Active-Active VM Storage at Datastore Granularity: SnapMirror Active Sync meets ONTAP tools Granular Datastore Protection 

The two things to remember 

1. Active-active with synchronous SnapMirror (SnapMirror active sync / SM-as) — ONTAP TOOLSONTAP tools Granular Datastore Protection (GDP) lets you hand-pick VMFS-FC or VMFS-iSCSI datastores inside an ESXi host cluster and protect them with zero recovery time objective (RTO)/zero recovery point objective (RPO)replication backed by ONTAP SnapMirror Active Sync. VMs can read and write from either site. 
2. Load balancing across sites: Workloads can actively use I/O from either location.  
3. With uniform host proximity, peered datastores at both sites are mapped to ESXi hosts at both sites. If one ONTAP cluster becomes unreachable, VMs continue serving I/O from the surviving site with typical failover latency on the order of ~11 ms (the actual I/O resumption time [IORT] will be environment-dependent).  
4. With non-uniform host proximity, ESXi hosts are only mapped to the local copy of the datastore. I.e. If a VM migrates or fails over to a host on the other site, that host only accesses the local ONTAP cluster. If one ONTAP cluster becomes unreachable, the VM will use vSphere HA to failover to the other site since it can only access its local copy.  

Everything else in this article explains how ONTAP tools 10.6 provisions and governs that experience. 

Why GDP changes the protection conversation 

Before ONTAP TOOLS 10.6, Host Cluster Protection (HCP) was all-or-nothing: protecting a cluster meant protecting every eligible VMFS datastore on that cluster together. 

Granular Datastore Protection (GDP) shifts the unit of protection from the host cluster to individual VMFS datastores — while still operating within a single ESXi host cluster boundary. 

Customer value: Protect only the datastores that matter, add/remove datastores over time, and run different SnapMirror targets per SVM, without forcing every datastore in the host cluster into the same protection group. 

What ONTAP SM-as brings to GDP 

SnapMirror Active Sync (SM-as) is ONTAP’s synchronous, active-active replication mode used by the Automated Failover Duplex (AFD) policy. Combined with GDP, it delivers: 

• RPO = 0 — writes are synchronously committed to NVRAM on both sites before acknowledgment 
• RTO = 0 — because both copies are always available, IO can resume as soon as the mediator initiates the failover and the host multipath driver can retry any required I/Os 
• Active-active data path — both copies are read/write capable (policy and proximity permitting) 
• Consistency group (CG) backed protection — multiple LUNs/datastores in one atomic replication unit 
• Automatic host access orchestration — ONTAP TOOLS manages igroups, LUN maps, mounts, and HBA rescans 

GDP is the ONTAP TOOLS control plane; SM-as is the ONTAP replication engine. ONTAP TOOLS creates and lifecycle-manages: 

• Protection Settings — which datastores are protected, CG membership, SnapMirror relationship 
• Cluster Configuration — fault domains, host-to-SVM mapping, uniform vs non-uniform proximity 
• Initiator groups (igroups) — host IQNs/WWPNs mapped to protected LUNs at each site 

ONTAP TOOLS 10.6 constructs that you configure 

1. Protection Setting 

A protection group ties together: 

• One or more VMFS datastores (same host cluster, same SVM) 
• An ONTAP consistency group 
• A SnapMirror Active Sync relationship (for AFD) 
• Initiator groups for host access 

Typical workflows: Protect · Modify (add/remove datastore) · Unprotect · Delete 

2. Cluster Configuration (required for AFD / SM-as) 

Maps an ESXi host cluster to two fault domains (Site A / Site B): 

• Each fault domain lists ESXi hosts + peered source/target SVMs 
• The uniform_host_config attribute is set at create time and is immutable 

The following table illustrates the two protection constructs. 

Prerequisite: Create Cluster Configuration before protecting datastores with AFD/SM-as. Async-only SnapMirror does not require cluster configuration. 

Uniform vs Non-Uniform Host Proximity 

This is the architectural fork that determines the system behavior during various modes of failure in different fault domains. 

Uniform proximity (uniform_host_config = true) 

Behavior: Peered datastores from both sites are mapped to ESXi hosts at both sites. All hosts in the cluster can access all protected datastores. ONTAP TOOLS manages igroup replication and host proximity settings across both SVMs. 

Use cases: 

• Active-active workload distribution — VMs on either site issue I/O to locally mapped LUNs based on proximity settings 
• Metro / stretched cluster — compute at both sites, storage synchronously mirrored 

How does GDP use SMas to protect you in different failure scenarios: 

• Storage cluster failure — IO continues without vSphere HA by using remote copy 
• Storage network failure on local target side of network — IO continues without requiring vSphere HA by using the remote copy 
• Storage network failure on local initiator side of network — A vSphere HA event triggers automatic recovery on the remote site with VM reboot 
• Compute failure — vSphere HA reboots VM on an applicable ESXi host based on resource availability. Affinity and anti-affinity rules may dictate which site the VM is rebooted on 
• Full site outage — VM’s on the failed site are rebooted and recovered by vSphere HA on the surviving site, and I/O is resumed; typical switchover latency ~11 ms (lab/field reference; actual depends on distance, network, and load) 

Non-uniform proximity (uniform_host_config = false) 

Behavior: Peered datastores are mapped only to hosts locally within each site. Site A hosts access Site A SVM LUNs; Site B hosts access Site B SVM LUNs. Replication is still synchronous (SM-as), but with a reduced number of non-disruptive failure scenarios at the VM layer. For this reason, uniform configurations are considered the best practice when the environment can support it. 

Use cases: 

• Campus / dual-room: each room’s hosts only access their local copy 
• Optimizing limited WAN bandwidth: eliminating host network traffic between failure domains 
• Reduced SAN path management: hosts cannot see remote paths 
• Sync DR with site affinity: zero data loss 

How does GDP use SMas to protect you in different failure scenarios: 

• Storage cluster failure — A vSphere HA event triggers automatic recovery on the remote site 
• Storage network failure on target side of network — A vSphere HA event triggers automatic recovery on the remote site 
• Storage network failure on initiator side of network — A vSphere HA event triggers automatic recovery on the remote site 
• Compute failure — vSphere HA reboots VM on applicable ESXi host based on resource availability. Affinity and anti-affinity rules may dictate which site the VM is rebooted on 
• Full site outage — VM’s on the failed site are recovered by vSphere HA on the surviving site, and I/O is resumed; typical switchover latency ~11 ms (lab/field reference; actual depends on distance, network, and load) 

Side-by-side comparison 

End-to-end user flow: from datastore selection to protected active-active 

GDP use cases (where customers win) 

Version and platform guardrails (ONTAP TOOLS 10.6) 

Supported 

Not supported in 10.6 

• NFS and NVMe datastore protection 
• Sync / strict-sync policies outside AFD SM-as scope 
• Local snapshot policies for GDP workflows 
• Protecting datastores across different SVMs in one protection setting 
• Moving a datastore between protection groups (unprotect + re-protect required) 
• Custom async SnapMirror policies 
• MetroCluster-backed configurations 
• ONTAP clusters with > 4 nodes 
• Mixing uniform and non-uniform protection on the same host cluster 
• Protection failover initiated from ONTAP TOOLS UI (use ONTAP System Manager) 
• ONTAP TOOLS discovering CGs / SnapMirror created outside ONTAP TOOLS (CLI/SM) 

Operational guardrails customers should know 

Host proximity and igroups — what ONTAP TOOLS automates 

When you protect a datastore, ONTAP TOOLS 10.6: 

1. Creates or extends an ONTAP consistency group spanning the protected LUNs/volumes 
2. Establishes SnapMirror Active Sync to the peered SVM 
3. Creates nested igroups (parent per datastore, child per host) with host IQNs/WWPNs from participating sites 
4. For uniform AFD: replicates igroups across sites so all hosts retain access 
5. For non-uniform AFD: creates site-local igroups mapped to local fault-domain hosts 
6. Mounts peer datastores and rescans HBAs when topology changes (cluster config modify) 

You do not manually patch igroups for GDP lifecycle operations — ONTAP TOOLS owns add/remove host, mount, unmount, and shrink flows. 

Deeper dive, what happens when a complete site or failure domain goes down? 

Uniform proximity + SM-as 

• Both copies were actively serving I/O 
• SM-as maintains synchronous consistency 
• ESXi hosts at the surviving site continue I/O on the accessible LUN paths 
• Expected: I/O continuity with failover latency typically in the ~11 ms range (not a guaranteed SLA — validate in your environment) 

Non-uniform proximity + SM-as 

• Source-site hosts were actively using local LUNs; target site held the sync replica 
• RPO remains 0 — no committed write loss 
• RTO is non-zero — DR-site hosts (or orchestrated failover) must establish access via igroup/mount/rescan workflows 
• ONTAP TOOLS cluster configuration modify / protection discovery may be needed after topology events 

Quick decision guide 

Summary 

ONTAP SnapMirror active sync provides the synchronous, active-active replication engine. ONTAP TOOLS 10.6 Granular Datastore Protection provides the VMware-native control plane to: 

• Hand-pick which VMFS datastores to protect inside a host cluster 
• Model uniform or non-uniform host proximity via Cluster Configuration 
• Lifecycle-manage consistency groups, SnapMirror, igroups, mounts, and rescans 

Key Takeaways  

Active-active sync SnapMirror: GDP + SM-as delivers zero-RPO, dual-site VMFS protection at datastore granularity. 

Load balancing: SnapMirror active sync enables both sites to actively serve I/O, maximizing resource utilization with best of breed business continuity on failure. 

Hi,

I am trying to set Remote Authentication using Active Directory, but despite configuring with relevant information, I am getting error as attached when performing Test Authentication.  Any help will be greatly appreciated. 

Thanks & regards,

Hello,
My customer noticed a latency spike in their cluster, reaching 40ms in Grafana, and raised a support case. 
However, the NetApp support observed latency of around 25ms from the performance archive logs they shared.
I need help identifying the cause of this discrepancy.

- Grafana : v7.5.17 (84411794f3)
- ONTAP : 9.12.1P11

Last year we generated a CA-signed cert for ActiveIQ Unified Manager for the first time. We followed the procedure below and it went fine.

https://docs.netapp.com/us-en/active-iq-unified-manager/config/task_install_ca_signed_and_returned_https_certificate.html

Now we need to renew it, however there don't appear to be any clear instructions on how to renew a CA-signed certificate for AIUM. The following link takes you to articles on how to generate/install a CA-signed cert, renew a self-generated cert, and install/renew a CA cert for System Manager - but nothing about renewing a CA-signed cert for AIUM. Can anyone provide insight into the correct procedures? We've tried a mixture of steps from the articles linked below but nothing is working so far.

https://kb.netapp.com/data-mgmt/AIQUM/AIQUM_Kbs/Active_IQ_Unified_Manager_Certificate_Regeneration_and_Importing_Resolution_Guide

Dear community,

the following entry can be found in the event log of our FAS2750 (ONTAP 9.13.N)

"mgmtgwd.certificate.expired: A digital certificate with Fully Qualified Domain Name (FQDN) nnnnnnnn-911f-47c7-b1c1-nnnnnnnnnnnn, Serial Number nnnnnnnn, Certificate Authority 'nnnnnnnn-911f-47c7-b1c1-nnnnnnnnnnnn' and type client for Vserver FASxxxxxx has expired."

The certificate has expired and is no longer needed because the affected AIQUM host no longer exists and has been replaced by another one (with new hostname).

The problem is that the certificate cannot be deleted because the old AIQUM host no longer exists:

The certificate could not be removed due to the following conflicts: The certificate issued by "nnnnnnnn-911f-47c7-b1c1-nnnnnnnnnnn" with serial number "nnnnnnnn" is in use by the rest-api EMS destination "hostname-bbbbb-de_server" and cannot be removed.

The listed destination no longer exists - how can I delete the certificate entry anyway?

Any Idea?

Thanks

Best regards

Michael

Postman is a REST development and command testing tool to allow developers and administrators build new commands for administration and provisioning. To utilized the drag and drop capabilities / double click capabilities to quickly build out new REST commands the Swagger template from the API Server can to be installed as a collection. 

Here are the steps required to import the Swagger JSON as a template into Postman collection. 

1. Install Postman

        Postman per platform can be found at https://www.getpostman.com/

 2.  Install API Services

       API Services can be found on the netapp support site

      This document assume the use of default ports if you are not using default ports you will need ot ajust things as required.

 3.  On the API Server go to this address

      https://{Servers NAME or IP}:8443/swagger.json

      You will want to select all data in the body and save it to a local text file.

4.  Modify the Second line of the file Add the following on the second line

<tab>”host”: “Server Name or IP :8443”

Save Document as NetApp_API.json

Launch postman

In the upper left corner of postman Click import.

Drag and drop file to the import screen.

On the 3 dots next to the OnCommand API Services … click the edit command.

Click Authorization

Select Basic Authentication.

Update the Username and the password for your API Services server.

You can now browse and use commands with API services.

Hi guys,

my appliance crashed and is unable to boot.

I tried a few times but it always stops with "fsck died with exit status 4".

I need the root pw to run fsck manually.

My "admin" / "maintainance" password is NOT working as root password.

First respone from NetApp support was

"The root account is disabled by default in the UM 6.x virtual appliance, and the password for the root account is not known to NetApp Support."

Although I said 7.1RC1 but anyway.

I doubt nobody knows the root pw or at least how to enable and reset it.

Hopefully somebody here can help me out.

Thanks!

-----

I fixed it by booting from a linux live OS iso and ran fsck there.

Still having the root pw would be easier.

Dear Community,

I have DFM 5.2.2.26328 running in two servers and connected to the same NETAPP filers running ontap 9.8 version 

one server am able to auto discover everything including LUNS but emails are not working 

seconds server emails are working fine but am not able to discover LUNS system is always showing no data available on the server 

I compare everything between the two servers all showing identical 

Any idea what could be the reason if any one was facing the same in the past ?

Hi NetApp community,

as you know, you could configure a quota notification setting in OnCommand Unify Manager 5.x where it sends email alerts directly to the user who reached a quota soft/hard limit.

Unfortunatly this email would only be send one time.

Do you have any idea to repeat this notification email?

For example, send an email once per day to the user who reached the limit, as far as he clean up his share?

Thanks a lot in advance.

Thanks & Best,

Michael 

OCUM 7.2 to 9.4 upgrade fails stating.

Error: The Wizard was interrupted before On command Unified Manager could be completely installed.

Noticed this error under event viewer: InnoDB: Table mysql/innodb_index_stats has length mismatch in the column name table_name. Please run mysql_upgradeFor more information, see Help and Support Center at http://www.mysql.com.

Can somebody help with the resolution, as it's EOS ,can't raise a NetApp ticket.

Hello,

we are using AIQUM 9.10. 

Is it possible to mark events in AIQUM so that they are no longer displayed.

Background:
We always get events like this: "Audit Log Disabled" on some SVM. The message is correct, but audit log must not be enabled there (because of the staff council). - There are also other similar events that should not be displayed.

If you set them to "acknowledged" they stay in the list forever, if you set them to "resolved" they reappear later again..

What can be done to prevent such a message from constantly reappearing?

Thanks a lot

Michael

I am looking for the REST API calls for all RW volumes seen by AIQ-UM sorted by cluster

Hello there !

I'm using a Powershell script used by ActiveIQ Unified Manager Alerting system that connect to Unified Manager server using SDK and send the information to our Centreon monitoring server using an HTTPS web request.

I have noticed that I can reach the Centreon Web server normaly once I create the NetApp object "NetApp.Manage.NaServer".

I think the creation of this object modify the way to connect using Invoke-WebRequest cmdlet ...

Can I set back the default settings at the end of my script in order to be able to use Invoke-WebRequest properly ... ?

Any idea ?

I am trying to create what I assume should be an extremely simple view in ActiveIQ Unified Manager - a list of every volume with a column showing the current volume sizes. My intent is to browse through and look for volume with odd sizes, which indicates autogrow has kicked in, so I can manually inspect and possibly resize / reconfigure them.

I added the "Total Data Capacity" field. For most volumes this field shows full volume size, but for extremely tiny volumes that are 1GB (mostly root volumes) it shows Total Data Capacity of 973 MB instead of 1GB. When looking in System Manager, it shows correctly as 1GB. I spent a long time thinking the whole list was invalid until I scrolled down and saw that the rest were fine. Is this a bug/glitch in AIUM or am I missing something?

Hi,

I'm trying to build some saved searches in AIQUM but have run into the problem that there isn't a "not" option for some choices.  Allow me to 'splain.

I want to report on all volumes owned by an SVM that are not mirrored (protected) BUT I'd also like to NOT show some volumes in this report because they don't need to be protected.  I.E. they are exchange or MSSQL instances that have replicas in other datacenters, therefore do not need protection.  Just chekcing here here, there's no way to to show some volumes and NOT others, at least by name, right?

There are multiple instances of Active IQ Unified Manager 9.7P1 installed in different locations for our company but cant find why only of the installations keeps logging out if we try to load something that has a lot of information, like performance view of aggregates, volumes or just list events at times. Click on the option like Aggregates on the left pane and the screen shows as though it is loading something then blanks and logs out right away. Tried with different user accounts with different permission levels. Couldn't find any relevant articles related to this problem anywhere. 

As mentioned this happens to only of the installations strangely. Checked the ocum logs to see any weird behaviour couldnt find any traces of the log out operation at all, in fact all the logged in events and the API calls to list the pages requested are mentioned. Appreciate if some one could advice how to figure out what is happening here. 

Dear Community Experts,

We are using oncommand unified manager 9.5 version and there is no inbuilt headroom dashboard or reports on OCUM.

We see there is an option in OCI about the headroom report. We tried to build the custom report using existing MYSQL database tables and need some insights about the reference DB tables associated with getting the desired headroom report.

Is there any product documentation or info about the mappings of existing dashboards with backend DB tables. We are actually trying to leverage the inhouse tool for creating custom reports for which we need to understand the existing tables and give information to other teams about the required tables to parse to get the desired result. We don't have direct access to the report tools(like Tableau, IBM Cognos) to play with the OCUM Mysql DB data.

I am actually trying in the Simulator environment to check the OCUM performance DB tables and trying to write the custom queries. I have gone through general TR documents related to OCUM DB and reporting.

Any inputs are highly appreciated.

Regards,

Krishgudd

Hello folks, please help me.

I don't get LDAP running in Grafana. Let me aks few questions, please?

How do I need to login in Grafana "domain\user", or "user@domain", or just "user"

I have in my base DNs spaces, such as "cn=Frank Schubert". Do I need to escape them somehow?

How can I check in CLI if auth is working? 

Would realllllly appreciate help...

regards Frank

Hi All,

Wondering if anyone had the same issue, Tried to upgrade one of our virtual appliance OCUM 7.3P1 to 9.5P1  Notice Java didn't get install during the upgrade. Due to no Java OCIE doesn't start.

ul 16 12:41:08 cmsempocump01 ocie[1033]: Starting NetApp OnCommand Insight Essentials Server service: ocie/opt/netapp/essentials/jboss/bin/twiddle.sh: 46: exec: java: not found
Jul 16 12:41:18 cmsempocump01 ocie[1033]: /opt/netapp/essentials/jboss/bin/twiddle.sh: 46: exec: java: not found
Jul 16 12:41:28 cmsempocump01 ocie[1033]: /opt/netapp/essentials/jboss/bin/twiddle.sh: 46: exec: java: not found
Jul 16 12:41:38 cmsempocump01 ocie[1033]: /opt/netapp/essentials/jboss/bin/twiddle.sh: 46: exec: java: not found

After 60 mins  its timed out

Jul 16 13:41:06 cmsempocump01 systemd[1]: ocie.service: Start operation timed out. Terminating.
Jul 16 13:41:06 cmsempocump01 systemd[1]: ocie.service: Main process exited, code=killed, status=15/TERM
Jul 16 13:41:06 cmsempocump01 systemd[1]: Failed to start LSB: OnCommand Platform Server.
Jul 16 13:41:06 cmsempocump01 systemd[1]: ocie.service: Unit entered failed state.
Jul 16 13:41:06 cmsempocump01 systemd[1]: ocie.service: Failed with result 'timeout'.

I just installed OCUM 6.1 and I am trying to add some clusters.  I added the first one without a problem, but when I tried to install the second one it complained that the self signed certificate had expired.  Sure enough I logged on to the cluster and the certificate was expired.  I used the following command to create a new certificate:

security certificate create -vserver add-n1-nas2 -common-name add-n1-nas2.cert -expire-days 365 -type server

Unfortunately I still received the error that the certificate was expired.  I figured it was still using the older certificate so I deleted the old one.  Apparently that was a mistake, because now OCUM is simply stating "Cannot establish communication to the host <IP> over SSL".  I tried disabling and enabling the "portal" and "ontapi" web services, (hoping that would restart the web server) all to no avail.

Anyone have any ideas what is going on?  And/or what to look at to figure this out?

Thanks,

Keith

Hi,

I am wondering how to generate PDF reports in AIQUM where it summarizes (totalize) data on the columns.

If I generate a space consumption report, there's no total space consumed in the report. I thought that this would be a basic item on a report.

What am I doing wrong?

Regards,

Pedro Rocha.

Hello

I followed KB ID HO83 (Answer ID 1029768) to get access to mysql on OCUM VM appliance. But I get access denied error

ERROR 1045 (28000): Access denied for user 'diag'@'localhost' (using password: NO)

OCUM 9.4 on ESX

What do I do wrong?

Thank you

Jan

Just upgraded to 9.6P1 and trying to recreate a custom scheduled report using a domain user account. I can save the custom view, but not retrieve that view (it just hangs) and eventually even the save fails. Switched from domain user to the admin user and it is working. The domain user is identified as an Administrator to OCUM. Host server is Windows 2016. Browser is Chrome on Windows 10.

In the ocumserver.log, the only thing I see are messages like this, where xxxx is the user name. Also admin is in that log:

ERROR [xxxxxxxx] [default task-20] [c.n.i.d.resource.ProtectionRoleType] Failed to find ProtectionRole with name: NOTAPPLICABLE

ERROR [admin] [default task-20] [c.n.i.d.resource.ProtectionRoleType] Failed to find ProtectionRole with name: NOTAPPLICABLE

ERROR [admin] [default task-25] [c.n.i.d.resource.ProtectionRoleType] Failed to find ProtectionRole with name: NOTAPPLICABLE

There are various task numbers.

Any tips?

Beth

Hi all

Can i forward syslog messages from OCUM or OCPM to a remote syslog server ?

Thanks

I am trying to view the Harvest collected data with grafana AND our influxdb backend instead of a real graphite.

Influx has a graphite interface that I use to send data but my problem is that I cannot do proper templating in grafana....the provided .json dashboards have templating already definded in a way influx doesn't understand.

Anyone already successfull in changing the templating in grafana for those dashboards so they work ? Do I have to use the templates in influxdb.conf to make it work (kind of map) ?

Hello community,

we have made an upgrade from OCUM 9.5 to AIQUM 9.7. According to the documentation (https://docs.netapp.com/ocum-97/index.jsp), self-created BIRT (.rptdesign) reports should be able to be used further.

However, the existing reports are not available in 9.7 (the same with an upgrade to 9.6).

Where can I find the reports? 

Thanks a lot

Best  regards

Michael

Hi All,

Does anybody know how I can see a report with the LUNs created using OCUM ?

I couldn't find the igroup information even using BIRT to create a custom report.

Best Regards,

Vinicius Calori Aurelio

NetApp Brazil

I am currently using click-a-tell service to let OCUM send out the alerts as SMS but it's not an ideal solution as the alert you get is bit generic and not specific eg. It tells you that a volume is full but does not tell you which volume.

I was wondering if there is a better solution out there which give more specific alerts.

Please share if you are using a better one.

Thanks in advance

KS