About mjschneider

mjschneider · ‎2017-06-27

It appears that auto-snapshots-enable is "non-modifiable". <volume-snapshot-attributes>  <auto-snapshots-enabled></auto-snapshots-enabled>  <snapdir-access-enabled></snapdir-access-enabled> </volume-snapshot-attributes> That at least explains why it didnt change it, not sure if there is an alternate api call for it though.

mjschneider · ‎2017-03-22

I would first try to generate a new certificate on one of the failing systems and make sure it's key length is the max (2048 i think). The python standard libraries disabled handshake's with key lengths shorter than 1024 (i believe that theres a bug where it actually only works with 2048 key lengths) a few years ago; version i think was somewhere around 2.6.9 or so. You may also need to add to the default cipher list as i mentioned in my post above. I believe the order maters. During my troubleshooting i has also installed the following packages, though i cant confirm if they contributed to my success: pip install requests[security] urllib3 As a fall back, i have a python 2.6.6 install that i use to verify its not something more than the cert. Hope that helps.

mjschneider · ‎2017-03-09

This works for python 2.7 as well. In my scenario i have netapps using TLS or SSLv3, so i created a seperate NaServer.py which specified SSLv3 instead: connection = httplib.HTTPSConnection(server, port=self.port, timeout=self.timeout, context=ssl.SSLContext(ssl.PROTOCOL_SSLv3)) Then in my phython script i import both as such: from NaServer import * import NaServer_SSL3 Then just have a simple boolean variable that i set to use the other library: def na_setup(netapp, sslv3=False): if sslv3: ss = NaServer_SSL3.NaServer(netapp, 1, 1) else: ss = NaServer(netapp, 1, 1) return ss I tried monkey patching ssl._create_default_https_context a few times, but as my script makes a tong of other api calls, this was a bit outside my python comfort zone. Also worth mentioning that i battled weak ciphers with older 7mode systems for a few days and finally found a combination that worked for all my netapps: import ssl try: _create_unverified_https_context = ssl._create_unverified_context except AttributeError: pass else: ssl._create_default_https_context = _create_unverified_https_context ssl._DEFAULT_CIPHERS += ':RC4-SHA' Thanks! You got me on the right path. Matt S.

mjschneider · ‎2013-07-24

I have found two user tables in the db using: dfm database query run "SELECT * FROM sysobjects" name: perfClientStatCollections type: U userstat: 0 name: perfClientStats type: U userstat: 0 ... still not sure how the data is stored though since client IPs are not an object in DFM...

mjschneider · ‎2013-07-24

Two questions... Is there any way to tie dfm perf clientstat collections to the nfs export? Without going to each client(which still doesn't verify ops per export). Problem here is that most of our older exports were configured to allow an entire subnet, so figuring out whats still using an export. Right now i have all our filers collecting clientstats every so often . The problem i'm faced with is that i want to view a sum of these stats over a given period. So far i've got the below command working, but it's very slow and i have yet to combine and sum columns. Hoping there's something in DFM that can help with this. Perhaps a query to the dfm DB would work better, but im clueless when it comes to DB queries. for i in $(dfm perf clientstat list -a '2013-07-23 11:55:09.692000' <filername>| tail -n +2 | cut -d' ' -f1); do dfm perf clientstat list -s $i | tail -n +7; done | sort Any help would be greatly appreciated. Thanks, Matt

mjschneider · ‎2012-11-26

Hi, i know this is an old thread but did you happen to get this to work? I can ssh using 'DOMAIN\username'@netappfiler with just cifs setup and adding domain users to the local admin group. Trying to get this to work with just username@netapp though. Oddly, with just cifs setup, i can add the option "options ldap.ADdomain <domainname>" and successfully use "getXXbyYY getpwbyname_r username" WITHOUT adding ldap.name, ldap.servers or ldap.base.

mjschneider · ‎2012-09-04

aborzenkov wrote: Just remember that "reboot" is required after setting 'vol options <volname> root'. Doing a failover won't suffice. It will. cf takeover/cf giveback is enough. It provides for moving root volume almost non-disruptively (almost because existing NFS mounts will still become stale and need remount) I'm echoing what a netapp installer told me just last week. But to be honest i'd take your word over the installer's

mjschneider · ‎2012-09-04

Hi, I can SSH with active directory credentials to our filers by using "domain\username". I'd like to set something like the "base domain name" to allow admins to login without having to specify the domain name. I see quite a few options that seem like they all could all do the trick under options ldap, but I've only setup AD authentication using 'cifs setup'. Is there a simple way to accomplish this? I'd prefer to not mess with options.ldap* if at all possible. I've tried messing with security.admin.authentication security.admin.nsswitchgroup But i assume that because 'options ldap.enable' is off that it wont do what im expecting. Any help would be greatly appreciated. running 8.1.1GA Thanks, Matt

mjschneider · ‎2012-09-04

Just remember that "reboot" is required after setting 'vol options <volname> root'. Doing a failover won't suffice.

mjschneider · ‎2012-08-10

Adai, I've never noticed the "Storage Controller Tools"... Took me a while to figure out how to get that to show up but i found it. Thanks everyone, between the two tools I have a solution for sure. If it didnt hijack this thread i'd mark as answered

mjschneider · ‎2012-08-10

Thanks! I'll check out the guide.

mjschneider · ‎2012-08-09

I have config advisor installed and only recently began using to check filer health. I remember something about checking config files but a quick glance at it and i dont see any mention of /etc/rc or /etc/hosts... something in 3.0.1 maybe?

mjschneider · ‎2012-08-09

I understand what you're saying. The problem is that NetApp offers no method(that im aware of) to check and/or verify /etc/rc and /etc/hosts file health, history and comparison with it's HA pair. At least 80% of our failed fail-over attempts have been due to misconfigured /etc/rc and /etc/hosts files. After multiple failures I've had to make it a habit to manually compare those two files between HA pairs prior to a maintenance, which doesn't just consist of comparing between the pair, but verifying all active interfaces, vifs etc.. exist in the rc file. Also, I actually have matching /etc/rc files between HA pairs (minus the hostname). So matching configs between the two is absolutely critical in my environment. OnCommand Config Mgmt just seems like a fitting place to offer some historical and automated checks between HA pairs... Perhaps this should be a separate function in config mgmt and not built-in to what already exists. Maybe an additional area called HA or HA Pair Config Management? If it could be intelligent enough to check that a filer's active configuration exists in /etc/rc and /etc/hosts that would save us a LOT of headaches. It could also help restore faith in System Manager... when it's fixed. I imagine a good comparision check could work like this: HA pair1 Compare /etc/rc (ignore hostname) filer 1 Compare etc/rc with running config Verify anything in /etc/rc with `hostname` has an entry in /etc/hosts filer 2 Compare etc/rc with running config Verify anything in /etc/rc with `hostname` has an entry in /etc/hosts I did have time to review my post, let me know if this doesn't make sense. Thanks, Matt

mjschneider · ‎2012-08-07

We're referring to Operations Manager AKA DFM, not Systems Manager. /rant For the record, i reported system manager causing /etc/rc and /etc/hosts file corruption late last year. It was easy to replicate the issue even from a clean install of windows and yet, doesn't show up as a bug until now... bad bad bad. There's also a corruption issue while using ssh to connect to RLM port to paste a config file using wrfile.

mjschneider · ‎2012-08-07

Ok, so that explains why i still see the option in oncommand and in /etc/registry. All right, so it was available in 7.3.x, 'not available' in 8.0.x and available again in 8.1.x. Thanks for the help! Also, saw this in the 8.0.3 release notes: FTPS is not supported File Transfer Protocol over Secure Socket Layer (FTPS) was introduced in a previous Data ONTAP release, but it is not supported in the Data ONTAP 8.0 release family. If you enabled FTPS in a previous Data ONTAP release family, it is no longer available as an option for file access when you run the Data ONTAP 8.0 release family. SFTP is not supported Secure File Transfer Protocol (SFTP) was introduced in a previous Data ONTAP release, but it is not supported in the Data ONTAP 8.0 release family. If you enabled SFTP in a previous Data ONTAP release family, it is no longer available as an option for file access when you run the Data ONTAP 8.0 release family.

mjschneider · ‎2012-08-07

Interesting, I just realized that theres only two mentions of SFTP in 8.0 7-Mode File Access and Protocols Management Guide but in the 7.3.3 guide is has complete setup instructions. So i'm assuming it was removed in 8.0 and re-added in 8.1?

mjschneider · ‎2012-08-07

OnCommand is able to pull options sftp.enable settings but i dont see anything sftp related when running from command line. I've tried to run under priv set advanced as well. This is a 3240 running NetApp Release 8.0.2P3 7-Mode. I've followed this doc https://kb.netapp.com/support/index?page=content&id=1012643 as well as whats in the 8.0 7-Mode File Access and Protocols Management Guide. Ftp is there but no SFTP or even TFTP. .... also just checked 8 other 3140s running same version. We haven't setup SFTP or FTP prior to now so i might be missing something really simple. Thanks!

mjschneider · ‎2012-08-07

Bumping your question because of the following: why are /etc/rc and /etc/hosts not included? OnCommand Pulls options.sftp but when i try and query those options from command line, they're missing. Even tried under priv set advanced. 2 was answered in my other post. SFTP is not available in 8.0.x.

mjschneider · ‎2012-05-10

I recently had a pair of 3140s BOTH panic due to the PAM modules. Support pointed us at this bug id and workaround to reduce the ext-cache-tagstore-oversize-percent to 50. I believe default is 75. http://support.netapp.com/cgi-bin/bol?Type=Detail&Display=528631 Whats confusing is that the workarounds are recommended for versions that are also in the 'fixed in version' section... Yesterday we had a meeting with our var and netapp reps and we mentioned this problem as we have mostly 3140s. They said that with PAM modules we will not be able to upgrade to 8.1 due to the bottom line increased system resource utilization. They did mention a version where it will be supported but i cant remember which one... want to say 8.2 (i think it correlated to the new wafl version).

mjschneider · ‎2012-01-24

You might catch it in the auditing logs. You have to turn it on in ontap and on the share. Check the docs, it's been a while since i've messed with auditing.

mjschneider · ‎2012-01-24

You're correct, I'm confusing 8.1 with what ever future version does away with the 7-mode/cluster-mode split... We recently did some serious long term planning which is throwing me off.

mjschneider · ‎2012-01-24

That makes sense. This may not apply to this scenario; but we did have issues accessing netapp cifs shares on windows 7 when first going through a win2k3 DFS server. I think it had to do with NTLM versions. Upgrading to 2008 dfs servers fixed the issue.

mjschneider · ‎2012-01-24

We don't have any 8.1 installs yet but have begun planning. It's all about card slots. 8.1 upgrades require a dedicated two port 10G-E card. The card cant be used for any traffic other than HA/ontap stuff. If you've got a flash cache card installed, you most likely dont have enough room for the card. Simple as that, slots!

mjschneider · ‎2012-01-24

Rafael, have you tried setting the 'share' permissions to everyone-Full? Then just manage permissions via NTFS. My train of thought is that maybe share permission authentication is handled differently than NTFS; from the file server's perspective.

mjschneider · ‎2012-01-24

I've seen that issue a couple times. I think ontap just loses communication with rlm somehow. I do a 'rlm reboot' to clear the problem.

Re: Disabling automatic snapshots on volume over API

Re: Tricks to work with self-signed certificate over TLS on python sdk 5.6

Re: Tricks to work with self-signed certificate over TLS on python sdk 5.6

Re: dfm perf clientstat - per export? merge collections?

dfm perf clientstat - per export? merge collections?

Re: Enable administrative access through LDAP

Re: Moving root volume

ssh with active directory credentials without using domain name?

Re: Moving root volume

Re: Missing Options in Configuration Files

Re: Missing Options in Configuration Files

Re: Missing Options in Configuration Files

Re: Missing Options in Configuration Files

Re: Missing Options in Configuration Files

Re: options sftp.enable missing

Re: options sftp.enable missing

options sftp.enable missing

Re: Missing Options in Configuration Files

Re: We recently found out NetApp are not supporting 8.1 on the 3210 with Flash Cache installed

Re: NetApp CIFS is NOT windows file server?

Re: We recently found out NetApp are not supporting 8.1 on the 3210 with Flash Cache installed

Re: NetApp CIFS is NOT windows file server?

Re: We recently found out NetApp are not supporting 8.1 on the 3210 with Flash Cache installed

Re: NetApp CIFS is NOT windows file server?

Re: RLM Status: Offline