About connoisseur

connoisseur · ‎2017-06-05

Thank you.. Regarding the restore.. the Exchange technichian hadn´t checked from user side 🙂 He just looked from SMBR, and as you said.. there it shows create date as the date you restored it. So that´s solved.. The other question. I think I was a little un-clear. What they would like to do is to create pst files from disconnected mailboxes. And as they can´t connect to them from powershell, they can only connect to them via snapshots. They was wondering of they could connect to a snapshot of a database and then mark what disconnected mailboxes they wanted to create pst files from. For example.. If they have 5000 disconnected mailboxes and want to extract 500 of them as pst files.. they can´t do it from Powershell (active export).. Is there a way to do them in "bulk" from snapshot? //Henrik

connoisseur · ‎2017-06-02

Hi! We have an Exchange environment protected by SnapManager Exchange.. Our Exchange DBA´s are in the process of taking out some information from the environment and are asking.. If we need/would like to create several pst files from a database, is there a way to configure it so we can do them all at a time? We would like to avoid doing them one by one When restoring a single mail it changes ”create day” to time when restore is done. Are there any way to avoid that? //Henrik

connoisseur · ‎2017-01-31

Hi guys! Just a small tip, if you didn´t know.. but you don´t have to drop to node shell.. you can run the whole command in one line as long as you know your path. So for exampel: cluster01::> node run -node cluster01-01 "priv set diag;ls /vol/dfs_doc/DOC" This will give you the output directly in cluster view, and you don´t need to skip between cluster view and node view. Cheers.

connoisseur · ‎2016-10-28

Hi there. I´m trying to accomidate a customer to set up auditing on their SMB vserver. There are no problem activating it, and it writes to the log file. But it´s not capturing the event the customer is after. They want to see if anyone change permission on a folder. Is that even possible? As i understand it´s "4670: Permissions on an object were changed" that they need. I have read tr-4189 and found the list of event IDs the controller is logging. 4670 is not avaialable... but 4663 is and it captures "Read/Write Object Get/Set Object attributes" Should the "change permission" be available in that eventID, or is it impossible to audit folder permission changes on a NetApp vserver? (Running cDOT 8.3.1)

connoisseur · ‎2016-05-10

Did you fix it? Looking for the same on my Clustered Ontap environment. Had one customer to run full due to the fact that we migrated from a smaller controller to a bigger.. and the maxdir_size was set according to the older/smaller controller. Now they wanna monitor it with alerts.. but can´t seem to find where to go

connoisseur · ‎2016-02-05

Thanks Andrew! (just saw that you are the guy from practical-admin.com .. cool) Anyhow.. As I said, I´m very new to PS. A regular "Get-Childitem" command should do the trick to find the files.. So far I´m good. But when it comes to the NPTK, I find it a bit difficult. First, If I get a list from the GCI command where the output finds the correct path to the files, it´s still only the SMB path. So I need to find the correct volume/qtree path etc in the controller to get to the next step. Next I need to find the version where the file isn´t infected.. maybe that needs to be done manually.. or could one use the create timestamp from the *.decrypted file in some way. Then I thought about if, in someway, one can use the command below in a PS script: snap restore -t file /vol/svmvolume/qtree/folder/file -s nightly.0 Today we use the following way. We find the point in time where the files are OK, clone that snapshot and then mount it and share out the volume to a "restore" share. Then mount the infected area to U: (for exampel) and the restore to Y:. Then we use robocopy to receive the filename and use PS to copy the to destination. #robocopy 'U:\Folder' null /l /e /fp | select-string 'decrypted' | out-file c:\temp\decrypted.txt $x=get-content c:\temp\decrypted.txt $i=$null $J=$null foreach ($i in $x){ $i=$i.trim('.decrypted') $i $j=$i -replace "u:" , 'y:' $j copy-item "$j" -destination "$i" } I just thought if that can be done through Snap Rrestore in NPTK, It might go a little faster? We have also worked with To list the encrypted files below script is used: #robocopy 'U:\folder' null /l /e /fp | select-string 'decrypted' | out-file c:\temp\decrypted.txt To restore the files from backup: robocopy "\\NAS\restore_share$" "\\NAS\original_path" /COPYALL /DCOPY:T /B /SEC /E /R:0 /W:0 /log:"c:\temp\output.txt" /nfl /ndl /TEE

connoisseur · ‎2016-02-04

That´s the problem. Sometimes not all files are affected in a cryptoware attack. And usually the customers don´t allow us to restore on folder level. Say they have 10 qtrees in that volume. And in that qtree they have X number of folders. If 1 folder has ten thousands of files and get affected, but only 80% of the files are decrypted. the customer only want the affected files restored.. not the whole folder. That´s my dilemma.. Otherwhise I just would have done a restore from OCUM

connoisseur · ‎2016-02-04

Long story short We have a lot of Cryptoware incidents on our fileserver SVM:s. Is there a way to find and restore *.encrypted files via NPTK? What I´m looking for is a way to do file level restores on thousands of files in a folder/subfolder without restoring unaffected files located in the same. Maybe one can use NPTK to do some kind of SnapRestore, targeting only *.encrypted files? Do you have any idea? I´m new to PS, but I got it installed and working. I can connect to both cluster and SVM.

connoisseur · ‎2015-12-15

We had a couple of more incidnets with ransomware. I thought of fpolicy. Can we create an fpolicy to prevent someone to encrypt the files. All files are left, but they are named file.encrypted instead of file.excel for exampel. Does anyone know how the ransom engine works. Does it copy the original file and paste an ecrypted version? Or does it just rename it? if it copys and replace it.. I don´t think a fpolicy is goog, because then it can remove all files and the option to get lists with affected files are then gone. If it only renames it, it might work thoughts?

connoisseur · ‎2015-12-15

I updated.. OK to delete the SVM now

connoisseur · ‎2015-12-11

Hi! Did you figure it out? As I understand you need SMB3.02 support, but maybe that´s changed.

connoisseur · ‎2015-08-28

I just searched for webdav information for cDot.. But it seems that both webdav and http wasn´t ported over to cDot from 7-mode. Did YOU get any more information about it?

connoisseur · ‎2015-07-02

OK, had a webex with NetApp today. And there are no solution for this as for now. Here´s the burt: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=908671 It will be fixed in 8.3.1 RC1

connoisseur · ‎2015-07-01

No, Sorry .. no solution at this moment. I have a case open about this now, and we are scheduled to have a webex session tomorrow. Will update this post when I have any more information. BTW, got information that there´s a burt on this, 908671 . But it´s internal so far, so no public information. But it did mention this could happen if you uppgrade from 8.2.x to 8.3, which we have done.

connoisseur · ‎2015-06-24

Well we have followed those steps, and we have deleted SVMs before. This is the first time we get the particular error message.

connoisseur · ‎2015-06-24

Hi! We are trying to delete a SVM but get the following error: Error: command failed: [Job 5777] Job failed: The IPV4 address specified with "-address" is not supported because it is one of the following: multicast, loopback or 0.0.0.0. Try the command after sometime. We have deleted the SVM peer relationship associated with the SVM. Disabled all Snapmirror relations We have unmounted all volumes on the SVM, taken them offline, and deleted them including the root volume of the SVM. We have deleted CIFS server. Deleted any customized user accounts and roles associated with the SVM. And the SVM is stopped We have tried to delete the LIF, but same error. created the LIF again, and when we run the command same error but also it deletes the LIF once again The Vserver Admin State: deleting , whatever that means?

connoisseur · ‎2015-05-26

Thanks mate.. I hade the same problem. But both my SVM and my volumes where part of the same aggregata alreaddy, but it was not under the "List of Aggregates Assigned: " option. (when I ran the 'vserver show' command) So added it in and it worked. Thanks

connoisseur · ‎2015-02-24

Hi! Recently one of our customers was hit by a ransomware/cryptoware. The have a NAS server with CIFS which holds home and common folders. A couple of clients in the customer environment got some suspicious emails that they probably opened. And their client AND all mapped shares on the NAS server was then encrypted (all MS Office files changed the file names) They didn´t wanna do a restore on the whole volume, as they didn´t wanna loose any progress of the files NOT affected. So what we ended up doing was to do a vol clone on the snapshot created the day before the incident and then run a powershell script to scan/delete and replace the affected files with the clone as source. Now we had a "lessons learned" meeting with the customer, and they was wondering how to prevent a simular attack. Is there a function to get alert, if a client changes alot of files in a short time period Is there a function to prevent executable files to change files on NAS folders Is there any other options/ideas to implement to prevent these attacks?

connoisseur · ‎2015-01-16

Thank you so very much. This was a a legacy from a 7-mode transition we did last summer. I checked the transition output and it pointed to an old 7-mode system. Deleted it and now it works. Thanks again

connoisseur · ‎2015-01-16

Thanks. Also noticed that SnapManager service does a CRL check before starting.. So you need to have internet connection to start the service... or change Internet Explorer options to not check for Cert on the service account used to start SME.

connoisseur · ‎2015-01-16

Hi! I´m in the process of setting up a Exchange environment on NetApp disk. It consists of 6 exchange servers. All data is migrated to NetApp disk. I have installed SnapDrive and SME and all that is working. In SME I can add all the exchange servers in the "Add Server to be Managed". But when I choose to add the DAG i get the following error: "Catch an error in GetServiceProvider(EXDAG01Z2) - Could not connect ot net.tcp://exdag01z2:810/NetAppServices/SMEServices/Service. The connection attempt lasted fo a time span of 00:00:01.0140065. TCP error code 10061 : No connection could be made because the target machine actively refesed it 131.115.8.105:810." After that I get "SnapManager initialization failed. Error Code: hr=0x80004005 The specified Server is either not running or the Server name is incorrect." I can ping the DAG so there´s connection (it´s on the sam net) Read the Installation and Administration Guide for SME and there´s nothing special for DAG that differs from adding the exchange server it self. Any Ideas?

connoisseur · ‎2015-01-16

Hi! I have a bunch of vservers which are peered to a secondary site for snapvault. I´m trying to delete two of them but keep getting error message telling me that I can´t delete a Vserver that is part of a Vserver peer or transition peer relationship. But it´s not. These are the steps I´ve taken. * check and release snapmirror relationship on primary * check and delete snapmirror relationship on secondary * delete peer relationship (on both clusters) * unmount namespace * take all volumes related to vserver offline and then deleted them * deleted the cifs server * stopped the vserver. But when I try to delete it , from System Manager or CLI, i get the message about peer. When I do a vserver peer show, there is now peers on either cluster pointing to the vserver I intent to delete?

connoisseur · ‎2014-06-09

Hi! Do you have any update on the new OpenSSL issue? DTLS invalid fragment vulnerability (CVE:2014-0195) and SSL/TLS MITM vulnerability (CVE:2014-0224) Will this document be updated or will you have new ones for these?

connoisseur · ‎2013-11-14

I only use SnapVault on my system, and no cascading. The strange thins is that the conformance/nonconformance jumps from dataset to dataset. One day I have 5/20 in nonconformant, next day I can have 10/20, and some days none.... without me doing anything. We to have a case about this, with slow progress, and the last information I got was that it was due to my resource pools being full (which they are not , I have 20+TB in each) And how can "The Active/Active partner of storage system controller_name does not have any interfaces in the ipspace xxxxxxx-ipspace" error have anything to do with resource pools being full??

connoisseur · ‎2013-11-06

Seems like there are some problems using Mavericks on NAS shares. And the workaround is to disable SMB2 and only use SMB again on the Mac cleint? https://discussions.apple.com/thread/5467191

Re: SME functions/help

SME functions/help

Re: Simple 'ls' dir listing in C-MODE

Auditing "change permissions"

Re: MaxDirSize Monitoring Question

Re: Restore files via Powershell ToolKit

Re: Restore files via Powershell ToolKit

Restore files via Powershell ToolKit

Re: Ransomware/Cryptoware prevention

Re: Cannot delete SVM

Re: Shared VHDX for Guest Clusters using SMB 3.0

Re: WebDav, FTP , HTTP in NAS SVM (CDOT 8.2.1)

Re: Cannot delete SVM

Re: Cannot delete SVM

Re: Cannot delete SVM

Cannot delete SVM

Re: SMSQL 7.0 - Ensure that the aggregate of the volume <volnam> is assigned to the Virtual St

Ransomware/Cryptoware prevention

Re: Unbale to delete vserver (cDOT 8.2.1P3)

Re: Can´t add DAG to SME

Can´t add DAG to SME

Unbale to delete vserver (cDOT 8.2.1P3)

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

Re: Datasets "nonconformant" after DFM upgrade

Re: SMB2 in OS X 10.9 Mavericks