Hello,

I've been reading through all the documentation, including Update Advisor, regarding upgrade from 8.1 family to 8.2. Management would like this done by the end of the year, so initially I was going to update to the lates p10 for 8.1. After reading everything, it seems 8.2.3(or 5) is really the only way to go, 8.1 is old and no longer supported.

While the documentation is pretty comprehensive, I just wanted to throw this question out to the people in the trenches and ask what 'Gotchas' I might anticipate. From what I've read, it is much more involved that staying in the same revision family, and my plan was to update the Management software (SnapManager, SnapDrive, etc) much earlier, as well as any firmware, to break up the migration in to digestible steps. I believe we can't do nondisruptive update, as we run CIFS for our drive shares. Is this assumption correct?

Any thoughts on your experience is greatly appreciated!

ONTAP Recipes: Did you know you can…? 

Easily Protect your FlexGroup volume in ONTAP 9.3

This recipe will show how to create a SnapMirror (or SnapVault/MirrorVault) relationship for FlexGroup volumes in ONTAP 9.3.

1. Open OnCommand System Manager. See if the volume is unprotected under “Volumes.” The volume we’re protecting is Tech_ONTAP (the Tech ONTAP podcast volume)

Clicking on the + sign will show more details.

2. Click on “Configuration” in the left menu, then on “SVM Peers” (for local snapmirrors) or “Cluster Peers” (for remote snapmirrors) if you haven’t already peered the source and destination. In this example, we’re peering SVMs to do a local SnapMirror.

3. Peer the SVM or cluster.

SVM Peering
Click “Create” and choose your SVMs. Click “Initiate SVM peering.” Within a few seconds, you should see “SVM peering successful.” Click done.

Cluster Peering
Cluster peering is needed if you plan on implementing an intercluster snapmirror. In OnCommand System Manager for ONTAP 9.3, this is done with “Cluster Peers.” Doing this also allows you to peer SVMs in the same configuration steps.

4. Next, click on “Protection -> relationships” on the left menu. Then click “Create.”

From here, go to the CLI – System Manager doesn’t currently support creating SnapMirror relationships for FlexGroup volumes. Create the destination volume. It must:

- Be type DP
- Have the same number of member volumes as the source FlexGroup
- Be the same size or greater than the source FlexGroup

The Tech_ONTAP FlexGroup has 8 member volumes and is 10TB in size.

This is the destination volume created. The destination volume must match the source volume’s member volume count and must be as large or larger than the source. Otherwise, a “geometry” error will be seen:

The FlexGroup spans a single aggregate and uses a multiplier of 8 to create 8 member volumes per aggregate. So, in this case, it’s a FlexGroup with 8 member volumes.

5. Decide on a snapmirror policy. You can apply a variety of policies to the mirror. For a DR SnapMirror, use “MirrorAllSnapshots.” If not specified, this is the default.

SnapVault/MirrorVault would use MirrorAndVault.

These are the specific policies and what they do:

6. Create the SnapMirror relationship.

7. Now, initialize the snapmirror. This will take some time, which will depend on the amount of data to transfer and the speed of your connection.

While you can’t currently manage a FlexGroup SnapMirror from System Manager, you can view it:

8. To make the mirror a SnapVault relationship (keeping more snapshots than just the ones on the source), modify the relationship policy to MirrorAndVault.

9. Consider also using a snapshot policy and label for your volume.

Note: Labels cannot be used with the async-mirror policy type.

The policy rules support only two combinations of these labels, either just “sm_created” or both “sm_created” and “all_source_snapshots”. The label is used to define the set of Snapshot copies that you want backed up to the version-flexible SnapMirror secondary volume. Other Snapshot copies on the primary volume are ignored by the version-flexible SnapMirror relationship.

Then, modify the volume to use the new policy:

10. Create a schedule to apply to the SnapMirror relationship using “job schedule create” and then apply it to your snapmirror.

Once a volume is successfully SnapMirrored, System Manager will show it is protected:

If using SnapMirror restore, keep in mind that the entire FlexGroup volume will get restored, not just files or single member volumes.

For more information, see the ONTAP 9 documentation center

For the last couple of days, the sis changelog on one particular volume that contains VMware datastores keeps filling up. We have several VMware datastore volumes and this is only happening on this one volume. It's one of the smaller ones at 250 GB. i re-run the volume efficiency start with -scan-old-data set to true to clear the error, but I can't figure out why it keeps occurring. This is an AFF system with inline dedupe/compression on, and scheduled dedupe which takes about 5 - 6 minutes. I did change the scheduled dedupe time to twice a day instead of once but that didn't clear the issue. Any ideas?

Hi to all.

FAS 2650 with ONTAP 9.1P2 updated to ONTAP 9.1P8

Two node in HA cluster.

On one node I have get next error after booting.

Uptime: 1m33s

PANIC: raid: Unable to find root aggregate. Reason: Unknown. (DS=76, DL=10, DA=33, BDTOC=0, BDLBL=0, BLMAG=50 BLCRC=2, BLVER=0, BLSZ=0, BLTOC=0, BLOBJ=0) in SK process rc on release 9.1P8 (C) on Tue Dec  5 14:34:12 GMT 2017
version: 9.1P8: Wed Aug 30 02:09:07 PDT 2017
compile flags: x86_64.optimize.nodar
Writing panic info to HA mailbox disks.
HA: current time (in sk_msecs) 31681 (in sk_cycles) 1852899501657506
DUMPCORE: START
Dumping to disks: 0b.00.7P2
....................................................................................................................................................................................................................................................................................................................

May be who know can I reset all nodes to the factory settings?

I want to get clean system and setup again.

I use netapp's XCP at our data migration project .

"xcp copy"  was succed ,and "xcp sync" was suceed too.

But some error occured when "xcp sync"  was done in a week .

Following error is written in a xcp.log .

xcp 2017-12-06 16:01:48 rescan 'Server:/cfs046a/xxx' ERROR: rescan 'Server:/cfs046a/xxx': 'rd.Dir3' object has no attribute 'parfh'

xcp 2017-12-06 16:01:48 rescan 'Server:/cfs046a/xxx' ERROR: Traceback (most recent call last):

  File "sched.pyx", line 579, in sched.Engine._runTasks (sched.c:14759)
  File "sched.pyx", line 1567, in sched.Task.run (sched.c:39275)
  File "../sync.py", line 1568, in gWhatsNew
  File "../idx.py", line 915, in getTargetPath
  File "../idx.py", line 885, in __init__

AttributeError: 'rd.Dir3' object has no attribute 'parfh'

What has happened?

This server has a lot of update data , Is that safe to retry " xcp sync" ?

ONTAP Recipes: Did you know you can…? 

Easily enable SAML Authentication for OCSM in ONTAP 9.3

Security Assertion Markup Language (SAML) 2.0 is a widely adopted industry standard that allows any third-party SAML-compliant identity provider (IdP) to perform Multifactor authentication (MFA) using mechanisms unique to the IdP of the enterprise’s choosing and as a source of single sign-on (SSO). 

There are three roles defined in the SAML specification:

• The Principal
• The IdP
• The Service Provider (SP)

In the ONTAP 9.3 implementation, a principal is the cluster administrator gaining access to ONTAP through OnCommand System Manager (OCSM) or OnCommand Unified Manager (OCUM). The IdP is third-party IdP software from an organization such as Microsoft Active Directory Federated Services (ADFS) or the open-source Shibboleth IdP. The SP is the SAML capability built into ONTAP that is used by OCSM or the OCUM web application.

Steps to enable SAML Authentication for OCSM in ONTAP 9.3:

1. Open System Manager using the cluster management interface (DNS name or IP address). https://cluster-mgmt-LIF

 2. Authenticate using administrator credentials.

Click Configuration > Authentication

3. Select the Enable SAML Authentication checkbox.

4. Configure System Manager to use IdP authentication:

• Enter the URI of the IdP.
• Enter the DNS name or IP address of the host system.
• Optional: If required, change the host system certificate to a CA-signed certificate.

5. Click Retrieve Host Metadata to retrieve the host URI and host metadata information.

6. Copy the host URI or host metadata details.

7. Click Save

8. Click Save and Confirm. Ensure that you have copied the host URI or metadata to the IdP and done the trust configuration on the IdP server. (Refer to your IdP documentation.)

The IdP login window is displayed.

9. Log in to System Manager by using the IdP login window. (You might see a prompt from the IdP stating that you are about to share specific attributes with the ONTAP cluster. You must allow sharing to occur for successful login.)

After the SAML IdP authentication succeeds, the session has a lifetime configured in the IdP. For other service providers (SPs) that use the same IdP, this allows the authentication to exist within the session lifetime period. If OCUM is one of the SPs that uses the same IdP, access to OCUM is allowed without an additional authentication. Thus, single sign-on (SSO) is enabled.

Steps to enable SAML Authentication for OCUM 7.3:

1. Ensure that you have network connectivity between OCUM, the IdP, and OCUM web clients.

 2. Launch the OCUM web GUI.

 3. Authenticate using maintenance user credentials.

 4. In the upper-right toolbar, click the gear icon and select Authentication in the left Setup menu.

 5. If you haven’t enabled remote authentication, you must do so for SAML IdP users to have access to OCUM:

• Select the Enable Remote Authentication checkbox.
• Set the authentication service to Active Directory or OpenLDAP (Microsoft Lightweight Directory Services is not supported).
• Enter the administrator name and password. For AD, specify Base Distinguished Name; for LDAP, specify Bind Distinguished Name, Bind Password, and Base Distinguished Name.
• In the Authentication Servers section, enter the authentication server’s DNS name or IP address.
• Use Test Authentication to ensure that Remote Authentication Settings are operational.
• Navigate to the Settings > Management > Users Page and add users of type remote user or remote group with the OnCommand administrator role.

6. Navigate to Settings > Setup > Authentication > SAML Authentication Page.

7. Click View Host Metadata, copy the metadata into a file, and save it. This file will be used to configure OCUM in the IdP.

8. Select the Enable SAML Authentication checkbox, enter the IdP URL, and click Fetch IdP Metadata to populate OCUM with the IdP data.

9.Click Save and Yes in the warning dialog box.

10. Wait 5 minutes for the OCUM services to restart.

11. Configure the IdP (refer to your IdP documentation).

• Populate the IdP with the OCUM metadata from step 7.
• Add OCUM as a Relying Party.
• Add claim rules. Set Name to urn:oid:0.9.2342.19200300.100.1.1 and Unqualified Name to urn:oid:1.3.6.1.4.1.5923.1.5.1.1.

12. Launch the OCUM web GUI and get redirected to the IdP for authentication

13. Authenticate using a remote user defined in step 5 above

As in the OCSM section, after the SAML IdP authentication succeeds, the session has a lifetime configured in the IdP. For other SPs that use the same IdP, this allows the authentication to exist within the session lifetime period. If OCSM is one of the SPs that uses the same IdP, access to OCSM is allowed without an additional authentication after a successful OCUM authentication

For more information, see the ONTAP 9 documentation center and the OCUM 7.3 documentation.

Hi all

Is ip fastpath still used on c-mode (9.2)?  can't find it in the docs.

If so, what are the commands to turn it on/off and check its working.

Thanks

Problem Summary: Ontap 9 OVF from website fails to deploy on VMWare Workstation

1.Please find attached the screenshots showing error when the ovf fails to meet criteria

2.Tried doing the following:

a.manually extracting the ovf and further extracting the 4 disk files

b.Creating a new VM and attaching these as IDE hard disks

c.Not missing a floppy/serial port as these cause no boot up or hung boot up

d.Still face the attached errors:

-You do not have write access to a partition.

-g_vfs_done error=5

Info-only the 8.x series which are in compressed tgz format seem to work

Hi All,

Hope everyone doing good !!!

I've to renew the SSL ceritificates in my environement for most of the AFF and 8080 systems. Since I haven't done this in past looking for some assistance here.

For each cluster there are 5-6 vservers,  assuming SSL certificates are to be renewed on every vsevers.  Need to know following,

1. Will there be any downtime on vserver NFS services while deleting the current certificates.

2. Do I need to download the new certificate files into cluster as like ONTAP images

Hi All,

I'm doing migration from 7-mode to cDot through snapmirror . 

There are 1000s of volumes and bigger challanges is to apply the user  quota for all of them after migrtaion as it's very much required to control usage. Could someone please suggest how to reapply quotas after migration on below scenarions

1. Same volume name as like 7-Mode

2. Different volume name in 7-mode and cDot

As for as I know 2nd scenario would need manual efforts, looking for some hint to reduce work load..

Happy learning!!

Hello,

Deployed an Ontap Select instance with the deploy utility, a simple AD/DNS on a Windows 2012 R2 VM, but when I try to create a CIFS SVM, it fails when trying to add it to the domain, with the following error:

Data ONTAP API Failed: Failed to create the Active Directory machine account "DATA1CIFS". Reason: SecD Error: no server available Details: Error: Machine account creation procedure failed [ 0 ms] Trying to create machine account 'DATA1CIFS' in 'POC.TEST' for Vserver 'Data1' [ 10] No servers configured for the service: _ldap._tcp.POC.TEST [ 10] No servers found in DNS lookup for _ldap._tcp.POC.TEST. [ 10] No servers available for MS_LDAP_AD, vserver: 2, domain: POC.TEST. [ 10] Cannot find any domain controllers; verify the domain name and the node's DNS configuration **[ 10] FAILURE: Unable to connect to any (0) domain controllers. [ 10] 'NisDomain' configuration not available [ 10] NIS configuration not found for Vserver 2 [ 15] No servers found in DNS lookup for _ldap._tcp.dc._msdcs.POC.TEST. [ 17] No servers configured for the service: _ldap._tcp.POC.TEST [ 18] No servers found in DNS lookup for _ldap._tcp.POC.TEST. [ 21] No servers found in DNS lookup for _kerberos._tcp.POC.TEST. [ 21] No servers available for MS_LDAP_AD, vserver: 2, domain: POC.TEST. . (Error: 13001)

DNS is working if I logon to the node, I can ping the AD VM:

OnTapPOC::> ping -s WindowsAD1
PING WindowsAD1.poc.test (10.127.196.230): 56 data bytes
64 bytes from 10.127.196.230: icmp_seq=0 ttl=128 time=0.145 ms
64 bytes from 10.127.196.230: icmp_seq=1 ttl=128 time=0.211 ms

Any idea?

Thanks.

Hello

There used to be some greate commands in 8.X

for example:

system health node-connectivity shelf show  -node * -num-paths <3

Any idea where a simialr command is in ontap 9.X

Thanks

Ian

Hello,

I am doing some quota configuration and noticed the data that was copied from our old nas is not part of the total usage assigned to that particular user.

Let say I have a user name test1.  He has 65 GB of data transferred from old nas.  I set a new quota for him and at 70 GB (hard limit).  When I created new files on the volume, it seemed like the number starts out at 0 GB and ignored the previous 65GB.

Does resize the quota correct this?

Come to think about it, calcuation of quota moving forward makes sense.

Thanks,

TT

Hi all

I have a customer who is using StoreVault Data ONTAP 7.2 and is using it to serve CIFS shares to Enterprise Vault.

ONTAP has lost its connection to AD. We have deleted the computer account, and re-added using cifs setup successfully - however it required a pre-staged computer account to work, plain vanilla cifs setup didn't work.

When we try now to access the shares we get errors like:

Cannot authenticate with server.

ser or Service not found in Kerberos database

UTH: SPNEGO- Error looking up SID: STATUS_NONE_MAPPED (0xc0000073)..

These messages are repeated for each DC.

cifs testdc doesn't reveal anything wrong.

cifs domaininfo shows connectivity ok but status of "PDCBROKEN" next to each DC.    (However, the PDC emulator DC is okay!)

I have tried cifs trace to gather more info which reveals the errors above.

DNS, time, timezone = all okay.

Any ideas would be appreciated!

Thank you in advance

Marcus

This is simply to ask you to review your configuration before upgrading to Ontap 9.2, still upgrade, just check first.

I discovered an issue just over a month ago, after an upgrade to Ontap 9.2.  It has now been confirmed by NetApp, but its not a bug, just a change in network stack that changes the way it routes particular protocols.  

Had the change to the Ontap OS been known, I would have made infrastructure changes before the upgrade, rather than having to raise support tickets and now have to make changes to to restore resilience to our infrastructure.

I will state that I have been very impressed with the performance of the new all flash NetApps and with the exception of one major bug, the systems have been bullet proof in general operation on our environment for the last year.

NetApp have removed a feature called “Fastpath” from Ontap 9.2, this feature stores the interface of each incoming network packet and ensures it goes back out the same interface.  This was originally implemented for performance as it saved the time of checking the routing table. This feature has enabled servers to send storage traffic to any NetApp virtual interface and teh packet would egress from the same interface irrespective of the network infrastructure.

During the upgrade to 9.2 we had several outages and lost monitoring from On Command Unified Manager, we restored monitoring by moving OCUM to another subnet but we had to live with some loss of NFS resilience until we had confirmation of the cause..

Though each virtual interface still has a profile (data, management, intercluster, etc.) for incoming traffic, the response packet can go out through any interface within the same SVM and now uses the routing table.

The loss of monitoring from OCUM was caused by the https responses from polling via the cluster management interface, leaving the NetApp via an intercluster interface, which happened to be on the OCUM server’s subnet.

NFS issues were caused by using a NAS interface on the same node as the SVM admin interface, once I realised we moved all servers NFS to the node without the admin interface.

A new feature of Ontap 9.2, a tcpdump like command, allowed viewing traffic in wireshark and confirmation of the asymmetric routing from the netapp side.

We are now in the process of moving intercluster and admin interfaces to their own subnets.  Hopefully upon completion 9.3 will be GA and we can gain some more space back.

After disable ADP or remove ADP is it required to install the software.

‎

‎

ONTAP Recipes: Did you know you can…?

Easily create a NAS Application Container

To create a NAS Application Container for use over NFS without compromising application or overall system performance, follow these steps in OnCommand System Manager:

1. Select the SVM.

2. Click Applications & Tiers.

3. Click Applications.

4. Click Add an Application.

5. In the “General Applications” Add NAS Container page, specify the following:

• application name
• size
• storage service level

The floor and ceiling IOPS values adjust automatically based on space capacity used by the application.For a 1TB application with “Value” specified, the floor and ceiling start at 128 IOPS. As more space is used by the application the ceiling increases to a maximum of 512 IOPS.

6. Select NFS as the protocol used to access the application.

7. Set the host IP addresses that will access the application.

After creation, details of the application components will be displayed in the System Manager summary.

For more information, visit the ONTAP 9 Documentation Center.

Did you know you can...

Configure Oracle ASM with multiple LUNs oer disk group?

Oracle ASM allows for disk groups to be created which span multiple disks or LUN’s. ONTAP LUN’s will appear as Disk Paths in the ASM Configuration Assistant.  Multiple LUN’s can be assigned to ASM Disk Groups to improve performance when using ONTAP 9.3. 

This recipe describes how to assign multiple LUN’s to an ASM Disk Group:

1. Using the ASM Configuration Assistant, click on the Disk Groups tab.

2. From the Disk Groups tab, select “Create” to launch the “Create Disk Group” window.

3. In the “Create Disk Group” window, enter a name for the new Disk Group in the Disk Group Name field. In our case, we assigned 32 LUN’s to the Disk Group named ORA_DATA.

4. In the “Redundancy” pane, select desired Oracle Redundancy. In this case, we selected External (None) as extra redundancy was not needed for this database.

5. in the “Select Member Disks” pane, check the box for each disk path you wish to use. (The Disk Paths displayed are your previously defined LUN’s visible from your Oracle host.)

6. Click on the “Advanced” button at the bottom of the “Create Disk Group” window to display the “Disk Group Attributes”.

7. In the “Disk Group Attributes” pane, select 64 as the “Allocation Unit Size (MB)”.

8. Click “OK” to create the Disk Group. A window will pop up with the message “Disk Group created successfully.” Click “OK”.

See related Recipe to create an Oracle RAC Application on SAN:

https://community.netapp.com/t5/Data-ONTAP-Discussions/ONTAP-Recipes-Easily-create-an-Oracle-RAC-Application-on-SAN/m-p/132293