ONTAP Discussions

Folders are moving from one location to another without manual intervention

siddarajugc
16,061 Views

Hi all,

 

In our environment, Folders in volume are moving in to another folder without any manual intervention.

 

let us assume, there are 2 main folders, Say 'A' & 'B' in a volume.

A folder have around 100 of sub folders and that sub folders are moving in to another sub folder without any manual intervention.

Can any one please suggest how to resolve this issue and its in urgent basis.

Your comments are valuable.

 

Regards

siddaraju

19 REPLIES 19

scottgelb
15,899 Views

There is no mechanism I can think of in ONTAP that would move folders or files.  It sounds like a host is doing this.  ONTAP (cDOT) can move volumes (vol move) or aggregates (aggregate relocate), and can even copy files and folders with ndmpcopy at the cli, but not moves of files.  I would look at all hosts and enable auditing to try to see what is moving the directory structures around.

siddarajugc
15,888 Views

 

 

 

 

 

RPHELANIN
15,882 Views

This has to be host based. As said, OnTap cannot move sub-directories or files from volume to volume without a backup engine. You can't even create or delete files \ folders from CLI of OnTap. Have you considered setting up Fpolicy?

Assuming this is CIFS you could try seeting options cifs.trace_login on and view messages log file.

siddarajugc
15,872 Views

 

 

 

 

RPHELANIN
15,868 Views

Ok, well as i said OnTap cannot just move sub directories from one volume to another with a backup protocol and manual configuration.

Is it CIFS or NFS?

siddarajugc
15,856 Views

Hi ,

 

Its a CIFS Shares.

siddarajugc
15,806 Views

Hi,

 

Under volume we had created a qtree and in that qtree so many sub folders are there.

 

Thiese sub folders are moving into another sub folders without any manual intervention.

 

How to resolve these issue.

 

Thiese all are entirly CIFS shares.

 

Please give your valuable suggetstions and its in urgent basis.

 

 

Darkstar
15,807 Views

What OnTap version are you running? I remember there once was a strange bug with SMB2 that manifested itself in a similar way (files created in a subdirectory disappeared and were later found a few directories further up). But that was with newly created files, not with pre-existing files.

Try disabling SMB2 on the filer to see if that helps. Note that this requires all CIFS clients that are currently connected via SMB2 to reconnect to the filer.

 

You can also enable CIFS Auditing on the volume to see who/what does the move operation if it's indeed client-initiated

 

Also you should upgrade to the most recent OnTap version (8.1.4P9 if you're currently at or before 8.1.x, or 8.2.3P5 if you're already on 8.2)

siddarajugc
15,796 Views

Hi ,

 

Thanks for your suggestions, ONTAP version we are using is 7.3.5. 1p4.

And please suggest how to disable SMB2 on filer and how to enable CIFS Auditing on the volume.

 

 

Darkstar
14,362 Views

In that case I would strongly suggest you upgrade to 7.3.7P3 as there are a lot of bugs that have been fixed since 7.3.5*, especially with regard to SMB2 support

 

You should ask your partner/reseller if you need help with upgrading, even though it's rather easy (download new software, install on filer, do takeover/giveback 2 times) there might be dependencies on other software (SnapManager or other 3rd party tools) that you might need to check, and your partner should be able to help you assess these issues.

 

You can check if smb2 is enabled by entering

NetApp> options cifs.smb2.enable

cifs.smb2.enable    on

 

If it's on, you can disable it with

NetApp> options cifs.smb2.enable off

 

and re-enable it with

NetApp> options cifs.smb2.enable on

 

The settings take effect immediately, and if you have Windows clients that were accessing the filer through SMB2 when you disabled it, these clients might need a reconnect with SMB1, which will happen only after some time (depending on the Windows version and settings it can be up to 15 minutes) or a client reboot (usually faster than just waiting). It should not affect existing sessions but since windows continuously tries to disconnect and reconnect, you should be prepared to expect these long timeouts.

 

Auditing is a bit more involved, you should probably skim over the relevant documentation (File Protocols Access Guide) and over the basic Windows concepts before trying to implement it (misconfiguration can under some circumstances kill your performance or fill up your root volume with tons of logs)

 

scottgelb
14,357 Views

How many users are there (can you walk by and see what they are doing?)?  Anyone running a script of some sort that might be doing this?  "options cifs.audit" for all cifs auditing but then you also need to change the share properties from a windows host.. don't have the KB offhand but documented nicely on the NetApp mysupport site.

Renifa
14,291 Views
Following is the KB link that will explain how to enable CIFS auditing on the controller. https://kb.netapp.com/support/index?page=content&id=1011243&actp=search&viewlocale=en_US&searchid=1440136137770 Hope this helps.
If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

siddarajugc
14,177 Views

Hi Renifa,

 

Thank you for your reply, and is it possible to do CIFS audit for particular folder.

 

 

 

regards

siddaraju

Renifa
14,169 Views

Hi,

Yes it’s possible to audit one particular folder. Refer to the following guide: https://library.netapp.com/ecm/ecm_download_file/ECMP1610207

Configuring and applying audit policies on NTFS files and folders using the

CLI, page no 316

 

Hope this helps.

 

Renifa

 

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

siddarajugc
12,181 Views

Hi Renifa,

 

Thanks for your reply,

Link you had sent is for Data ONTAP 7 mode (version-7.5.3) ?

I want to audit CIFS for particular folder in Data ONTAP 7 mode 7.5.3 ?

 

 

regards

siddaraju

Renifa
12,153 Views

Try this link for 7 mode. page no: 280

https://library.netapp.com/ecm/ecm_download_file/ECMM1278400

 

Thanks,

Renifa 

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

siddarajugc
12,150 Views

Hi Renifa,

 

In our storage SMB2 support is disabled, if we enabled SMB2 it will effect the production environment?

 

please give your valuable suggestions, thanks in advance.

 

regards

siddaraju

Renifa
12,143 Views

Hi,

 

Yes there might be a disruption in the production while enabling SMB2.0 and also you need to reboot the system for the changes to take effect. 

 

Thans,

Renifa

 

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

mbeattie
14,268 Views

Hi,

 

Have you checked who the owner of the folder is that was moved? That is likely to point to the culprit that moved it (folders don't move by themselves). It's possible a user who has NTFS permissions to the data has accidently moved it (drag drop) in windows explorer. What are the NTFS permissions? Have you identified the number of users who have access to the data to try and find out who did it? You could always restore it to it's origonal location and then enable cifs auditing temporarily to identify who is responsible

 

/matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.
Public