Folders are moving from one location to another without manual intervention

[siddarajugc]

Hi all,

In our environment, Folders in volume are moving in to another folder without any manual intervention.

let us assume, there are 2 main folders, Say 'A' & 'B' in a volume.

A folder have around 100 of sub folders and that sub folders are moving in to another sub folder without any manual intervention.

Can any one please suggest how to resolve this issue and its in urgent basis.

Your comments are valuable.

Regards

siddaraju

[scottgelb]

There is no mechanism I can think of in ONTAP that would move folders or files.  It sounds like a host is doing this.  ONTAP (cDOT) can move volumes (vol move) or aggregates (aggregate relocate), and can even copy files and folders with ndmpcopy at the cli, but not moves of files.  I would look at all hosts and enable auditing to try to see what is moving the directory structures around.

[siddarajugc]

Hi scottgelb,

Thanks for your reply, morever it is DOT 7 mode and there is no NDMP copy has enabled in storage side.

Morever there is no vol copy and snapmirror has enabled, its a kind of moving sub folder and sitting in different folder.

please find attached pic for your reference.

regards,

Siddaraju

[RPHELANIN]

This has to be host based. As scottgelb said, OnTap cannot move sub-directories or files from volume to volume without a backup engine. You can't even create or delete files \ folders from CLI of OnTap. Have you considered setting up Fpolicy?

Assuming this is CIFS you could try seeting options cifs.trace_login on and view messages log file.

[siddarajugc]

 Hi RPHELANIN,

Fpolicy is not yet enabled and its not yet created also.

Its a kind of subdirectry moving to another sub directory in a volume.

regards

Siddaraju

[RPHELANIN]

Ok, well as i said OnTap cannot just move sub directories from one volume to another with a backup protocol and manual configuration.

Is it CIFS or NFS?

[siddarajugc]

Hi RPHELANIN,

Its a CIFS Shares.

[siddarajugc]

Hi,

Under volume we had created a qtree and in that qtree so many sub folders are there.

Thiese sub folders are moving into another sub folders without any manual intervention.

How to resolve these issue.

Thiese all are entirly CIFS shares.

Please give your valuable suggetstions and its in urgent basis.

[AdvUniMD]

What OnTap version are you running? I remember there once was a strange bug with SMB2 that manifested itself in a similar way (files created in a subdirectory disappeared and were later found a few directories further up). But that was with newly created files, not with pre-existing files.

Try disabling SMB2 on the filer to see if that helps. Note that this requires all CIFS clients that are currently connected via SMB2 to reconnect to the filer.

You can also enable CIFS Auditing on the volume to see who/what does the move operation if it's indeed client-initiated

Also you should upgrade to the most recent OnTap version (8.1.4P9 if you're currently at or before 8.1.x, or 8.2.3P5 if you're already on 8.2)

[siddarajugc]

Hi AdvUniMD,

Thanks for your suggestions, ONTAP version we are using is 7.3.5. 1p4.

And please suggest how to disable SMB2 on filer and how to enable CIFS Auditing on the volume.

[AdvUniMD]

In that case I would strongly suggest you upgrade to 7.3.7P3 as there are a lot of bugs that have been fixed since 7.3.5*, especially with regard to SMB2 support

You should ask your partner/reseller if you need help with upgrading, even though it's rather easy (download new software, install on filer, do takeover/giveback 2 times) there might be dependencies on other software (SnapManager or other 3rd party tools) that you might need to check, and your partner should be able to help you assess these issues.

You can check if smb2 is enabled by entering

NetApp> options cifs.smb2.enable

cifs.smb2.enable    on

If it's on, you can disable it with

NetApp> options cifs.smb2.enable off

and re-enable it with

NetApp> options cifs.smb2.enable on

The settings take effect immediately, and if you have Windows clients that were accessing the filer through SMB2 when you disabled it, these clients might need a reconnect with SMB1, which will happen only after some time (depending on the Windows version and settings it can be up to 15 minutes) or a client reboot (usually faster than just waiting). It should not affect existing sessions but since windows continuously tries to disconnect and reconnect, you should be prepared to expect these long timeouts.

Auditing is a bit more involved, you should probably skim over the relevant documentation (File Protocols Access Guide) and over the basic Windows concepts before trying to implement it (misconfiguration can under some circumstances kill your performance or fill up your root volume with tons of logs)

[scottgelb]

How many users are there (can you walk by and see what they are doing?)?  Anyone running a script of some sort that might be doing this?  "options cifs.audit" for all cifs auditing but then you also need to change the share properties from a windows host.. don't have the KB offhand but documented nicely on the NetApp mysupport site.

[Renifa]

Following is the KB link that will explain how to enable CIFS auditing on the controller. https://kb.netapp.com/support/index?page=content&id=1011243&actp=search&viewlocale=en_US&searchid=1440136137770 Hope this helps.

[siddarajugc]

Hi Renifa,

Thank you for your reply, and is it possible to do CIFS audit for particular folder.

regards

siddaraju

[Renifa]

Hi,

Yes it’s possible to audit one particular folder. Refer to the following guide: https://library.netapp.com/ecm/ecm_download_file/ECMP1610207

Configuring and applying audit policies on NTFS files and folders using the

CLI, page no 316

Hope this helps.

Renifa

[siddarajugc]

Hi Renifa,

Thanks for your reply,

Link you had sent is for Data ONTAP 7 mode (version-7.5.3) ?

I want to audit CIFS for particular folder in Data ONTAP 7 mode 7.5.3 ?

regards

siddaraju

[Renifa]

Try this link for 7 mode. page no: 280

https://library.netapp.com/ecm/ecm_download_file/ECMM1278400

Thanks,

Renifa 

[siddarajugc]

Hi Renifa,

In our storage SMB2 support is disabled, if we enabled SMB2 it will effect the production environment?

please give your valuable suggestions, thanks in advance.

regards

siddaraju

[Renifa]

Hi,

Yes there might be a disruption in the production while enabling SMB2.0 and also you need to reboot the system for the changes to take effect. 

Thans,

Renifa

[mbeattie]

Hi,

Have you checked who the owner of the folder is that was moved? That is likely to point to the culprit that moved it (folders don't move by themselves). It's possible a user who has NTFS permissions to the data has accidently moved it (drag drop) in windows explorer. What are the NTFS permissions? Have you identified the number of users who have access to the data to try and find out who did it? You could always restore it to it's origonal location and then enable cifs auditing temporarily to identify who is responsible

/matt