I believe it is not necessary to have quota trees in order to have quotas. But it is highly advisable. I highly recommend putting all user home directories in quota trees. If you don't want to make false barriers, put all the users in a single quota tree. This will prevent a disaster. It's possible to have a disaster (well maybe the word is too strong) if your filer fills up. If it fills up, you could truncate an essential file such as /etc/passwd. If the quota tree(s) add up to slightly less than the entire volume, then users will never fill up the filer.
Unfortunately, if existing directories are NOT in a quota tree, you have to move them into one. This can be extremely time consuming. I don't know a way around this. You may have to have a night where the filer is unavailable to users while you make the move(s).
I believe it is not necessary to have quota trees in order to have quotas. But it is highly advisable. I highly recommend putting all user home directories in quota trees.
I second this. Always put users who are subject to quotas into a quota tree. Even if you think you will never need quota trees.
Assume a volume is delimited by { and } and a qtree is delimited by ( and ). If you have a user A who owns files in a volume and also in a qtree, it looks like this:
{ A ( A ) }
Suppose you want to limit A to 100M in the volume at large, but let A use up to 500M in the qtree. There is no way to accomplish this with the above scenario. The volume quota covers the ENTIRE volume, i.e., everything from { to }. If you set A's volume quota to 100M, and A's qtree quota to 500M, then A is limited to 100M in the entire volume, including any space A uses in the qtree.
Since A is entitled to up to 600M total, you could set A's volume quota to 600M and A's qtree quota to 500M. But then A could use 600M outside the qtree and nothing inside it. Still not what you want.
It is much better to do this:
{ ( A ) ( A ) }
That way you can give A an unlimited quota in the volume, but then set separate quotas for A in each qtree. You can give A a 100M quota in one qtree and a 500M quota in the other one.
When planning, don't assume that you will never use qtrees. Sure as the world some special project will come along that just begs for a qtree and you will need to let folks use the qtree who already own files elsewhere in the volume.
It's very easy to set up quotas using defaults. For each volume, I suggest creating a "users" qtree:
qtree create /vol/vol0/users
Now put these lines in your quotas file:
* user@/vol/vol0 - - (default user in vol unlimited) * tree@/vol/vol0 - - (default tree size unlimited) /vol/vol0/users tree - - ("users" tree size unlimited) * user@/vol/vol0/users 100M - (default user in "users" tree 100M)
Run "quota on"
Now add users to the "users" quota tree. Each one will be limited to 100M. You can override this with specific entries:
A user@/vol/vol0/users 500M - (user A in "user" tree gets 500M)
Then run "quota resize"
If you ever create a new qtree, just add these lines to the quotas file:
/vol/vol0/qt1 tree 10G - ("qt1" tree size is 10G) * user@/vol/vol0/qt1 - - (default user can have it all)
and run "quota resize"
The total size of qt1 is limited to 10G and each user in qt1 can use the whole thing. Of course, you could put in a limited user default, and you could override it with explicit entries:
* user@/vol/vol0/qt1 2G - (default user gets 2G) A user@/vol/vol0/qt1 - - (A can have it all) B user@/vol/vol0/qt1 500M - (B gets 500M)
If you are paranoid, you may prefer to set the default user quota for the qtree to zero. But then you need an explicit quota entry for each qtree user.
* user@/vol/vol0/qt1 0M 0K A user@/vol/vol0/qt1 - - B user@/vol/vol0/qt1 500M -
Why do this? Suppose user A makes a directory world writable. This lets any other user create files in there. Suppose user F, who should not be allowed into qt1, discovers this open directory and copies a bunch of files in there. F owns these files, so they are charged to F's quota in qt1, which is the default. If you set the default to zero then that prevents F or anyone else from sneaking files into qt1.
Steve Losen scl@virginia.edu phone: 804-924-0640
University of Virginia ITC Unix Support
Tom Reingold tommy@research.bell-labs.com writes
I believe it is not necessary to have quota trees in order to have quotas. But it is highly advisable. I highly recommend putting all user home directories in quota trees.
So do I, but not exactly for the reasons you give.
If you don't want to makefalse barriers, put all the users in a single quota tree. This will prevent a disaster. It's possible to have a disaster (well maybe the word is too strong) if your filer fills up. If it fills up, you could truncate an essential file such as /etc/passwd.
Not if safety-conscious procedures are followed when updating such files. But of course, a volume filling up can be a serious nuisance.
If the quotatree(s) add up to slightly less than the entire volume, then users will never fill up the filer.
True as stated, but in practice this will mean that your filer is under-utilised. The trick with quotas is _judicious_ overallocation. If you ensure that all your users working together cannot fill up the filer, you have overdone things: you just have to arrange that it would involve an improbably large conspiracy. :)
We put user home directories in a /home qtree, so that per-uid quotas can be made to apply only in that qtree (and the sum of the per-uid quotas is substantially larger than the size of the volume). There is a quota for /home as a whole, but with infinite limits; i.e. it's just for tracking usage. NFS access as root would escape all controls, but if this gets out the door we have a big hole in our security anyway!
Unfortunately, if existing directories are NOT in a quota tree, you have to move them into one. This can be extremely time consuming. I don't know a way around this. You may have to have a night where the filer is unavailable to users while you make the move(s).
To reorganise an already-populated volume like this is at least as painful as copying everything to a new volume. That's why it's worth advising NetApp-newbies to put everything (except /etc) into one or more qtrees from day one.
Chris Thompson Email: cet1 [at] cam.ac.uk
-
Chris Thompson -
Steve Losen -
Tom Reingold