issued byt the DC : [...] filer -> DC [FIN,ACK] DC->filer [ACK] DC->filer [RST,ACK] [...] this shouldn't be a problem, since the filer requested a FIN anyway, but the time coincidence is troubling... Enabling cifs.trace_dc_connection and cifs.trace_login yields some more information: AUTH: notice- The context has expired. AUTH: notice- No error. AUTH: notice- Unexpected GSSAPI security context error. AUTH: notice- The context has expired. AUTH: notice- No error. CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. AUTH: Error looking up domain groups during login from 192.168.x.x:RPC_NT_CALL_FAILED (0xc002001b). and ten seconds later: AUTH: TraceLDAPServer- Starting AD LDAP server address discovery for domain.tld AUTH: TraceLDAPServer- Found 2 AD LDAP server addresses using generic DNS query. AUTH: TraceLDAPServer- AD LDAP server address discovery for domain.tld complete. 2 unique addresses found. AUTH: notice- Unexpected GSSAPI security context error. [...] This goes on for ten minutes, then the filer tries to locate a DC again, and then everything works fine again AUTH: TraceDC- Starting DC address discovery for domain. AUTH: TraceDC- Filer is not a member of a site. AUTH: TraceDC- Found 2 addresses using generic DNS query. AUTH: TraceDC- Starting WINS queries. AUTH: TraceDC- Found 2 BDC addresses through WINS. AUTH: TraceDC- Found 1 PDC addresses through WINS. AUTH: TraceDC- DC address discovery for PC complete. 2 unique addresses found. I'm not really sure of what *should* happen, but this definitely does *not* look good... I understand that a security context expires sometimes, but I wonder why it takes so long to re-negociate Simon "This e-mail and any attachments to it (the "Communication") is, unless otherwise stated, confidential, may contain copyright material and is for the use only of the intended recipient. If you receive the Communication in error, please notify the sender immediately by return e-mail, delete the Communication and the return e-mail, and do not read, copy, retransmit or otherwise deal with it. Any views expressed in the Communication are those of the individual sender only, unless expressly stated to be those of Australia and New Zealand Banking Group Limited ABN 11 005 357 522, or any of its related entities including ANZ National Bank Limited (together "ANZ"). ANZ does not accept liability in connection with the integrity of or errors in the Communication, computer virus, data corruption, interference or delay arising from or in respect of the Communication."

1 0

snaplock enterprise / compliance
by Willeke, Jochen 29 Nov '06

29 Nov '06

Hi toasters, i have an R200 with snaplock_enterprise. There is already an aggregate using this feature. But now i want to convert from snaplock_enterprise to snaploch_compliance. Is there a way to do this? Can i just remove the snaplock_enterprise license and than add the snaplock_compliance license or will this cause any trouble? Best Regards Jochen

2 1

Intermittent "Permission denied" on NTFS qtree
by Simon Vallet 28 Nov '06

28 Nov '06

Hi, we've been trying to solve an intermittent "Permission denied" access problem on a NTFS qtree for some time now, to no avail, so maybe some of you will have some advice. We have a CIFS- and NFS-exported NTFS qtree on a FAS3020 cluster running Data ONTAP 7.1.1. The PDC is a win2k3 server, and Unix users are managed via NIS. From time to time, legitimate users are refused access to certain files with a "Permission denied" message, especially when trying to access the qtree via NFS. These users *do* have permission to access the files in question as per NTFS ACLs -- in fact, when they retry to access the file a few minutes later, they are granted access. We're seing this problem since a bit more of a week now, and still have no clue what the cause of the problem could be... the SID cache seems to be a good suspect, but it's hard to tell; we've also thought of buggy win2k3 patches... In parallel, we're seing the following messages in the logs: CIFSRPC SamrGetAliasMembership: Exception rpc_s_unknown_reject caught. Has anybody experienced a similar problem ? Simon -- Simon Vallet Ingénieur Systèmes/Réseaux Genoscope / CNRG Tél. : 01 60 87 36 06 E-mail : svallet(a)genoscope.cns.fr

2 1

RE: simple SAN?!
by Learmonth, Peter 26 Nov '06

26 Nov '06

Hi Fred What virtual HBA/driver would you configure in the VM? To my understanding, the only virtual HBA available are VMLSILogic and VMBusLogic. It's been that way for a long time. This isn't to say VMware couldn't invent a new VMHBA or integrate virtual port functionality into the VMLSILogic implementation. I'm just not sure what you would gain from it. One of the main points of the VM architecture is to not have to worry about what drivers you need in the VM. Another thing that comes to mind is that you couldn't use VMFS (for the VM's disk), since with a virtual FC port would talk directly to LUNs. This becomes more like RDM, and again, I don't see what you gain. It occurred to me to see what VMware had to say. The only occurrence of "NPIV" on their site yields the following: http://www.vmware.com/pdf/esx_lun_security.pdf So, from their perspective, it seems the gain from NPIV is security. It also look like this is not a shipping product/feature. Share and enjoy! Peter ________________________________ From: Fred Grieco [mailto:fredgrieco@yahoo.com] Sent: Thursday, November 23, 2006 4:50 AM To: Davies,Matt; Willeke, Jochen; toasters(a)mathworks.com Subject: Re: simple SAN?! I'm pretty sure you can use FC to the VMs if you use virtual ports or NPIV. http://storagemagazine.techtarget.com/magLogin/1,291245,sid35_gci1228666 ,00.html This is a little like "NAT" for fibre channel. It also requires sophisticated cards and switches. Fred ----- Original Message ---- From: "Davies,Matt" <MDAVIES(a)generalatlantic.com> To: "Willeke, Jochen" <Jochen.Willeke(a)wincor-nixdorf.com>; toasters(a)mathworks.com Sent: Thursday, November 23, 2006 6:24:50 AM Subject: RE: simple SAN?! On the VMware side, as far as I understand you can only use FC to the physical machine, not to a virtual machine, as the VM's do not support FC. I believe you can still use VCB with Iscsi, it just needs a bit more scripting, I would check out the VMware discussion groups on the VMware website, I have always found them very helpful. Cheers Matt ________________________________ From: Willeke, Jochen [mailto:Jochen.Willeke@wincor-nixdorf.com] Sent: 23 November 2006 11:07 To: Davies,Matt; toasters(a)mathworks.com Subject: RE: simple SAN?! We already use ISCSI, but we aer thinking about VMWare and VMWare has some nice features (e.g. VCB) which need an FC-SAN. Thanks anyway Jochen ________________________________ From: Davies,Matt [mailto:MDAVIES@generalatlantic.com] Sent: Thursday, November 23, 2006 11:59 AM To: Willeke, Jochen; toasters(a)mathworks.com Subject: RE: simple SAN?! If you are looking at low cost san, I would go Iscsi, as long as everything you need on Iscsi is on Gig ethernet ports, it should work fine. Cheers Matt ________________________________ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Willeke, Jochen Sent: 23 November 2006 10:11 To: toasters(a)mathworks.com Subject: simple SAN?! Hi, as we use not too much SAN at our site i am not really used to this topic. Yesterday i read an article about "simple SAN". "Simple SAN" seems to mean as an plug-n-play solution. But what about the components espacially the SAN-switches? Do we see really new (and cheap :D) SAN-switches or only old products "reassembled" as a solution for small companies. Regards Jochen __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: simple SAN?!
by Glenn Walker 26 Nov '06

26 Nov '06

You can use SD\SM with FC-SAN as well as iSCSI using software initiator or hardware initiator (QLogic 4010C for example). I'm not aware if using VMWare with guest OSs places any further limitations on this. Glenn -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Holloway, Chris Sent: Thursday, November 23, 2006 1:42 PM To: Julio Calderon; Willeke, Jochen; Davies,Matt; toasters(a)mathworks.com Subject: RE: simple SAN?! You may also want to be aware of the limitations as to when and where you can use SnapDrive and SnapManager products with the guest machines. Essentially you can only use SD and SM if you are using a software iSCSI initiator. Any other methods (and as far as I know this includes raw device mapping) and you won't be able to use them. Chris -----Original Message----- From: owner-toasters(a)mathworks.com on behalf of Julio Calderon Sent: Thu 23/11/2006 18:07 To: Willeke, Jochen; Davies,Matt; toasters(a)mathworks.com Cc: Subject: RE: simple SAN?! You should be able to levereage nfs for vmware -----Original Message----- From: Willeke, Jochen [mailto:Jochen.Willeke@wincor-nixdorf.com] Sent: Thu Nov 23 03:25:26 2006 To: Davies,Matt; toasters(a)mathworks.com Subject: RE: simple SAN?! We already use ISCSI, but we aer thinking about VMWare and VMWare has some nice features (e.g. VCB) which need an FC-SAN. Thanks anyway Jochen ________________________________ From: Davies,Matt [mailto:MDAVIES@generalatlantic.com] Sent: Thursday, November 23, 2006 11:59 AM To: Willeke, Jochen; toasters(a)mathworks.com Subject: RE: simple SAN?! If you are looking at low cost san, I would go Iscsi, as long as everything you need on Iscsi is on Gig ethernet ports, it should work fine. Cheers Matt ________________________________ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Willeke, Jochen Sent: 23 November 2006 10:11 To: toasters(a)mathworks.com Subject: simple SAN?! Hi, as we use not too much SAN at our site i am not really used to this topic. Yesterday i read an article about "simple SAN". "Simple SAN" seems to mean as an plug-n-play solution. But what about the components espacially the SAN-switches? Do we see really new (and cheap :D) SAN-switches or only old products "reassembled" as a solution for small companies. Regards Jochen Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Employees of the company are expressly required not to make defamatory statements and not to infringe or authorize any infringement of copyright or any other legal right by email communications. Any such communication is contrary to company policy and outside the scope of the employment of the individual concerned. The company will not accept any liability in respect of such communication, and the employee responsible will be personally liable for any damages or other liability arising.

1 0

DataONTAP 7.2 Cheat Sheet
by Timothy Hollingworth 24 Nov '06

24 Nov '06

I keep a command cheat sheet for my own reference. I thought I'd pass it along. Suitable for framing! http://www.freewebs.com/atlantabikerides/doc/DataONTAP.7.2.Commands.TLH. 11.21.06.pdf Timothy L. Hollingworth Sr. Network Engineer, ePlus Technology Inc. 678.462.6698 (cell) AIM: HollingworthTim YIM: t_holling

4 3

RE: SnapMirror Bandwidth restrictions
by Davies,Matt 24 Nov '06

24 Nov '06

The peaks occur only during snapmirror jobs, and all the jobs have been spaced so that only one job runs at a time. We have set the tcp window size and it has reduced the problem a little. We can buffer more packets on the router, the problem is that some packets get delayed too long and have to be retransmitted, which only makes the problem worse. Thanks Matt -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Johnson, James A Sent: 23 November 2006 22:49 To: Holland, William L; toasters(a)mathworks.com Subject: RE: SnapMirror Bandwidth restrictions Have you determined the times that you are getting these peaks? I think there could be number of things going on here , one of which was mentioned - snapmirror running simultaniously. I would also check the time this is happening. If the you could find a pattern, this could help you narrow it down to what is running at the time. -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Holland, William L Sent: Tuesday, November 14, 2006 9:12 AM To: toasters(a)mathworks.com Subject: RE: SnapMirror Bandwidth restrictions Take a look at Adjusting the TCP Window Size in http://now.netapp.com/NOW/knowledge/docs/ontap/rel705/html/ontap/onlineb k/mirror6.htm It can help you determine the proper setting based on your network needs. -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Davies,Matt Sent: Tuesday, November 14, 2006 7:58 AM To: Glenn Walker; toasters(a)mathworks.com Subject: RE: SnapMirror Bandwidth restrictions Glenn, The snapmirror.conf file is showing 1000 as the limit. Which should equate to just under 8Mb/s Overall the rate does average out for the snapmirror jobs to be below 1000KB/s There was only one snapmirror running at the time of the test I carried out to confirm the rates. Matt -----Original Message----- From: Glenn Walker [mailto:ggwalker@mindspring.com] Sent: 14 November 2006 12:47 To: Davies,Matt; toasters(a)mathworks.com Subject: RE: SnapMirror Bandwidth restrictions I assume that the snapmirror.conf file is showing 1000 as the limit? This is in KB (kilobyte), not kb(kilobit). Are you sure that there aren't multiple mirrors running simultaneously? Glenn -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Davies,Matt Sent: Tuesday, November 14, 2006 5:40 AM To: toasters(a)mathworks.com Subject: SnapMirror Bandwidth restrictions Hi, We have noticed that when a snapmirror runs between our filers with a maximum transfer rate of 1000 KB/s, we are seeing peaks of traffic of around 24Mb/s. This has been confirmed using ethereal, that it is the snapmirror traffic. We have noticed that these peaks are causing excessive amount of dropped packets on the wan interface of the routers between all the site. we have tried a number of difference queuing strategies and bandwidth shaping, but the router cannot buffer all the packets during the peaks and starts dropping them. As we also use these links for both voice and video, we are seeing high jitter rates during these peaks, and need to do something about it. We have a mixture of FAS250's and FAS270's all are showing the same problem Has anyone else experienced this ? Or does anyone have any ideas. Cheers Matt

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters