files disappeared every few nights

[laser]

Hi Team,

We having AFF8020 , version 9.7P22 (the support contract is done for this system)

We've noticed already 3-4 times, that files disappeared (now we'll notice if it's happening every night, or once in few nights).

The 1st time it happened, we've first created a clone from week ago snapshot to keep it in the side if the 'restore' won't work, and then we restored the original volume to few days ago, and the files got back.

From the UI, I can't see something strange.

But, now there is a strange thing, that I see that few new folders created/edited on the time 00:00. we didn't created it. it looks like some k8s/contect libraries directories maybe. don't know

So I suspect it's one of 2 things :

1. something related to snapshot etc.

2. maybe there is some system that this volume is mounted to it, and it's doing some changed in 00:00. but I can't see it from the UI logs

I do saw some similar topic here :https://community.netapp.com/t5/Ask-The-Experts/Files-disappear-from-NetApp-2220-every-day-at-00-00/td-p/153164

So I'm already showing here the command that the supporter asked there.

** editing - 

I see both on May 22, and May 30, the following error on the "event log show" 

5/30/2024 00:03:58 ntn01-netapp01-b ERROR disk.dynamicqual.fail.parse: Device qualification information file (/etc/qual_devices) is invalid. The following error, " Unsupported File version detected.
" has been detected. For further information about correcting the problem, search the knowledgebase of the NetApp technical support support web site for the "[disk.dynamicqual.fail.parse]" keyword.
5/30/2024 00:00:00 ntn01-netapp01-b ERROR mgmtgwd.certificate.expired: A digital certificate with Fully Qualified Domain Name (FQDN) aff, Serial Number 52D2566E1F3FF, Certificate Authority 'aff' and type server for Vserver ntn01-netapp01 has expired.
5/30/2024 00:00:00 ntn01-netapp01-b ERROR mgmtgwd.certificate.expired: A digital certificate with Fully Qualified Domain Name (FQDN) AFF_SAN_DEFAULT_SVM, Serial Number 52D2794F809E9, Certificate Authority 'AFF_SAN_DEFAULT_SVM' and type server for Vserver ntn01-netapp-04 has expired.
5/29/2024 23:14:01 ntn01-netapp01-a ERROR disk.dynamicqual.fail.parse: Device qualification information file (/etc/qual_devices) is invalid. The following error, " Unsupported File version detected.

Thanks in advance !

[cedric_renauld]

Hello,

I thinks you've many issues in //, 

Fist the certificat of SVM,you can renew them if there are autocertificat

Second your DQP isnt in good version can you try to donwload and intall it ?

the DQP is the Disk Qualiufication Package, it can shaiw to the systel the right hardware definition of these disk.

Probably you have change a disk, and the new one isnt in this file, the installation of this file is easy, can you show on support site ?

https://mysupport.netapp.com/site/info/disk-qual

And last, for the deleted file, i think the right solution is to activate the NFS file auditing :

https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-KBs/How_to_enable_auditing_of_NFS_events_in_ONTAP_9

you can see how access, modify and delete files

[laser]

Hi, and thanks for your reply !!!

1. I've now renewed the cert

2. I've installed the DQP

3. I'll read now the link you sent regarding the "activate the NFS file auditing" , and will reply here later

* update - Our NFS version is 3, and I see that the link is for NFSv4. is there an option to change my NFS from v3 to v4 ? if so, should be any risk ?]

[and BTW - there is SMB access also for those folders, just in case it matters and change to solution]

[cedric_renauld]

Hello

No, change NFS version could be dangerous, it's depend of your client side, if the clients support NFS 4 or not.

And yes if you have SMB acces on this volume, it's could change the solution ...

@this time I dont have any solution for you, sorry

[laser]

oh, thanks @cedric_renauld for your assistant !!

I'll wait for someone to reply now, now that I wrote the we also have SMB acces

[laser]

Can I get an answer please ?

it's keep going on