ONTAP Discussions
ONTAP Discussions
We are in the process of (finally!) decommissioning our FAS6220 HA pairs. Auditing is enabled so I have to address the auditing staging (MDV) volumes. I've seen a number of suggestions across Google search results but wanted to present this to the community for a solution rooted in NetApp best practice.
I will be affecting nine (9) aggregates across four (4) FAS6220 nodes in this procedure. I am currently vacating the aggregates of data and root volumes but suspect I will not be able to delete the aggregates as long as there are staging volumes present.
As always, thank you all for any constructive feedback you may be able to provide!
Solved! See The Solution
Based on TR-4189, page 7 in particular, I would say that the proper way to clean up those MDV volumes would be to delete the audit policy for all SVMs, which then deletes the audit staging volumes.
Steps 1 and 2 of this KB article also describe the process.
Hope that helps!
Donny
Based on TR-4189, page 7 in particular, I would say that the proper way to clean up those MDV volumes would be to delete the audit policy for all SVMs, which then deletes the audit staging volumes.
Steps 1 and 2 of this KB article also describe the process.
Hope that helps!
Donny
I would never "shoot the messenger".... but that was the ONE solution that I was hoping could be avoided. This means auditing would NOT be active for the period of time it takes to delete policy/delete aggregate/create policy. Is this assumption correct? Thank you for your quick reply, Donny!
Greg
Yes, I would agree with that assumption.
Very well... I will need to plan accordingly. Thank you!
Could not ever find any official documention on this. I really wish NetApp would publish something on this topic, some KB or something!!!
What I have noticed/done in the past is simpley delete the aggregate. As you know MDV volumes are placed on every aggregate when auditing is enabled. Even a new aggregate after the fact gets the MDV volumes added. I am believeing that once a volume is migrated off an aggregate, the MDV on the prior aggregate is no longer used on only updated on the current aggregate. I also suspect that it may not necessarily move auditing information during the volume move. Hence, delteing the aggregate may in fact remove some historical audting information.
With that said, I cannot recall, but it did require using diag or at least advanced mode. I was able to forcably delte the MDV volumes on the aggregate I was removing. After that, the aggregate removd easily.
Of course, I may have had to use the force method on the aggregate as I could not remove the MDV. Again, I do not recall completely.
Either way, I was able to use the "-force" flag and either : delete the MDV and the offline/delete the AGGR, or: using the "-force flag" I was able to offline/delete the aggregate. I suspect it was the first.
Again: IF SUPPORT IS WATCHING: You should really come up with a KB article documenting how to properly remove a MDV volume from an aggregate that is being decommissioned and that process should not even come close to including: turn off auditing!
I'm from Support. Is this for CIFS auditing or just regular ONTAP auditing? Sorry just trying to get clarification. Great suggestion though.
This is usually cifs/nfs auditing. The mdv volumes are used to store event information related to auditing
Alright, I've forwarded it on.