r/netapp

Hello, I'm working for a client that has a 2 node fas cluster running ontap 9.11

They have several shares that are open access. Ie "Everyone / Full Control", they are needing to audit them to see who is accessing what in order to start tying things down for security purposes.

I am trying to figure out a way of capturing these logs...

So far I've tried

Enabling audit logs with "cifs-logon-logoff, file-ops, file-share" -

This captures the user id, but not what share they are actually accessing...

Enabling volume activity tracking

Dosnt seem to show me anything useful

I can see that ontap does have the information I need, as it is displayed when I manually run "cifs session show -fields windows-user,share-names".

Short of creating a cronjob to run every min and save the output then sift through it I can't see anyother way to capture it.

Wondering if anyone has any ideas....

So here’s the command:

vserver export-policy rule show -vserver svm -policyname default -ruleindex 1 -clientmatch hostname1

Always gives me “There are no entries matching your query”

If I take out -clientmatch, it lists out everything. And I verified hostname1 is in there by copying all out to notepad and doing a search with the hostname I was putting into the command. This is not holding me back from anything….its just bugging the hell out of me.

9.17.1 if it helps

Hey everyone, looking for some guidance after an unexpected data center shutdown over the weekend. Our controller is running ONTAP 9 and is connected to a DS2246 expansion shelf. All the physical link lights on the shelf are green, and I can reach the IP of the share, but I can't access any folders inside.

Digging into the CLI, the underlying data volumes are offline. Attempting `volume online` errors out because the parent aggregate is offline. When I try to bring the aggregate online via `storage aggregate online`, I get a `uuid is not valid error`. It looks like a metadata or disk signature mismatch occurred during the dirty reboot, and ONTAP isn't recognizing the aggregate's UUID on the shelf drives. Has anyone run into this specific error after a hard power cycle? What are the safest steps to re-import or force-mount the aggregate without risking data loss?

I have a FAS3250 in my environment we’re keeping around for NFS storage on old HPUX/IRIX and SunOS systems. Our users have been complaining about this NFS storage being unusably slow.

I’ve been driving myself crazy trying to figure out what the issue is. I used nfsstat to show clients consuming the most network bandwidth, went to those hosts, and there are no active processes reading or writing to the FAS3250. At first a couple Solaris systems were showing as the top clients, I had the users pause doing their software stuff on them which took them off the list, but our RHEL7 server we use as a gateway between our FAS3250 and FAS70 to do backups will move up the list to be at the top and I’ve confirmed there were no backups running. (xcp as a cronjob)

I did a read/write test on the FAS3250 from the same RHEL7 system, it’s slow, about 50 mb/s.

We do not touch the FAS3250 unless something is wrong with it, no one on our team is comfortable messing with it and naturally support for it now is non-existent.

Network hardware hasn’t changed. The system is using a single 10GBe port for data.

Rambling aside, my question is, the NFS volumes are on a 96% full aggregate. Would this cause the performance issues I’m seeing? The volumes themselves have a good amount of space left. I’m guessing they were thick provisioned.

I’m not great with storage or networking if you couldn’t tell. If anyone has any insight I’d really appreciate it.

basically the title, if no where do you guys go for a smoke break?

Two hosts are fine, the third one just drops the Netapp (AFF220) the moment I try to vMotion to it or create new VM's

They all have the latest round of 8.0.3 updates

Replaced the DAC cable on Host3 to resolve if it was a Layer1 issue, but no improvement, the MTU is 9000 on all VMK + Netapp interfaces and all plugged into the same 10gig switch

VMKlogs complain about massive I/O latency and a constant loop of dropping and reconnecting to the datastore

NFS41VolumeLatencyUpdate:7622: NFS41 volume VM Data performance has deteriorated. I/0 latency increased

Average value of 0(us) to 2749149(us).

Exceeded threshold 10000(us)

cpu2:2098343 opID=ec9b475)WARNING: NFS41: NFS41FileIOSync:790: Synchronous IO on obj 0x43093df9b00 (fh 0x4314eee13aa8) failecon #0

NFS41: NFS41_ConnectionRemove:1307: Connection: 0x43171020c040 [1] addr: tcp 10.10.20.20.8.1

NFS41: NFS41ClusterDestroy:2578: Destroying cluster: 0x43171020d690 flags: 0x10

WARNING: NFS41: NFS41FileIOSync:790: Synchronous IO on obj 0x4309e3dc5940 (fh 0x431710210a7) failed

WARNING: SunRPC: 4847: fail all pending calls for client 0x4310b8601370 IP 10.10.20.21.8.1 (socket half closed)

2026-06-1718: 33:11.998Z Wa(180) vmkwarning: cpu9:2097761)WARNING: NFS41: NFS41FSAPDNotify:6856: Lost connection to the server 10.10.20.20,10.10.20.21 mount point VM Data,

mounted as 371560c8-ba89eb8b-0000-000000000000 ("/VM Data")

cpu®: 2097759)NFS41: NFS41ProcessSessionReset:3942: Session Reset - XPRT UP, Issuing EXCHANGE_ID with Random Backoff

cpu®: 2097759)NFS41: NFS41IssueExid:1899: Issuing EXCHANGE_ID on Connection tcp:10.10.20.20.8.1 with 13834 US delay cpu2: 2097759)NFS41: NFS41ProcessExidResult:2397: clientid fbd5d30000004e20 roles 0x60000

cpu9:2097761)NFS41: NFS41ProcessClusterProbeResult:4349: Reclaiming state, cluster 0x431710204d80 [0]

cpu9:2097761)NFS41: NFS41ClusterReclaimState:3934: Reclaiming state for fs 0x4317102058c0 on cluster 0x431710204d80 [0]

vmkwarning: cpu3:2097764)WARNING: NFS41: NFS410penReclaimDoneWork:6138: Failed to reclaim objDesc 0x43093d5770 open status: Failure; rqst

0x43171020c0f8 cmpd status: NFS4ERR NO GRACE

vmkwarning: cpu3:2097764)WARNING: NFS41: NFS410penReclaimDoneWork:6138: Failed to reclaim objDesc 0x4309e3de6ff0 open status: Failure; rqst

0x43171020c918 cmpd status: NFS4ERR_NO_GRACE

vmkwarning: cpu11:2097766)WARNING: NFS41: NFS410penReclaimDoneWork:6138: Failed to reclaim objDesc 0x43093d5940 open status: Failure; ras t 0x431710215198 cmpd status: NFS4ERR_NO_GRACE

vmkernel: cpu11:2097766)NFS41: NFS410penReclaimDoneWork:6158: FS:0x4317102058c® reclaim completed on cluster:0x431710204d80[®]

vmkernel: cpu9:2097761)StorageApdHandler: 1304: APD exit for 0x43171020320 [371560c8-ba89eb8b-0000-000000000000]

vmkernel: cpu9:2097761)NFS41: NFS41FSAPDNotify:6921: Restored connection to the server 10.10.19.21,10.10.19.22 mount point VM Data, mounted as 371560c8-ba89eb8b-0000-000000000000 ("/VM Data")

vmkernel: cpu3:2097358)StorageApdHandler: 500: APD exit event for 0x43171020320 [371560c8-ba89eb8b-0000-000000000000, 01

vmkwarning: cpu1:2098357)WARNING: NFS41: NFS41FileOpGetFileAttributes:4681: Failed to get file attributes for object 0x43093de1380 name 37

1560c8-ba89eb8b-0000-000000000000: I0 was aborted

Hi everyone!

NetApp's Multi-admin-verify (MAV) is a great tool for enforcing dual control on potentially dangerous commands  (or any command - it's up to you as an admin to decide!), so having a sandbox to play with in labondemand.netapp.com was something I've long thought would be handy.

However, it's one thing to play in a sandbox, and another thing to make it in the first place, and know what steps to follow to set it up in your production environment. We don't have a pre-defined lab for MAV that I could find, so I wrote a powershell script to build one from scratch.

The script does the following:

• Creates AD OUs and groups for StorageAdmins and StorageOperators
• Provisions 9 accounts into each of them (storageadmX and storageopX), password: Netapp1!
• Creates an SVM on ONTAP cluster 1 (192.168.0.101)
• Domain joins SVM to demo.netapp.com
• Sets up domain tunnel through that SVM
• Sets up StorageAdmin and StorageOperator roles based on the admin role
• Assigns groups to roles
• Sets up MAV with StorageOperator requiring MAV approval, StorageAdmin not requiring approval
• Restricts vol delete and snap delete commands under MAV for StorageOperator

I’ve tested it with 9.16.1 and 9.19.1 labs and it’s done what I expected with regards to setup - I haven’t done deep testing of MAV with it, the aim is to setup an environment where MAV can be tested. 

The script and setup instructions are available from https://community.netapp.com/t5/ONTAP-Discussions/Quick-start-to-setting-up-Multi-admin-verify-MAV-on-labondemand-netapp-com/m-p/467864

Does Netapp give interns the option of selecting a MacBook?