Oracle® ZFS Storage Appliance Administration Guide, Release OS8

Oracle® ZFS Storage Appliance Administration Guide, Release OS8

Oracle

®

ZFS Storage Appliance

Administration Guide, Release OS8.7.0

Part No: E78912-02

July 2017

Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0

Part No: E78912-02

Copyright © 2009, 2017, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of

SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?

ctx=acc&id=info

or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs

if you are hearing impaired.

Référence: E78912-02

Copyright © 2009, 2017, Oracle et/ou ses affiliés. Tous droits réservés.

Ce logiciel et la documentation qui l'accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d'utilisation et de divulgation. Sauf stipulation expresse de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, accorder de licence, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d'interopérabilité avec des logiciels tiers ou tel que prescrit par la loi.

Les informations fournies dans ce document sont susceptibles de modification sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu'elles soient exemptes d'erreurs et vous invite, le cas échéant, à lui en faire part par écrit.

Si ce logiciel, ou la documentation qui l'accompagne, est livré sous licence au Gouvernement des Etats-Unis, ou à quiconque qui aurait souscrit la licence de ce logiciel pour le compte du Gouvernement des Etats-Unis, la notice suivante s'applique :

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Ce logiciel ou matériel a été développé pour un usage général dans le cadre d'applications de gestion des informations. Ce logiciel ou matériel n'est pas conçu ni n'est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer un risque de dommages corporels. Si vous utilisez ce logiciel ou ce matériel dans le cadre d'applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses affiliés déclinent toute responsabilité quant aux dommages causés par l'utilisation de ce logiciel ou matériel pour des applications dangereuses.

Oracle et Java sont des marques déposées d'Oracle Corporation et/ou de ses affiliés. Tout autre nom mentionné peut correspondre à des marques appartenant à d'autres propriétaires qu'Oracle.

Intel et Intel Xeon sont des marques ou des marques déposées d'Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d'Advanced Micro Devices. UNIX est une marque déposée de The Open Group.

Ce logiciel ou matériel et la documentation qui l'accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses affiliés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers, sauf mention contraire stipulée dans un contrat entre vous et Oracle. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l'accès à des contenus, produits ou services tiers, ou à leur utilisation, sauf mention contraire stipulée dans un contrat entre vous et Oracle.

Accès aux services de support Oracle

Les clients Oracle qui ont souscrit un contrat de support ont accès au support électronique via My Oracle Support. Pour plus d'informations, visitez le site http://www.oracle.com/ pls/topic/lookup?ctx=acc&id=info

ou le site http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs

si vous êtes malentendant.

Contents

About the Oracle ZFS Storage Appliance .........................................................  19

Oracle ZFS Storage Appliance Key Features ......................................................  20

Supported Protocols .......................................................................................  20

Appliance Data Services .................................................................................  21

Data Availability ...........................................................................................  21

Browser User Interface (BUI) .......................................................................... 22

Network Icons ..............................................................................................  30

Dashboard Icons ............................................................................................ 30

Analytics Toolbar Icons ..................................................................................  31

Identity Mapping Icons ..................................................................................  32

Supported Browsers .......................................................................................  33

Command Line Interface (CLI) ........................................................................ 33

CLI Contexts ........................................................................................  35

CLI Properties ......................................................................................  42

Working with CLI Scripting ............................................................................  45

Using Batch Commands .........................................................................  45

Understanding the CLI Scripting Commands ..............................................  46

▼ Accessing the CLI Script Environment ................................................. 46

Understanding the Built-in CLI Functions .................................................. 47

▼ Using the Run Function ....................................................................  48

▼ Using the Get Function .....................................................................  48

▼ Using the List Function .....................................................................  49

▼ Using the Children Function ..............................................................  52

▼ Using the Choices Function ...............................................................  53

Using the Functions for Generating Output ................................................  54

Understanding CLI Scripting Errors .......................................................... 55

Configuring the Appliance ................................................................................  57

5

Contents

Initial Appliance Configuration ........................................................................  57

Appliance Cluster Configuration ......................................................................  58

Cluster Configuration BUI View ..............................................................  58

▼ Upgrading a Standalone Appliance to a Clustered Configuration (BUI) .......  60

▼ Shutting Down a Clustered Configuration (BUI) ....................................  62

▼ Shutting Down a Clustered Configuration (CLI) ....................................  64

Cluster Terminology ..............................................................................  66

Understanding Clustering ........................................................................ 66

Cluster Advantages and Disadvantages ...................................................... 68

Cluster Interconnect I/O .........................................................................  70

Cluster Resource Management .................................................................  71

Cluster Takeover and Failback .................................................................  74

Configuration Changes in a Clustered Environment .....................................  76

Clustering Considerations for Storage .......................................................  77

Clustering Considerations for Networking .................................................. 79

Private Local IP Interfaces ......................................................................  81

Clustering Considerations for InfiniBand ...................................................  82

Preventing Split-Brain Conditions ............................................................  85

Estimating and Reducing Takeover Impact ................................................. 87

Network Configuration ...................................................................................  89

Network Configuration (BUI) ..................................................................  90

Network Configuration (CLI) ................................................................. 102

Working with Network Configuration ...................................................... 111

Configuring Management Interfaces ........................................................  113

Configuring Network Datalinks ..............................................................  113

Configuring Network Interfaces .............................................................  116

Configuring Network IP MultiPathing (IPMP) ..........................................  117

Configuring Network Performance and Availability ...................................  118

Configuring Network Routing ................................................................  119

Configuring Storage .....................................................................................  122

▼ Creating a Storage Pool (BUI) ..........................................................  122

▼ Creating a Storage Pool (CLI) ..........................................................  125

▼ Importing an Existing Storage Pool (BUI) ...........................................  128

▼ Importing an Existing Storage Pool (CLI) ...........................................  128

▼ Configuring an All-Flash Storage Pool (BUI) ......................................  130

▼ Configuring an All-Flash Storage Pool (CLI) .......................................  131

▼ Adding a Disk Shelf to an Existing Storage Pool (BUI) .........................  133

6 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Contents

▼ Adding a Disk Shelf to an Existing Storage Pool (CLI) ..........................  135

▼ Adding a Cache, Meta, or Log Device to an Existing Storage Pool

(BUI) ................................................................................................. 137

▼ Adding a Cache, Meta, or Log Device to an Existing Storage Pool

(CLI) .................................................................................................  138

▼ Removing a Cache or Log Device from an Existing Storage Pool (BUI) ....  141

▼ Removing a Cache or Log Device from an Existing Storage Pool (CLI) ..... 142

▼ Unconfiguring a Storage Pool (BUI) ..................................................  143

▼ Unconfiguring a Storage Pool (CLI) ..................................................  144

▼ Renaming a Storage Pool (BUI) ........................................................  145

▼ Renaming a Storage Pool (CLI) ........................................................  146

▼ Scrubbing a Storage Pool (BUI) ........................................................  147

▼ Scrubbing a Storage Pool (CLI) ........................................................  148

▼ Viewing Pool and Device Status (BUI) ...............................................  149

Storage Pool Concepts ..........................................................................  150

Data Profiles for Storage Pools ..............................................................  152

Understanding the Appliance Status ................................................................  155

Dashboard Status .................................................................................  156

Summary of Memory Use .....................................................................  161

Disk Activity Dashboard .......................................................................  162

Dashboard CLI .................................................................................... 164

▼ Running the Dashboard Continuously ................................................. 165

Status Dashboard Settings .....................................................................  166

▼ Changing the Displayed Activity Statistics ..........................................  168

▼ Changing the Activity Thresholds ...................................................... 168

NDMP Status ...................................................................................... 169

NDMP States ......................................................................................  170

Configuring Storage Area Network (SAN) .......................................................  170

▼ Configuring FC Port Modes (BUI) ....................................................  171

▼ Discovering FC Ports (BUI) .............................................................  173

▼ Creating FC Initiator Groups (BUI) ...................................................  174

▼ Associating a LUN with an FC Initiator Group (BUI) ............................  176

▼ Changing FC Port Modes (CLI) ........................................................  177

▼ Discovering FC Ports (CLI) .............................................................  177

▼ Creating FC Initiator Groups (CLI) .................................................... 178

▼ Associating a LUN with an FC Initiator Group (CLI) ............................  179

▼ Scripting Aliases for Initiators and Initiator Groups (CLI) ......................  179

7

Contents

▼ Creating an Analytics Worksheet (BUI) ..............................................  181

▼ Configuring SAN iSER Targets ......................................................... 182

▼ Adding an iSCSI Target with an Auto-generated IQN (CLI) .................... 185

▼ Adding an iSCSI Target with a Specific IQN and RADIUS Authentication

(CLI) .................................................................................................  185

▼ Adding an iSCSI Initiator with CHAP Authentication (CLI) ...................  186

▼ Adding an iSCSI Target Group (CLI) .................................................  187

▼ Adding an iSCSI Initiator Group (CLI) ............................................... 187

▼ Configuring SRP Target (BUI) ..........................................................  188

▼ Configuring SRP Targets (CLI) .........................................................  189

Understanding SAN .............................................................................  190

SAN Fibre Channel Configuration ..........................................................  192

SAN iSCSI Configuration .....................................................................  196

SAN iSCSI Initiator Configuration .........................................................  197

SAN SRP Configuration .......................................................................  199

SAN Terminology ................................................................................ 200

Configuring Users ........................................................................................ 202

▼ Adding an Administrator or User (BUI) .............................................. 203

▼ Adding an Administrator or User (CLI) ..............................................  205

▼ Changing a User Password (BUI) ......................................................  207

▼ Changing a User Password (CLI) ......................................................  208

▼ Editing Exceptions for a User (BUI) ..................................................  209

▼ Editing Exceptions for a User (CLI) ................................................... 209

▼ Deleting Exceptions for a User (BUI) ................................................. 211

▼ Deleting Exceptions for a User (CLI) .................................................  212

▼ Adding a Role (BUI) ......................................................................  213

▼ Adding a Role (CLI) .......................................................................  214

▼ Editing Authorizations for a Role (BUI) .............................................  215

▼ Editing Authorizations for a Role (CLI) .............................................. 215

▼ Deleting Authorizations from a Role (BUI) .........................................  217

▼ Deleting Authorizations from a Role (CLI) .......................................... 217

▼ Adding a User Who Can View the Dashboard ...................................... 218

Understanding Users and Roles ..............................................................  219

User Authorizations .............................................................................  220

Managing User Properties .....................................................................  222

Setting Appliance Preferences ........................................................................  224

▼ Setting Preferences (BUI) ................................................................  224

8 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Contents

▼ Setting Preferences (CLI) ................................................................. 225

▼ Setting SSH Public Keys (BUI) ........................................................  226

▼ Setting SSH Public Keys (CLI) .........................................................  226

Preference Properties ............................................................................  228

Configuring Alerts .......................................................................................  228

▼ Adding an Alert Action (BUI) ..........................................................  229

▼ Adding an Alert Action (CLI) ........................................................... 230

Sending Email Alerts (CLI) ...................................................................  231

Sending an SNMP Trap (CLI) ...............................................................  231

Alert Categories ..................................................................................  232

Threshold Alerts ..................................................................................  233

Resuming/Suspending Analytics Datasets and Worksheets ........................... 234

Configuring Certificates ................................................................................  235

▼ Creating a New Server Certificate (BUI) ............................................. 236

▼ Creating a New Server Certificate (CLI) .............................................  237

▼ Uploading CA Certificates from Non-root CAs (BUI) ...........................  238

▼ Uploading CA Certificates from Non-root CAs (CLI) ............................  239

▼ Viewing CSR and Certificate Details (BUI) .........................................  240

▼ Viewing CSR and Certificate Details (CLI) .........................................  240

▼ Destroying a CSR or Certificate (BUI) ...............................................  241

▼ Destroying a CSR or Certificate (CLI) ................................................ 241

▼ Setting the Appliance Certificate (BUI) ..............................................  242

▼ Setting the Appliance Certificate (CLI) ............................................... 242

▼ Uploading Trusted Certificates (BUI) .................................................  243

▼ Uploading Trusted Certificates (CLI) .................................................  243

▼ Viewing Trusted Certificate Details (BUI) ...........................................  244

▼ Viewing Trusted Certificate Details (CLI) ...........................................  244

▼ Destroying a Trusted Certificate (BUI) ...............................................  245

▼ Destroying a Trusted Certificate (CLI) ................................................ 245

▼ Assigning a Certificate to a Service (BUI) ........................................... 246

▼ Assigning a Certificate to a Service (CLI) ...........................................  246

Appliance Services .......................................................................................... 247

Managing Services ....................................................................................... 248

▼ Viewing a Service in the BUI ...........................................................  248

▼ Selecting a Service in the CLI ..........................................................  249

▼ Enabling a Service (BUI) .................................................................  249

9

Contents

▼ Enabling a Service (CLI) .................................................................  250

▼ Disabling a Service (BUI) ................................................................  250

▼ Disabling a Service (CLI) ................................................................  250

▼ Viewing Service States in the CLI .....................................................  251

▼ Viewing Service Help in the CLI ....................................................... 251

▼ Setting Service Properties (BUI) .......................................................  252

▼ Setting Service Properties (CLI) ........................................................  253

▼ Viewing Service Logs (BUI) ............................................................  254

▼ Viewing Service Logs (CLI) .............................................................  255

List of Available Appliance Services .......................................................  256

Required Service Ports .........................................................................  258

Configuring Services ....................................................................................  258

NFS Configuration ............................................................................... 259

iSCSI Configuration .............................................................................  265

SMB Configuration ..............................................................................  266

FTP Configuration ...............................................................................  285

HTTP Configuration ............................................................................. 288

NDMP Configuration ...........................................................................  291

Shadow Migration Configuration ............................................................  301

SFTP Configuration .............................................................................  301

SRP Configuration ...............................................................................  305

TFTP Configuration .............................................................................  305

Virus Scan Configuration ......................................................................  306

NIS Configuration ...............................................................................  309

LDAP Configuration ............................................................................  311

Active Directory Configuration ..............................................................  318

Identity Mapping Configuration .............................................................  324

DNS Configuration ..............................................................................  335

IPMP Configuration .............................................................................  342

Kerberos Configuration ......................................................................... 343

NTP Configuration ............................................................................... 359

Phone Home Configuration ...................................................................  363

Dynamic Routing Configuration .............................................................  366

Service Tags Configuration .................................................................... 366

SMTP Configuration ............................................................................  366

SNMP Configuration ............................................................................  367

Syslog Configuration ............................................................................  371

10 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Contents

System Identity Configuration ................................................................ 376

SSH Configuration ............................................................................... 377

RESTful API Configuration ................................................................... 379

Shares and Projects ........................................................................................  381

▼ Creating a Project (BUI) ..........................................................................  382

▼ Creating a Project (CLI) ..........................................................................  382

▼ Editing a Project (BUI) ...........................................................................  384

▼ Editing a Project (CLI) ............................................................................  384

▼ Renaming a Project (BUI) ........................................................................ 386

▼ Renaming a Project (CLI) ........................................................................  386

▼ Deleting a Project (BUI) ..........................................................................  387

▼ Deleting a Project (CLI) ..........................................................................  387

▼ Creating a Filesystem or LUN in a Project (BUI) .........................................  388

▼ Creating a Filesystem or LUN in a Project (CLI) .......................................... 389

▼ Editing a Filesystem or LUN (BUI) ...........................................................  391

▼ Editing a Filesystem or LUN (CLI) ...........................................................  392

▼ Renaming a Filesystem or LUN (BUI) .......................................................  393

▼ Renaming a Filesystem or LUN (CLI) ........................................................ 394

▼ Moving a Filesystem or LUN to a Different Project (BUI) .............................. 395

▼ Moving a Filesystem or LUN to a Different Project (CLI) ..............................  395

▼ Deleting a Filesystem or LUN (BUI) .........................................................  396

▼ Deleting a Filesystem or LUN (CLI) .......................................................... 396

▼ Setting User or Group Quotas (BUI) ..........................................................  397

▼ Setting User or Group Quotas (CLI) ..........................................................  398

About Storage Pools, Projects, and Shares ........................................................ 399

Project and Share Properties ..........................................................................  401

Inherited Properties ..............................................................................  402

LUN Local Properties ........................................................................... 409

Other Properties ..................................................................................  410

Static Properties ..................................................................................  411

Project Properties ......................................................................................... 414

Filesystem Properties .................................................................................... 420

LUN Properties ...........................................................................................  428

Space Management for Shares .......................................................................  432

Shares Terminology .....................................................................................  433

Managing Filesystem and Project Space ..........................................................  434

11

Contents

Setting User or Group Quotas ........................................................................  435

Working with Identity Management ................................................................  436

Working with Filesystem Namespace ..............................................................  436

Share Usage Statistics ..................................................................................  438

Share and Project Protocols ...........................................................................  439

NFS Protocol ......................................................................................  439

SMB Protocol .....................................................................................  446

HTTP Protocol ....................................................................................  452

FTP Protocol ......................................................................................  452

SFTP Protocol ..................................................................................... 453

TFTP Protocol ....................................................................................  453

Access Control Lists for Filesystems ...............................................................  453

Root Directory Access ..........................................................................  454

ACL Behavior on Mode Change ............................................................  455

ACL Inheritance Behavior ..................................................................... 456

Root Directory ACL ............................................................................. 457

Working with Schemas .................................................................................  461

▼ Creating a Schema (BUI) .................................................................  461

▼ Creating a Schema (CLI) .................................................................  461

Schema Properties ...............................................................................  463

Shadow Migration ............................................................................................ 465

Understanding Shadow Migration ...................................................................  466

Creating a Shadow Filesystem .......................................................................  468

Managing Background Migration ...................................................................  469

Handling Migration Errors ............................................................................  469

Monitoring Migration Progress ....................................................................... 470

▼ Monitoring Migration Progress and Errors (BUI) .................................. 470

▼ Monitoring Migration Progress and Errors (CLI) ..................................  471

Canceling Migration ..................................................................................... 473

Snapshotting Shadow File Systems .................................................................  473

Backing Up Shadow File Systems ..................................................................  474

Replicating Shadow File Systems ...................................................................  474

Migrating Local File Systems ........................................................................  474

Using Shadow Migration Analytics ................................................................. 475

▼ Testing Potential Shadow Migration using the CLI .......................................  475

▼ Migrating Data from an Active NFS Server using the CLI .............................. 476

12 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Contents

Snapshots and Clones ....................................................................................  477

Snapshot Space Management .........................................................................  478

▼ Taking a Snapshot (BUI) .........................................................................  480

▼ Taking a Snapshot (CLI) .......................................................................... 481

▼ Scheduling Snapshots (BUI) .....................................................................  481

▼ Scheduling Snapshots (CLI) .....................................................................  483

▼ Setting a Scheduled Snapshot Label (BUI) ..................................................  485

▼ Setting a Scheduled Snapshot Label (CLI) ..................................................  485

▼ Viewing Snapshots and Schedules (BUI) ....................................................  486

▼ Viewing Snapshots and Schedules (CLI) .....................................................  487

▼ Editing a Snapshot Retention Policy (BUI) .................................................. 488

▼ Editing a Snapshot Retention Policy (CLI) ..................................................  489

▼ Removing a Snapshot Schedule (BUI) ........................................................ 490

▼ Removing a Snapshot Schedule (CLI) ........................................................  491

▼ Making a Filesystem Snapshot Directory Visible (BUI) .................................  492

▼ Making a Filesystem Snapshot Directory Visible (CLI) .................................. 493

▼ Accessing a Hidden Filesystem Snapshot Directory (CLI) ..............................  494

▼ Accessing a Visible Filesystem Snapshot Directory (CLI) ..............................  494

▼ Renaming a Snapshot (BUI) .....................................................................  495

▼ Renaming a Snapshot (CLI) .....................................................................  496

▼ Rolling Back to a Snapshot (BUI) .............................................................  497

▼ Rolling Back to a Snapshot (CLI) .............................................................. 497

▼ Destroying a Snapshot (BUI) ....................................................................  498

▼ Destroying a Snapshot (CLI) ....................................................................  499

▼ Cloning a Snapshot (BUI) ........................................................................  500

▼ Cloning a Snapshot (CLI) ........................................................................  502

▼ Cloning a Clone .....................................................................................  504

▼ Viewing Clones of a Snapshot (BUI) .........................................................  504

▼ Viewing Clones of a Snapshot (CLI) .......................................................... 505

▼ Viewing a Clone Origin (BUI) ..................................................................  505

▼ Viewing a Clone Origin (CLI) ..................................................................  506

Remote Replication .........................................................................................  507

▼ Remote Replication Workflow ..................................................................  507

Configuring Remote Replication ..................................................................... 508

▼ Checking Source and Target Compatibility ..........................................  509

▼ Setting Up Network Interfaces and Static Routing (BUI) ........................  509

13

Contents

▼ Setting Up Network Interfaces and Static Routing (CLI) ........................  511

▼ Creating a Replication Target (BUI) ...................................................  512

▼ Creating a Replication Target (CLI) ...................................................  513

▼ Creating a Replication Action (BUI) ..................................................  514

▼ Creating a Replication Action (CLI) ..................................................  516

▼ Configuring Automatic Snapshot Retention on a Target (BUI) .................  518

▼ Configuring Automatic Snapshot Retention on a Target (CLI) .................  519

▼ Manually Sending a Replication Update (BUI) ..................................... 521

▼ Manually Sending a Replication Update (CLI) .....................................  522

▼ Configuring Replication for a Clustered Configuration ........................... 522

Configuring Offline Replication (BUI) ....................................................  523

Configuring Offline Replication (CLI) .....................................................  528

▼ Disabling Replication Compression (BUI) ........................................... 540

▼ Disabling Replication Compression (CLI) ...........................................  541

▼ Editing a Replication Target (BUI) ....................................................  542

▼ Editing a Replication Target (CLI) .....................................................  542

▼ Editing a Replication Action (BUI) .................................................... 543

▼ Editing a Replication Action (CLI) ....................................................  543

Monitoring Remote Replication ...................................................................... 544

▼ Monitoring Replication Progress (BUI) ............................................... 544

▼ Monitoring Replication Progress (CLI) ...............................................  545

▼ Setting Replication Alerts ................................................................  547

Replication Audit Actions .....................................................................  548

▼ Monitoring Replication Delays and RPO (BUI) .................................... 549

▼ Monitoring Replication Delays and RPO (CLI) ....................................  550

Using Replication Analytics ..................................................................  552

Managing Replication Packages .....................................................................  552

Managing User-Generated Snapshots ......................................................  553

▼ Canceling a Replication Update (BUI) ................................................ 554

▼ Canceling a Replication Update (CLI) ................................................  555

▼ Cloning a Replication Package (BUI) .................................................  556

▼ Cloning a Replication Package (CLI) .................................................  559

▼ Severing a Replication Package (BUI) ................................................  563

▼ Severing a Replication Package (CLI) ................................................  564

▼ Editing a Replication Package (BUI) ..................................................  564

▼ Editing a Replication Package (CLI) ..................................................  565

▼ Disabling a Replication Package (BUI) ............................................... 567

14 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Contents

▼ Disabling a Replication Package (CLI) ...............................................  567

Disaster Recovery with Remote Replication .....................................................  568

▼ Setting Up a Replication Target at a Recovery Site (BUI) .......................  568

▼ Switching Operations to the Recovery Site (BUI) .................................  569

▼ Updating the Production Site (BUI) ...................................................  570

▼ Reversing Replication Back to the Production Site (BUI) .......................  571

▼ Setting Up a Replication Target at a Recovery Site (CLI) .......................  572

▼ Switching Operations to the Recovery Site (CLI) .................................. 572

▼ Updating the Production Site (CLI) .................................................... 574

▼ Reversing Replication Back to the Production Site (CLI) ........................ 575

Remote Replication Concepts ........................................................................  576

Replication Terminology .......................................................................  578

Replication Targets ............................................................................... 579

Replication Actions and Packages ........................................................... 580

Replication Action Properties ................................................................. 582

Replication Package Properties ............................................................... 585

Replication Storage Pools ...................................................................... 586

Project vs. Share Replication .................................................................  587

Replication Authorizations ....................................................................  588

Deduplicated Replication ......................................................................  589

Replication Configuration for Clustered Appliances ...................................  592

Example: Replication Configuration for Clustered Appliances ...................... 592

Replication Snapshots and Data Consistency ............................................  600

Replication Snapshot Management .......................................................... 601

iSCSI Configurations and Replication .....................................................  604

Resumable Replication .........................................................................  604

Replication Alerts ................................................................................  605

Replication Failures .............................................................................  606

Compressed Replication ........................................................................ 609

Replication Packages ............................................................................  610

Cloning a Replication Package or Share ................................................... 611

Exporting Replicated Filesystems ...........................................................  612

Severing Replication ............................................................................  613

Reverse the Direction of Replication .......................................................  614

Destroying a Replication Package ...........................................................  617

Target Replica Backups ........................................................................  617

15

Contents

Data Encryption ............................................................................................... 619

▼ Data Encryption Workflow .......................................................................  620

▼ Configuring LOCAL Keystore Encryption (BUI) .........................................  620

▼ Configuring LOCAL Keystore Encryption (CLI) ..........................................  623

▼ Configuring OKM Keystore Encryption (BUI) ............................................. 624

▼ Configuring OKM Keystore Encryption (CLI) .............................................  625

▼ Creating an Encrypted Project (BUI) .......................................................... 626

▼ Creating an Encrypted Project (CLI) ..........................................................  627

▼ Changing a Project Encryption Key (BUI) ..................................................  628

▼ Changing a Project Encryption Key (CLI) ................................................... 630

▼ Creating an Encrypted Filesystem or LUN (BUI) .........................................  630

▼ Creating an Encrypted Filesystem or LUN (CLI) ..........................................  631

▼ Changing a Share Encryption Key (BUI) ....................................................  632

▼ Changing a Share Encryption Key (CLI) ....................................................  634

▼ Backing Up a LOCAL Key (BUI) .............................................................  634

▼ Backing Up a LOCAL Key (CLI) .............................................................  635

▼ Deleting an Encryption Key (BUI) ............................................................  635

▼ Deleting an Encryption Key (CLI) .............................................................  638

▼ Restoring a LOCAL Key (BUI) ................................................................  639

▼ Restoring a LOCAL Key (CLI) ................................................................. 640

Encryption Properties ...................................................................................  641

Managing Encryption Keys ...........................................................................  642

Maintaining Keys ................................................................................  643

Understanding Encryption Key Values ..................................................... 643

Performance Impact of Encryption .................................................................. 644

Encryption Key Life Cycle ............................................................................ 645

Backing up and Restoring Encrypted Data .......................................................  645

Replicating an Encrypted Share ...................................................................... 646

Maintenance Workflows ..................................................................................  647

Understanding Workflows .............................................................................  648

Understanding Workflow Parameters ............................................................... 649

Constrained Workflow Parameters ..................................................................  650

Optional Workflow Parameters ....................................................................... 651

Workflow Error Handling .............................................................................. 652

Workflow Input Validation ............................................................................  653

Workflow Execution Auditing and Reporting .................................................... 654

16 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Contents

Understanding Workflow Versioning ...............................................................  657

Using Workflows for Alert Actions ................................................................. 658

Using Scheduled Workflows ..........................................................................  660

Using a Scheduled Workflow ......................................................................... 661

Coding Workflow Schedules .......................................................................... 661

Creating a Worksheet Based on a Specified Drive Type ......................................  663

Uploading and Executing Workflows Using the BUI ..........................................  666

▼ Downloading Workflows using the CLI ......................................................  667

▼ Listing Workflows using the CLI ..............................................................  668

▼ Executing Workflows using the CLI ..........................................................  669

▼ Auditing Workflows using the CLI ............................................................  670

Integration .......................................................................................................  671

Configuring the Oracle ZFS Storage Appliance for Oracle Database Clients ............ 672

Plug-ins for Oracle Products ..........................................................................  672

Oracle Enterprise Manager Plug-in for Oracle ZFS Storage Appliance ...........  673

Oracle VM Storage Connect Plug-in for Oracle ZFS Storage Appliance .........  673

Oracle ZFS Storage Appliance Network File System Plug-in for Oracle Solaris

Cluster ...............................................................................................  674

Oracle ZFS Storage Appliance Plug-in for Oracle Solaris Cluster Geographic

Edition ...............................................................................................  674

Plug-ins for Non-Oracle Products ...................................................................  674

Oracle ZFS Storage Appliance Virtual Storage Manager Plug-ins for VMware vSphere and VMware vSphere Web Client ...............................................  675

Oracle ZFS Storage Appliance Storage Replication Adapter (SRA) for

VMware Site Recovery Manager ............................................................  676

Oracle ZFS Storage Appliance Plug-in for VMware vSphere Storage APIs for

Array Integration (VAAI) – NAS ............................................................ 676

Oracle ZFS Storage Appliance Provider for VMware vSphere APIs for Storage

Awareness (VASA) ..............................................................................  677

Oracle ZFS Storage Appliance Provider for (Microsoft) Volume Shadow Copy

Service Software .................................................................................. 677

Oracle ZFS Storage Appliance Plug-in for Veritas NetBackup OpenStorage ....  678

Oracle ZFS Storage Appliance Plug-in for CommVault Simpana IntelliSnap ...  678

Oracle Intelligent Storage Protocol .................................................................  678

Database Record Size ...........................................................................  679

Synchronous Write Bias Hint ................................................................. 679

Analytics Breakdown by Database Name .................................................  679

17

Contents

Caching Hints .....................................................................................  679

OISP-Capable Protocols and Clients .......................................................  680

Fibre Channel and iSCSI Support with Veritas Dynamic Multi-Pathing and Storage

Foundation/InfoScale Foundation .................................................................... 680

18 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

About the Oracle ZFS Storage Appliance

The Oracle ZFS Storage Appliance (appliance) family of products provides efficient file and block data services to clients over a network, and a rich set of data services that can be applied to the data stored on the system.

For information about configuring and working with the Oracle ZFS Storage Appliance, see the following sections:

Oracle ZFS Storage Appliance Key Features

“Supported Protocols” on page 20

Oracle ZFS Storage Appliance Data Services

“Data Availability” on page 21

Browser User Interface (BUI)

Network Icons

Dashboard Icons

Analytics Icons

Identity Mapping Icons

Supported Browsers

Command Line Interface (CLI)

Working with CLI Scripting

About the Oracle ZFS Storage Appliance 19

Oracle ZFS Storage Appliance Key Features

Oracle ZFS Storage Appliance Key Features

The Oracle ZFS Storage Appliance includes technologies to deliver the best storage price/ performance and unprecedented observability of your workloads in production, including:

Analytics, a system for dynamically observing the behavior of your system in real-time and viewing data graphically

The ZFS Hybrid Storage Pool, composed of optional Flash-memory devices for acceleration of reads and writes, low-power, high-capacity disks, and DRAM memory, all managed transparently as a single data hierarchy

Support for a variety of hardware

For more information about Analytics and Hardware, refer to the documentation on the Oracle

Technology Network (http://www.oracle.com/technetwork/indexes/documentation/ index.html

)

Supported Protocols

The Oracle ZFS Storage Appliance supports a variety of industry-standard client protocols, including NFS, iSCSI, SMB, FTP, HTTP, NDMP, Fibre Channel, SRP, iSER, and SFTP.

For information on these protocols, see the following:

“SAN Fibre Channel Configuration” on page 192

“Configuring SAN iSER Targets” on page 182

“NFS Configuration” on page 259

“iSCSI Configuration” on page 265

“SMB Configuration” on page 266

“FTP Configuration” on page 285

20 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Appliance Data Services

“HTTP Configuration” on page 288

“NDMP Configuration” on page 291

“SFTP Configuration” on page 301

“SRP Configuration” on page 305

Appliance Data Services

To manage the data that you export using these protocols, you can configure the appliance using the built-in collection of advanced data services, including:

RAID-Z (RAID-5 and RAID-6), mirrored, and striped disk configurations (See

“Configuring Storage” on page 122 )

Unlimited read-only and read-write snapshots, with snapshot schedules (See

“Snapshots and

Clones” on page 477 )

Controlling the elimination of duplicate copies of data (See

“Data

Deduplication” on page 404

)

Built-in data compression (See “Data compression” on page 405 )

Remote replication of data for disaster recovery (See

“Remote Replication” on page 507 )

Active-active clustering for high availability (See

“Appliance Cluster

Configuration” on page 58 )

Thin provisioning of iSCSI LUNs (See

“iSCSI Configuration” on page 265 )

Virus scanning and quarantine (See “Virus Scan Configuration” on page 306 )

NDMP backup and restore (See

“NDMP Configuration” on page 291

)

Note -

Replication and Cloning are licensed features. For details, refer to the "Oracle Software

License Agreement ("SLA") and Entitlement for Hardware Systems with Integrated Software

Options" and the Licensing Information User Manual for the software release.

Data Availability

To maximize the availability of your data in production, the appliance includes a complete endto-end architecture for data integrity, including redundancies at every level of the stack. Key features include:

Predictive self-healing and diagnosis of all system hardware failures: CPUs, DRAM, I/O cards, disks, fans, power supplies

About the Oracle ZFS Storage Appliance 21

Browser User Interface (BUI)

ZFS end-to-end data checksums of all data and metadata, protecting data throughout the stack

RAID-6 (double- and triple-parity) and optional RAID-6 across disk shelves

Active-active clustering for high availability (See “Appliance Cluster

Configuration” on page 58 )

Link aggregations and IP multipathing for network failure protection (See

“Network

Configuration” on page 89 )

I/O Multipathing between the controller and disk shelves

Integrated software restart of all system software services (See

“Appliance

Services” on page 247

)

Phone Home of telemetry for all software and hardware issues (See

“Phone Home

Configuration” on page 363

)

Lights-out Management of each system for remote power control and console access

Browser User Interface (BUI)

The Oracle ZFS Storage Appliance Browser User Interface (BUI) is the graphical tool for administration of the appliance. The BUI provides an intuitive environment for administration tasks, visualizing concepts, and analyzing performance data. The BUI provides an uncluttered environment for visualizing system behavior and identifying performance issues with the appliance.

22 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Browser User Interface (BUI)

Direct your browser to the system using either the IP address or host name you assigned to the

NET-0 port during initial configuration as follows: https://ipaddress:215 or https://hostname:

215. The login screen appears.

The online help linked in the top right of the BUI is context-sensitive. For every top-level and second-level screen in the BUI, the associated help page appears when you click the Help button.

About the Oracle ZFS Storage Appliance 23

Browser User Interface (BUI)

Changing a filesystem's properties by moving it into another project using the Projects side panel.

The masthead contains several interface elements for navigation and notification, as well as primary functionality. At left, from top to bottom, are the Sun/Oracle logo, a hardware model badge, and hardware power off/restart button. Across the right, again from top to bottom: login identification, logout, help, main navigation, and subnavigation.

System alerts appear in the Masthead as they are triggered. If multiple alerts are triggered sequentially, refer to the list of recent alerts found on the Dashboard screen or the full log available on the Logs screen.

24 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Browser User Interface (BUI)

Use the main navigation links to view between the Configuration, Maintenance, Shares, Status, and Analytics areas of the BUI. Use sub-navigation links to access features and functions within each area.

If you provide a session annotation, it appears beneath your login ID and the logout control. To change your session annotation for subsequent administrative actions without logging out, click on the text link. For details about session annotations, see

“Configuring Users” on page 202

.

The title bar appears below the Masthead and provides local navigation and functions that vary depending on the current view.

For example, the Identity mapping service title bar enables the following:

Navigation to the full list of services through the side panel

Controls to enable or disable the Identity Mapping service

A view of Identity Mapping uptime

Navigation to the Properties, Rules and Logs screens for your Identity Mapping service

Button to Apply configuration changes made on the current screen

Button to Revert configuration changes applied on the current screen

To quickly navigate between Service and Project views, open and close the side panel by clicking the title or the reveal arrow.

About the Oracle ZFS Storage Appliance 25

Browser User Interface (BUI)

To add projects, click the Add... link in the sidebar.

To move Shares between Projects, click the move icon and drag a filesystem Share to the appropriate Project in the side panel.

Note that dragging a share into another project will change its properties if they are set to be inherited from its parent project.

Most BUI controls use standard web form inputs; however, there are a few key exceptions worth noting:

TABLE 1

Key Web Form Exceptions

Summary of BUI Controls

Modify a property

Add a list item or property entry

Remove a list item or property entry

Save changes

Undo saved changes

Delete an item from a list

Search for an item in a list

Sort by list headings

Move or drag an item

Click the edit icon and complete the dialog

Click the add icon

Click the remove icon

Click the Apply button

Click the Revert button

Click the trash icon (hover the mouse over the item row to see the icon)

Click the search icon at the top right of the list

Click on the bold sub-headings to re-sort the list

Click the move icon

26 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Browser User Interface (BUI)

Summary of BUI Controls

Rename an item

View details about your system

Automatically open side panel

Click the rename icon

Oracle logo or click the model badge to go to the oracle.

com web page for your model

Drag an item to the side panel

When setting permissions, the RWX boxes are clickable targets. Clicking on the access group label (User, Group, Other) toggles all permissions for that label on and off.

To edit Share properties, deselect the Inherit from project checkbox.

To view controls for an item in a list, hover the mouse over the row.

About the Oracle ZFS Storage Appliance 27

Browser User Interface (BUI)

All modal dialogs have titles and buttons that identify and commit or cancel the current action at top, and content below. The modal content area follows the same interface conventions as the main content area, but are different in that they must be dismissed using the buttons in the title bar before other actions can be performed.

Icons indicate system status and provide access to functionality, and in most cases serve as buttons to perform actions when clicked. It is useful to hover your mouse over interface icons to view the tooltip. The tables below provide a key to the conventions of the user interface.

The status lights are basic indicators of system health and service state:

28 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Browser User Interface (BUI)

TABLE 2

Icon

Status Indicators

Description

on off

Icon Description

warning disabled

--

--

--

--

The following icons are found throughout the user interface and cover most of the basic functionality:

BUI Icons

TABLE 3

Icon*

--

--

--

Description

rename (edit text) move edit destroy add remove cancel/close error alert on/off toggle restart locate

-disable/offline lock wait spinner reverse direction

--

--

--

--

--

--

--

--

Icon*

--

Description

sever clone rollback appliance power apply revert info sort list column

(down) sort list column

(up) first page previous page next page last page search menu panel

About the Oracle ZFS Storage Appliance 29

Network Icons

* Disabled icons are shown at left.

The following icons are used to distinguish different types of objects and provide information of secondary importance.

TABLE 4

Icon

Miscellaneous Icons

Description

allow deny storage pool

Icon Description

SAS

SAS port

Network Icons

These icons indicate the state of network devices and type of network datalinks:

TABLE 5

Icon

Network Icons

Description

active network device inactive network device network datalink network datalink VLAN network datalink aggregation network datalink aggregation VLAN

Icon Description

active InfiniBand port inactive InfiniBand port network datalink (IB partition)

Dashboard Icons

The following icons indicate the current state of monitored statistics with respect to userconfigurable thresholds set from within Settings.

30 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Analytics Toolbar Icons

TABLE 6

Icon

Dashboard Icons

Description

sunny partly cloudy cloudy rainy stormy

Icon Description

hurricane hurricane class 2 hurricane class 3 hurricane class 4 hurricane class 5

Analytics Toolbar Icons

This set of icons is used in a toolbar to manipulate display of information within Analytics worksheets.

TABLE 7

Icon

Analytics Toolbar Icons

Description

back

Icon Description

show minimum forward forward to now pause zoom out zoom in show one minute show one hour show maximum show line graph show mountain graph crop outliers sync worksheet to this statistic unsync worksheet statistics drilldown

About the Oracle ZFS Storage Appliance 31

Identity Mapping Icons

Icon Description

show one day show one week show one month

Icon Description

export statistical data

(download to client) save statistical data archive dataset send worksheet with support bundle

For more information about Analytics, refer to the documentation on the Oracle Technology

Network (http://www.oracle.com/technetwork/indexes/documentation/index.html)

Identity Mapping Icons

These icons indicate the type of role being applied when mapping users and groups between

Windows and Unix.

TABLE 8

Icon*

Identity Mapping Icons

Description

allow Windows to Unix deny Windows to Unix allow bidirectional

Icon* Description

allow Unix to Windows deny Unix to Windows

*Disabled icons shown at left.

Related Topics

“Understanding the Appliance Status” on page 155

“Network Configuration” on page 89

“Configuring Storage” on page 122

“Configuring Alerts” on page 228

“Appliance Services” on page 247

For more information about Analytics, refer to the documentation on the Oracle Technology

Network (http://www.oracle.com/technetwork/indexes/documentation/index.html)

32 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Supported Browsers

Supported Browsers

This section defines BUI browser support.

The BUI is fully featured and functional on the following browsers:

Firefox 10 and newer

Internet Explorer 9 and newer

Safari 5 and newer

Google Chrome 31 and newer

BUI elements may be cosmetically imperfect on the following browsers, and some functionality may not be available, although all necessary features work correctly. A warning message appears during login if you are using one of the following browsers:

Firefox 6 to 9

Internet Explorer 7 and 8

Google Chrome 21 to 30

Opera 23 and older

The following browsers are incompatible, unsupported, and known to have issues; login will not complete.

Firefox 5 & older

Internet Explorer 6 & older

Google Chrome 20 & older

Safari 4 & older

Opera 22 & older

Related Topics

“Configuring Users” on page 202

“Setting Appliance Preferences” on page 224

Command Line Interface (CLI)

The CLI is designed to imitate the capabilities of the BUI, while also providing a powerful scripting environment for performing repetitive tasks. The command line is an efficient and powerful tool for repetitive administrative tasks. The appliance presents a CLI available through

About the Oracle ZFS Storage Appliance 33

Command Line Interface (CLI) either the Console or SSH. There are several situations in which the preferred interaction with the system is the CLI:

Network unavailability - If the network is unavailable, browser-based management is impossible; the only vector for management is the Console, which can only accommodate a text-based interface

Expediency - Starting a browser may be prohibitively time-consuming, especially if you only want to examine a particular aspect of the system or make a quick configuration change

Precision - In some situations, the information provided by the browser may be more qualitative than quantitative in nature, and you need a more precise answer

Automation - Browser-based interaction cannot be easily automated; if you have repetitive or rigidly defined tasks, script the tasks

Accessibility - The CLI is an alternative, and equivalent, way to access the BUI features and functionality. Because the operating systems that run on Oracle ZFS Storage Appliance systems support assistive technologies to read the content of the screen, you can use the

CLI as an equivalent means to access the color-based, mouse-based, and other visualbased utilities that are part of the BUI. For example, you can use a keyboard to enter CLI commands to identify faulted hardware components, check system status, and monitor system health.

Oracle strives to make its products, services, and supporting documentation usable and accessible to the disabled community. To that end, products, services, and documentation include features that make the product accessible to users of assistive technology. For more information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website (http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc) .

When navigating through the CLI, there are two principles to be aware of:

Tab completion is used extensively - if you are not sure what to type in any given context, pressing the Tab key will provide you with possible options. Throughout the documentation, pressing Tab is presented as the word "tab" in bold italics.

Help is always available - the help command provides context-specific help. Help on a particular topic is available by specifying the topic as an argument to help, for example help commands

. Available topics are displayed by tab-completing the help command, or by typing help topics.

You can combine these two principles as follows: dory:> help

tab builtins commands general help properties script

To log in remotely using the CLI, use an ssh client. If you have not followed the instructions in

“Configuring Users” on page 202

to administer the appliance, you will need to log in as

34 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Command Line Interface (CLI) root

. When you log in, the CLI will present you with a prompt that consists of the hostname, followed by a colon, followed by a greater-than sign:

% ssh [email protected]

Password:

Last login: Mon Oct 13 15:43:05 2009 from kiowa.sf.fishpo

dory:>

Related Topics

“Browser User Interface (BUI)” on page 22

“CLI Contexts” on page 35

“CLI Properties” on page 42

CLI Contexts

A central principle in the CLI is the context in which commands are executed. The context dictates which elements of the system can be managed and which commands are available.

Contexts have a tree structure in which contexts may themselves contain nested contexts and the structure generally mirrors that of the views in the BUI.

The initial context upon login is the root context, and serves as the parent or ancestor of all contexts. To navigate to a context, execute the name of the context as a command. For example, the functionality available in the Configuration view in the browser is available in the configuration context of the CLI. From the root context, this can be accessed by typing it directly: dory:> configuration dory:configuration>

Note that the prompt changes to reflect the context, with the context provided between the colon and the greater-than sign in the prompt.

The show command shows child contexts. For example, from the configuration context: dory:configuration> show

Children:

net => Configure networking

services => Configure services

version => Display system version

users => Configure administrative users

roles => Configure administrative roles

preferences => Configure user preferences

alerts => Configure alerts

storage => Configure Storage

About the Oracle ZFS Storage Appliance 35

Command Line Interface (CLI)

These child contexts correspond to the views available under the Configuration view in the browser, including Network, Services, Users, Preferences, and so on. To select one of these child contexts, type its name: dory:configuration> preferences dory:configuration preferences>

Navigate to a descendant context directly from an ancestor by specifying the intermediate contexts separated with spaces. For example, to navigate directly to configuration preferences

from the root context, simply type it: dory:> configuration preferences dory:configuration preferences>

Some child contexts are dynamic in that they correspond not to fixed views in the browser, but rather to dynamic entities that have been created by either the user or the system. There are two ways to navigate to these contexts: You can use the select command followed by the name of the dynamic context, or surround the name of the dynamic context with double quotes.

The names of the dynamic contexts contained within a given context are shown using the list command. For example, the users context is a static context, but each user is its own dynamic context.

dory:> configuration users dory:configuration users> list

NAME USERNAME UID TYPE

John Doe bmc 12345 Dir

Super-User root 0 Loc

To select the user named bmc, issue the command select bmc or "bmc": dory:configuration users> "bmc" dory:configuration users bmc>

Alternately, double quotes, select and destroy can in some contexts be used to select an entity based on its properties. For example, one could select log entries issued by the reboot module in the maintenance logs system context by issuing the following command: dory:maintenance logs system> select module=reboot dory:maintenance logs system entry-034> show

Properties:

timestamp = 2016-8-14 06:24:41

module = reboot

priority = crit

text = initiated by root on /dev/console syslogd: going down on signal 15

As with other commands, select or double quotes may be appended to a context-changing command. For example, to select the user named bmc from the root context:

36 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Command Line Interface (CLI) dory:> configuration users select bmc dory:configuration users bmc>

Use the last command to navigate to a previously selected or created context. The following example creates a replication action, and then uses the last and get id commands to retrieve the replication action ID. Then a different action is selected, and the last and get id commands are used to retrieve the ID of the last-visited replication action.

Using last, you can return to the last-visited node: dory:configuration net interfaces> "igb4" dory:configuration net interfaces igb4> done dory:configuration net interfaces> last net:configuration net interfaces igb4>

The last command is also useful to retrieve values that have been automatically set by the appliance during the creation of a dynamic node. For example, each replication action is assigned an ID by the appliance when it is created. Using the last command with the get id command, you can retrieve the ID without using the name of the replication action: dory:shares p1/share replication> create dory:shares p1/share action (uncommitted)> set target=dory

target = dory (uncommitted) dory:shares p1/share action (uncommitted)> set pool=p0

pool = p0 (uncommitted) dory:shares p1/share action (uncommitted)> commit dory:shares p1/share replication> last get id

id = 7034367a-d4d8-e26f-fa93-c3b454e3b595 dory:shares p1/share replication>

Note that when last is combined with another command (in this case, get id), the command is run in the context of the last-visited node, but the current node remains unchanged.

Because last allows you to retrieve the last-visited node and its values without specifying the name of the node, this command is particularly convenient for scripting: script

project = 'myproj';

target = 'mytarget';

target_pool = 'notmypool';

run('cd /');

run('shares select ' + project);

run('replication');

run('create');

set('target', target);

set('pool', target_pool);

run('commit');

About the Oracle ZFS Storage Appliance 37

Command Line Interface (CLI)

run('last');

id = get('id');

printf("Sending update for replication action id %s ...", id);

run('sendupdate');

while (get('state') != 'idle') {

printf(".");

run('sleep 1');

}

printf("done\n");

.

To return to the previous context, use the done command: dory:configuration> done dory:>

This returns to the previous context, which is not necessarily the parent context, as follows: dory:> configuration users select bmc dory:configuration users bmc> done dory:>

The done command can be used multiple times to backtrack to earlier contexts: dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> done dory:configuration users> done dory:configuration> done dory:>

To navigate to a parent context, use the cd command. Inspired by the classic UNIX command, cd

takes an argument of ".." to denote moving to the parent context: dory:> configuration users select bmc dory:configuration users bmc> cd ..

dory:configuration users>

And as with the UNIX command, "cd /" moves to the root context: dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> cd / dory:>

And as with its UNIX analogue, "cd ../.." may be used to navigate to the grandparent context:

38 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Command Line Interface (CLI) dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> cd ../..

dory:configuration>

Note that the cd / and cd .. commands support limited variations. For more versatility, use the top

command and the up command.

Use the top command to navigate to the root context: dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> top dory:>

Use the top command followed by a context name to directly navigate to the specified context relative to the root context. For example, to directly navigate from context configuration users

to context configuration services, use the top configuration services command: dory:> configuration dory:configuration> users dory:configuration users> top configuration services dory:configuration services>

When the top command is used in conjunction with a specific context, the done command can be used to navigate back to the context before the top command was executed. In the following example, the first done command returns to the previous context. The second done command returns to the context before the top command. The third done command returns to the context two nodes before the top command.

dory:> maintenance system dory:maintenance system> updates dory:maintenance system updates> top configuration services dory:configuration services> ftp dory:configuration services ftp> done dory:configuration services> done dory:maintenance system updates> done dory:>

Like the cd .. command, the up command can be used to navigate to the parent context: dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> up dory:configuration users>

About the Oracle ZFS Storage Appliance 39

Command Line Interface (CLI)

Additionally, you can go to a context n nodes up from the current context by repeating the up command n times: dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> up up dory:configuration>

To go back to a specific context relative to the current parent context, enter the context name after the up command. Likewise, use the up up command followed by a context name to go back to a specific context relative to the current grandparent context. For example, to go from context configuration users bmc to context configuration services, use the command up up services

: dory:> configuration dory:configuration> users dory:configuration users> select bmc dory:configuration users bmc> up up services dory:configuration services>

When the up command is used in conjunction with a specific context, the done command can be used to navigate back to the context before the up command was executed. In the following example, the first done command returns to the context before the up command. The second done

command returns to the context two nodes before the up command, and the third done command returns to the context three nodes before the up command.

dory:> configuration dory:configuration> services dory:configuration services> ftp dory:configuration services ftp> up http dory:configuration services http> done dory:configuration services ftp> done dory:configuration services> done dory:configuration> done dory:>

Context names will tab complete, be they static contexts (via normal command completion) or dynamic contexts (via command completion of the select command). Following is an example of selecting the user named bmc from the root context with just fifteen keystrokes, instead of the thirty-one that would be required without tab completion: dory:> config

tab dory:> configuration u

tab dory:> configuration users se

tab dory:> configuration users select

tab bmc root

40 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Command Line Interface (CLI) dory:> configuration users select b

tab dory:> configuration users select bmc

enter dory:configuration users bmc>

Once in a context, execute context-specific commands. For example, to get the current user's preferences, execute the get command from the configuration preferences context: dory:configuration preferences> get

locale = C

login_screen = status/dashboard

session_timeout = 15

session_annotation =

advanced_analytics = false

If there is input following a command that changes context, that command will be executed in the target context, but control will return to the calling context. For example, to get preferences from the root context without changing context, append the get command to the context navigation commands: dory:> configuration preferences get

locale = C

login_screen = status/dashboard

session_timeout = 15

session_annotation =

advanced_analytics = false

When creating a new entity in the system, the context associated with the new entity will often be created in an uncommitted state. For example, create a threshold alert by executing the create

command from the configuration alerts threshold context: dory:> configuration alerts thresholds create dory:configuration alerts threshold (uncommitted)>

The (uncommitted) in the prompt denotes that this an uncommitted context. An uncommitted entity is committed via the commit command; any attempt to navigate away from the uncommitted context will prompt for confirmation: dory:configuration alerts threshold (uncommitted)> cd /

Leaving will abort creation of "threshold". Are you sure? (Y/N)

When committing an uncommitted entity, the properties associated with the new entity will be validated, and an error will be generated if the entity cannot be created. For example, the creation of a new threshold alert requires the specification of a statistic name; failure to set this name results in an error: dory:configuration alerts threshold (uncommitted)> commit error: missing value for property "statname"

About the Oracle ZFS Storage Appliance 41

Command Line Interface (CLI)

To resolve the problem, address the error and reattempt the commit: dory:configuration alerts threshold (uncommitted)> set statname=cpu.utilization

statname = cpu.utilization (uncommitted) dory:configuration alerts threshold (uncommitted)> commit error: missing value for property "limit" dory:configuration alerts threshold (uncommitted)> set limit=90

limit = 90 (uncommitted) dory:configuration alerts threshold (uncommitted)> commit dory:configuration alerts thresholds> list

THRESHOLD LIMIT TYPE STATNAME threshold-000 90 normal cpu.utilization

Related Topics

“Command Line Interface (CLI)” on page 33

“CLI Properties” on page 42

CLI Properties

Properties are typed name/value pairs that are associated with a context. Properties for a given context can be ascertained by running the "help properties" command. Following is an example of retrieving the properties associated with a user's preferences: dory:configuration preferences> help properties

Properties that are valid in this context:

locale => Locality

login_screen => Initial login screen

session_timeout => Session timeout

session_annotation => Current session annotation

advanced_analytics => Make available advanced analytics statistics

The properties of a given context can be retrieved with the get command. Following is an example of using the get command to retrieve a user's preferences:

dory:configuration preferences> get

locale = C

login_screen = status/dashboard

session_timeout = 15

session_annotation =

advanced_analytics = false

42 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Command Line Interface (CLI)

The get command will return any properties provided to it as arguments. For example, to get the value of the login_screen property: dory:configuration preferences> get login_screen

login_screen = status/dashboard

The get command will tab complete with the names of the available properties. For example, to see a list of available properties for the iSCSI service: dory:> configuration services iscsi get

tab

<status> isns_server radius_secret target_chap_name isns_access radius_access radius_server target_chap_secret

The select command, or a command surrounded by double quotes, will select a dynamic node by property. For example, to select key-000 by user: hostname:configuration services sftp keys> show

Keys:

NAME MODIFIED CIPHER USER COMMENT key-000 2015-6-5 19:48:23 RSA u1 1 hostname:configuration services sftp keys> "user=u1" hostname:configuration services sftp key-000>

The set command will set a property to a specified value, with the property name and its value separated by an equals sign. For example, to set the login_screen property to be "shares": dory:configuration preferences> set login_screen=shares

login_screen = shares (uncommitted)

Note that in the case of properties that constitute state on the appliance, setting the property does not change the value, but rather records the set value and indicates that the value of the property is uncommitted.

To force set property values to take effect, they must be explicitly committed, allowing multiple values to be changed as a single, coherent change. To commit any uncommitted property values, use the commit command: dory:configuration preferences> get login_screen

login_screen = shares (uncommitted) dory:configuration preferences> commit dory:configuration preferences> get login_screen

login_screen = shares

If you attempt to leave a context that contains uncommitted properties, you will be warned that leaving will abandon the set property values, and will be prompted to confirm that you with to leave. For example:

About the Oracle ZFS Storage Appliance 43

Command Line Interface (CLI) dory:configuration preferences> set login_screen=maintenance/hardware

login_screen = maintenance/hardware (uncommitted) dory:configuration preferences> done

You have uncommitted changes that will be discarded. Are you sure? (Y/N)

If a property in a context is set from a different context -- that is, if the set command has been appended to a command that changes context -- the commit is implied, and happens before control is returned to the originating context. For example: dory:> configuration preferences set login_screen=analytics/worksheets

login_screen = analytics/worksheets dory:>

Some properties take a list of values. For these properties, the list elements should be separated by a comma. For example, the NTP servers property may be set to a list of NTP servers: dory:configuration services ntp> set servers=0.pool.ntp.org,1.pool.ntp.org

servers = 0.pool.ntp.org,1.pool.ntp.org (uncommitted) dory:configuration services ntp> commit

If a property value contains a comma, an equals sign, a quote or a space, the entire value must be double quoted. For example, the sharenfs shares property for the default project may be set

to read-only, but provide read/write access to host kiowa. For more information, see “Shares and Projects” on page 381 .

dory:> shares select default dory:shares default> set sharenfs="ro,rw=kiowa"

sharenfs = ro,rw=kiowa (uncommitted) dory:shares default> commit

Some properties are immutable; you can get their values, but you cannot set them. Attempts to set an immutable property results in an error. For example, attempting to set the immutable space_available

property of the default project. For more information, see

“Shares and

Projects” on page 381

.

dory:> shares select default dory:shares default> get space_available

space_available = 1.15T

dory:shares default> set space_available=100P error: cannot set immutable property "space_available"

Some other properties are only immutable in certain conditions. For these properties, the set command is not valid. For example, if the user named bmc is a network user, the fullname property will be immutable: dory:> configuration users select bmc set fullname="Rembrandt Q. Einstein" error: cannot set immutable property "fullname"

Related Topics

44 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Working with CLI Scripting

“Browser User Interface (BUI)” on page 22

“Command Line Interface (CLI)” on page 33

Working with CLI Scripting

The CLI is designed to provide a powerful scripting environment for performing repetitive tasks.

You can use Batching Commands or Scripting Commands (or some combination), but in any case the automated infrastructure requires automated access to the appliance. This must be done by user configuration, user authorizations, and setting SSH public keys using the CLI.

For information about configuring users, see the following:

“Configuring Users” on page 202

“User Authorizations” on page 220

“Setting SSH Public Keys (CLI)” on page 226

To use CLI scripting, use the following sections:

Using Batch Commands

Understanding the CLI Scripting Commands

Accessing the CLI Script Environment

Understanding the Built-in CLI Functions

Using the Run Function

Using the Get Function

Using the List Function

Using the Children Function

Using the Choices Function

Using the Functions for Generating Output

Understanding CLI Scripting Errors

Using Batch Commands

The simplest scripting mechanism is to batch appliance shell commands. For example, to automatically take a snapshot called "newsnap" in the project "myproj" and the filesystem

"myfs", put the following commands in a file: shares select myproj

About the Oracle ZFS Storage Appliance 45

Accessing the CLI Script Environment select myfs snapshots snapshot newsnap

Then ssh onto the appliance, redirecting standard input to be the file:

% ssh [email protected] < myfile.txt

In many shells, you can abbreviate this by using a "here file", where input up to a token is sent to standard input. Following is the above example in terms of a here file:

% '''ssh [email protected] << EOF shares select myproj select myfs snapshots snapshot newsnap

EOF'''

This mechanism is sufficient for the simplest kind of automation, and may be sufficient if wrapped in programmatic logic in a higher-level shell scripting language on a client, but it generally leaves much to be desired.

Understanding the CLI Scripting Commands

While batching commands is sufficient for the simplest of operations, it can be tedious to wrap in programmatic logic. For example, if you want to get information on the space usage for every share, you must have many different invocations of the CLI, wrapped in a higher level language on the client that parsed the output of specific commands. This results in slow, brittle automation infrastructure. To allow for faster and most robust automation, the appliance has a rich scripting environment based on ECMAScript 3. An ECMAScript tutorial is beyond the scope of this document, but it is a dynamically typed language with a C-like syntax that allows for:

Conditional code flow (if/else)

Iterative code flow (while, for, etc.)

Structural and array data manipulation via first-class Object and Array types

Perl-like regular expressions and string manipulation (split(), join(), etc.)

Exceptions

Sophisticated functional language features like closures

1.

Accessing the CLI Script Environment

In the CLI, enter the script environment using the script command:

46 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Accessing the CLI Script Environment

2.

3.

dory:> script

("." to run)>

At the script environment prompt, you can input your script, finally entering "." alone on a line to execute it:

dory:> script

("." to run)> for (i = 10; i > 0; i--)

("." to run)> printf("%d... ", i);

("." to run)> printf("Blastoff!\n");

("." to run)> .

10... 9... 8... 7... 6... 5... 4... 3... 2... 1... Blastoff!

If your script is a single line, you can simply provide it as an argument to the script

command, making for an easy way to explore scripting:

dory:> script print("It is now " + new Date())

It is now Tue Oct 14 2009 05:33:01 GMT+0000 (UTC)

Understanding the Built-in CLI Functions

Of course, scripts are of little utility unless they can interact with the system at large. There are several built-in functions that allow your scripts to interact with the system:

TABLE 9

Function

get list run props set choices

Built-in Functions to Support System Interactions

Description

Gets the value of the specified property. Note that this function returns the value in native form, e.g. dates are returned as Date objects.

Returns an array of tokens corresponding to the dynamic children of the current context.

Runs the specified command in the shell, returning any output as a string. Note that if the output contains multiple lines, the returned string will contain embedded newlines.

Returns an array of the property names for the current node.

Takes two string arguments, setting the specified property to the specified value.

Returns an array of the valid property values for any property for which the set of values is known and enumerable.

About the Oracle ZFS Storage Appliance 47

Using the Run Function

1.

2.

Using the Run Function

The simplest way for scripts to interact with the larger system is to use the "run" function: it takes a command to run, and returns the output of that command as a string. For example:

dory:> configuration version script dump(run('get boot_time'))

' boot_time = 2009-10-12 07:02:17\n'

The built-in dump function dumps the argument out, without expanding any embedded newlines. ECMAScript's string handling facilities can be used to take apart output. For example, splitting the above based on whitespace:

dory:> configuration version script dump(run('get boot_time').split(/\s+/))

[&#39;', 'boot_time', '=', '2009-10-12', '07:02:17', &#39;']

1.

2.

Using the Get Function

The run function is sufficiently powerful that it may be tempting to rely exclusively on parsing output to get information about the system -- but this has the decided disadvantage that it leaves scripts parsing human-readable output that may or may not change in the future. To more robustly gather information about the system, use the built-in "get" function. In the case of the boot_time property, this will return not the string but rather the ECMAScript Date object, allowing the property value to be manipulated programmatically.

For example, you might want to use the boot_time property in conjunction with the current time to determine the time since boot:

script

run('configuration version');

now = new Date();

uptime = (now.valueOf() - get('boot_time').valueOf()) / 1000;

printf('up %d day%s, %d hour%s, %d minute%s, %d second%s\n',

d = uptime / 86400, d < 1 || d >= 2 ? 's' : '',

h = (uptime / 3600) % 24, h < 1 || h >= 2 ? 's': '',

m = (uptime / 60) % 60, m < 1 || m >= 2 ? 's': '',

s = uptime % 60, s < 1 || s >= 2 ? 's': '');

Assuming the above is saved as a "uptime.aksh", you could run it this way:

% ssh [email protected] < uptime.aksh

Pseudo-terminal will not be allocated because stdin is not a terminal.

Password: up 2 days, 10 hours, 47 minutes, 48 seconds

48 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Using the List Function

The message about pseudo-terminal allocation is due to the ssh client; the issue that this message refers to can be dealt with by specifying the "-T" option to ssh.

1.

2.

Using the List Function

In a context with dynamic children, it can be very useful to iterate over those children programmatically. This can be done by using the list function, which returns an array of dynamic children.

The following example script iterates over every share in every project, printing out the amount of space consumed and space available:

script

run('shares');

projects = list();

for (i = 0; i < projects.length; i++) {

run('select ' + projects[i]);

shares = list();

for (j = 0; j < shares.length; j++) {

run('select ' + shares[j]);

printf("%s/%s %1.64g %1.64g\n", projects[i], shares[j],

get('space_data'), get('space_available'));

run('cd ..');

}

run('cd ..');

}

Here is the output of running the script, assuming it were saved to a file named

"space.aksh":

% ssh [email protected] < space.aksh

Password: admin/accounts 18432 266617007104 admin/exports 18432 266617007104 admin/primary 18432 266617007104 admin/traffic 18432 266617007104 admin/workflow 18432 266617007104 aleventhal/hw_eng 18432 266617007104 bcantrill/analytx 1073964032 266617007104 bgregg/dashbd 18432 266617007104 bgregg/filesys01 26112 107374156288

About the Oracle ZFS Storage Appliance 49

Using the List Function

3.

4.

bpijewski/access_ctrl 18432 266617007104

...

If one would rather a "pretty printed" (though more difficult to handle programmatically) variant of this, one could directly parse the output of the get command:

script

run('shares');

projects = list();

printf('%-40s %-10s %-10s\n', 'SHARE', 'USED', 'AVAILABLE');

for (i = 0; i < projects.length; i++) {

run('select ' + projects[i]);

shares = list();

for (j = 0; j < shares.length; j++) {

run('select ' + shares[j]);

share = projects[i] + '/' + shares[j];

used = run('get space_data').split(/\s+/)[3];

avail = run('get space_available').split(/\s+/)[3];

printf('%-40s %-10s %-10s\n', share, used, avail);

run('cd ..');

}

run('cd ..');

}

Here is the output of running this new script, assuming it were named

"prettyspace.aksh":

% ssh [email protected] < prettyspace.aksh

Password:

SHARE USED AVAILABLE admin/accounts 18K 248G admin/exports 18K 248G admin/primary 18K 248G admin/traffic 18K 248G admin/workflow 18K 248G aleventhal/hw_eng 18K 248G bcantrill/analytx 1.00G 248G bgregg/dashbd 18K 248G bgregg/filesys01 25.5K 100G bpijewski/access_ctrl 18K 248G

...

50 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Using the List Function

5.

6.

The list function supports optional arguments depth and filter.

The format is: list ([depth, [filter]]). The argument depth can be defined by a number.

The greater number of depth, the more details will be returned. The argument filter is formatted as {<prop1>:<val1>, <prop2>:<val2> ...}. If filter is specified, depth must also be specified.

Usage and input behavior:

■ list()

- Returns only node names.

list(0)

- Return properties of node and only children names.

list(0, {kiosk_mode: true})

- Return a filtered list for kiosk_mode is true with names of children.

list(1)

- Return properties of node, names and properties of children, only names of grandchildren.

list(1, {kiosk_mode: true})

- Return a filtered list for kiosk_mode is true with details up to depth=1.

list(2)

- Return properties of node, names and properties of children and list(0) output of grandchildren.

list(2, {fullname:'Super*', kiosk_mode: true})

- Return a filtered list for fullname containing Super and kiosk_mode is true with details up to depth=2.

This is an example output for a list with depth=2:

The label name shows the name of the list item (that is, a node). The label properties shows the properties of the list item. The label children shows static children of the list item. The label list shows dynamic children of the list item.

script

("." to run)> dump(list(2));

("." to run)> .

[{

name: 'restuser',

properties: {

kiosk_screen: 'status/dashboard',

kiosk_mode: false,

roles: ['basic'],

require_annotation: false,

initial_password: 'DummyPassword',

fullname: 'REST User',

logname: 'restuser'

},

children: [{

name: 'preferences',

About the Oracle ZFS Storage Appliance 51

Using the Children Function

properties: {

advanced_analytics: false,

session_timeout: 15,

login_screen: 'status/dashboard',

locale: 'C'

}

}, {

name: 'exceptions',

list: [{

name: 'auth-000',

properties: {

allow_configure: false,

scope: 'alert'

}

}, {

name: 'auth-001',

properties: {

allow_workgroup: false,

allow_domain: false,

name: '*',

scope: 'ad'

}

}]

}]

}]

1.

Using the Children Function

Even in a context with static children, it can be useful to iterate over those children programmatically. This can be done by using the children function, which returns an array of static children.

For example, here's a script that iterates over every service, printing out the status of the service:

configuration services script

var svcs = children();

for (var i = 0; i < svcs.length; ++i) {

run(svcs[i]);

try {

printf("%-10s %s\n", svcs[i], get('<status>'));

} catch (err) { }

run("done");

52 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Using the Choices Function

2.

}

Here's the output of running the script, assuming it were saved to a file named

"svcinfo.aksh":

% ssh [email protected] < space.aksh

Password: cifs disabled dns online ftp disabled http disabled identity online idmap online ipmp online iscsi online ldap disabled ndmp online nfs online nis online ntp online scrk online sftp disabled smtp online snmp disabled ssh online tags online vscan disabled

1.

Using the Choices Function

The choices function returns an array of the valid property values for any property for which the set of values is known and enumerable. For example, the following script retrieves the list of all pools on the shares node using the choices function and then iterates all pools to list projects and shares along with the available space.

For example, the following script retrieves the list of all pools on the shares node using the choices function and then iterates all pools to list projects and shares along with the available space.

fmt = '%-40s %-15s %-15s\n'; printf(fmt, 'SHARE', 'USED', 'AVAILABLE'); run('cd /'); run('shares'); pools = choices('pool'); for (p = 0; p < pools.length; p++) {

About the Oracle ZFS Storage Appliance 53

Using the Choices Function

2.

set('pool', pools[p]);

projects = list();

for (i = 0; i < projects.length; i++) {

run('select ' + projects[i]);

shares = list();

for (j = 0; j < shares.length; j++) {

run('select ' + shares[j]);

share = pools[p] + ':' + projects[i] + '/' + shares[j];

printf(fmt, share, get('space_data'),

get('space_available'));

run('cd ..');

}

run('cd ..');

}

}

Here is the output of running the script:

SHARE USED AVAILABLE pond:projectA/fs1 31744 566196178944 pond:projectA/fs2 31744 566196178944 pond:projectB/lun1 21474836480 587670999040 puddle:deptA/share1 238475 467539219283 puddle:deptB/share1 129564 467539219283 puddle:deptB/share2 19283747 467539219283

Using the Functions for Generating Output

Reporting state on the system requires generating output. Scripts have several built-in functions made available to them to generate output:

TABLE 10

Function

dump print printf

Built-in Functions for Generating Output

Description

Dumps the specified argument to the terminal, without expanding embedded newlines. Objects will be displayed in a JSON-like format. Useful for debugging.

Prints the specified object as a string, followed by a newline. If the object does not have a toString method, it will be printed opaquely.

Like C's printf(3C), prints the specified arguments according to the specified formatting string.

54 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Using the Choices Function

Understanding CLI Scripting Errors

When an error is generated, an exception is thrown. The exception is generally an object that contains the following members:

■ code

- a numeric code associated with the error message

- a human-readable message associated with the error

Exceptions can be caught and handled, or they may be thrown out of the script environment. If a script environment has an uncaught exception, the CLI will display the details. For example: dory:> script run('not a cmd') error: uncaught error exception (code EAKSH_BADCMD) in script: invalid command

"not a cmd" (encountered while attempting to run command "not a cmd")

You could see more details about the exception by catching it and dumping it out: dory:> script try { run('not a cmd') } catch (err) { dump(err); }

{

toString: <function>,

code: 10004,

message: 'invalid command "not a cmd" (encountered while attempting to

run command "not a cmd")'

}

This also allows you to have rich error handling, for example:

#!/usr/bin/ksh -p ssh -T [email protected] <<EOF script

try {

run('shares select default select $1');

} catch (err) {

if (err.code == EAKSH_ENTITY_BADSELECT) {

printf('error: "$1" is not a share in the ' +

'default project\n');

exit(1);

}

throw (err);

}

printf('"default/$1": compression is %s\n', get('compression'));

exit(0);

EOF

About the Oracle ZFS Storage Appliance 55

Using the Choices Function

If this script is named "share.ksh" and run with an invalid share name, a rich error message will be generated:

% ksh ./share.ksh bogus error: "bogus" is not a share in the default project

56 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring the Appliance

To configure the appliance, use the following sections:

“Initial Appliance Configuration” on page 57

“Appliance Cluster Configuration” on page 58

“Network Configuration” on page 89

“Configuring Storage” on page 122

“Understanding the Appliance Status” on page 155

“Configuring Storage Area Network (SAN)” on page 170

“Configuring Users” on page 202

“Setting Appliance Preferences” on page 224

“Configuring Alerts” on page 228

“Configuring Certificates” on page 235

Initial Appliance Configuration

If you are setting up a new appliance, follow the initial configuration steps in “Configuring the

Appliance for the First Time” in Oracle ZFS Storage Appliance Installation Guide .

You can repeat initial configuration at a later time by clicking the INITIAL SETUP button on the Maintenance > System screen, or by entering the maintenance system setup context in the

CLI.

Related Topics

“Appliance Cluster Configuration” on page 58

“Network Configuration” on page 89

“Configuring Storage” on page 122

Configuring the Appliance 57

Appliance Cluster Configuration

Appliance Cluster Configuration

The Oracle ZFS Storage Appliance supports cooperative clustering of appliances. This strategy can be part of an integrated approach to availability enhancement that may also include clientside load balancing, proper site planning, proactive and reactive maintenance and repair, and the single-appliance hardware redundancy built into all Oracle ZFS Storage Appliances.

Note -

If you are configuring clustering for two new controllers, follow the procedure

“Configuring the Appliance for the First Time” in Oracle ZFS Storage Appliance Installation

Guide

.

For tasks related to appliance clustering, see:

“Connecting Cluster Cables” in Oracle ZFS Storage Appliance Cabling Guide

“Cluster Configuration BUI View” on page 58

“Upgrading a Standalone Appliance to a Clustered Configuration (BUI)” on page 60

“Shutting Down a Clustered Configuration (CLI)” on page 64

For a better understanding about appliance clustering, see:

“Cluster Terminology” on page 66

“Understanding Clustering” on page 66

“Cluster Advantages and Disadvantages” on page 68

“Cluster Interconnect I/O” on page 70

“Cluster Resource Management” on page 71

“Cluster Takeover and Failback” on page 74

“Configuration Changes in a Clustered Environment” on page 76

“Clustering Considerations for Storage” on page 77

“Clustering Considerations for Networking” on page 79

“Private Local IP Interfaces” on page 81

“Clustering Considerations for InfiniBand” on page 82

“Preventing Split-Brain Conditions” on page 85

“Estimating and Reducing Takeover Impact” on page 87

Cluster Configuration BUI View

The Configuration > Cluster view provides a graphical overview of the status of the cluster card, the cluster controller node states, and all of the resources.

58 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Appliance Cluster Configuration

FIGURE 1

Cluster Connections

Note -

Cluster cables must be connected between the two controllers to see the three solid line connections in the BUI. For cluster cabling details, see “Connecting Cluster Cables” in Oracle

ZFS Storage Appliance Cabling Guide

.

The interface contains the following objects:

A thumbnail picture of each system, with the system whose administrative interface is being accessed shown at left. Each thumbnail is labeled with the canonical appliance name, and its current cluster state (the icon above, and a descriptive label).

A thumbnail of each cluster card connection that dynamically updates with the hardware: a solid line connects a link when that link is connected and active, and the line disappears if that connection is broken or while the other system is restarting/rebooting.

A list of the PRIVATE and SINGLETON resources currently assigned to each system, shown in lists below the thumbnail of each cluster node, along with various attributes of the resources.

For each resource, the appliance to which that resource is assigned (that is, the appliance that will provide the resource when both are in the CLUSTERED state). When the current appliance is in the OWNER state, the owner field is shown as a pop-up menu that can be edited and then committed by clicking Apply.

For each resource, a lock icon indicating whether or not the resource is PRIVATE. When the current appliance is in either of the OWNER or CLUSTERED states, a resource can be locked to it (made PRIVATE) or unlocked (made a SINGLETON) by clicking the lock icon

and then clicking Apply. Note that PRIVATE resources belonging to the remote peer will not be displayed on either resource list.

The BUI contains the following buttons:

TABLE 11

Button

Setup

Cluster Interface Buttons

Description

If the cluster is not yet configured, execute the cluster setup guided task, and then return to the current screen.

Configuring the Appliance 59

Upgrading a Standalone Appliance to a Clustered Configuration (BUI)

Button

Unconfig

Apply

Revert

Failback

Takeover

Description

Upgrade a node to standalone operation by unconfiguring the cluster.

If resource modifications are pending (rows highlighted in yellow), commit those changes to the cluster.

If resource modifications are pending (rows highlighted in yellow), revert those changes and show the current cluster configuration.

If the current appliance (left-hand side) is the OWNER, fail-back resources owned by the other appliance to it, leaving both nodes in the CLUSTERED state (active/ active).

If the current appliance (left-hand side) is either

CLUSTERED or STRIPPED, force the other appliance to reboot, and take-over its resources, making the current appliance the OWNER.

Related Topics

“Performing Initial Configuration (BUI)” in Oracle ZFS Storage Appliance Installation

Guide

“Upgrading a Standalone Appliance to a Clustered Configuration (BUI)” on page 60

“Shutting Down a Clustered Configuration (CLI)” on page 64

Upgrading a Standalone Appliance to a Clustered

Configuration (BUI)

Use this procedure to upgrade a standalone appliance to a clustered configuration.

Note -

It is strongly recommended that you use the BUI to configure clustered controllers.

Before You Begin

Check for the following:

The second controller is a new controller or a controller that has been reset to the factory settings. See “Performing a Factory Reset” in Oracle ZFS Storage Appliance Customer

Service Manual

.

Both controllers must be the same model. Note that the 7420 (with 2Ghz or 2.40GHz CPUs) is based on the same platform and can be clustered with the 7420 (with 1.86GHz or 2.00

GHz CPUs).

The standalone appliance is powered on. There is no need to power down the standalone appliance during this procedure.

60 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Upgrading a Standalone Appliance to a Clustered Configuration (BUI)

1.

2.

3.

4.

5.

6.

7.

8.

9.

Connect the cluster cables between the standalone appliance and second controller.

For cluster cabling details, see “Connecting Cluster Cables” in Oracle ZFS Storage Appliance

Cabling Guide

.

On the second controller, connect the power cables into power supply 0 and power supply 1. Then connect each cable to the external power source.

The second controller powers on automatically.

Connect the second controller to the disk shelves.

See the documentation that came with your appliance or refer to “Getting Started with Cabling” in Oracle ZFS Storage Appliance Cabling Guide .

On the standalone controller, go to Configuration > Cluster.

Confirm that the communication links between the two controllers are connected and active.

If three solid lines are not shown, ensure that the three cluster cables are properly connected and secure in their connectors.

Click SETUP.

Enter the host name for the second controller and the same root password that is set on the first controller.

Note -

An initial cluster configuration setup can take several minutes to complete.

On the standalone controller, go to Configuration > Cluster and click the lock icon for the management interface.

Locking the management interface to the controller will prevent a transfer of resources when a failback occurs.

From the standalone controller, configure the management interface for the second controller.

a.

Go to Configuration > Network and click the add icon next to Interfaces.

b. Enter a name for the management interface, and check the boxes for Enable

Interface and Allow Administration.

c. Select an IP address and click APPLY.

Configuring the Appliance 61

Shutting Down a Clustered Configuration (BUI)

10.

Go to Configuration > Cluster and click FAILBACK to bring the cluster to Active:

Active mode.

The two controllers are now configured as clustered peers.

11.

On the second controller, go to Configuration > Cluster and click the lock icon for the management interface.

Related Topics

“Clustering Considerations for Storage” on page 77

“Cluster Configuration BUI View” on page 58

1.

2.

Shutting Down a Clustered Configuration (BUI)

Use this procedure to shut down a clustered configuration.

From one of the peer controllers, go to Configuration > Cluster.

Determine the state of both controllers.

In the following figure, the active controller is controller-a, and the standby controller is controller-b

.

Use the following table to determine the state of each controller.

controller-a

Active

controller-b

Active

Condition

Both controllers are running in a normal clustered condition.

62 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (BUI)

controller-a

Active (takeover completed)

Active (takeover completed)

Active (takeover completed)

controller-b

Ready (waiting for failback)

Rejoining cluster ...

Unknown (disconnected or restarting)

Condition

controller-a

owns all of the resources and is the active controller.

controller-b

, is in standby mode and has no resources. To limit the number of times a pool is moved, shut down the standby controller first.

controller-b

is rebooting and controller-a

has all resources.

controller-b

is powered off or rebooting, all of its cluster interconnect links are down, or clustering has not yet been configured.

3.

Log in to the BUI of Controller B and click the power icon on the left side under the masthead.

Note -

To limit the number of times a pool is moved, shut down the standby controller first.

4.

From the BUI of Controller A, go to Configuration > Cluster to confirm that

Controller B is powered off, with the cluster state: Unknown (disconnected or restarting).

5.

6.

7.

From the BUI of Controller A, click the power icon on the left side under the masthead.

(Optional) To confirm that both controllers are powered off, log into the Oracle

ILOM and enter :

->show /SYS power_state

For information about accessing ILOM, see “Logging in to Oracle ILOM Remotely Using a

Command Line Interface” in Oracle ZFS Storage Appliance Customer Service Manual .

Power off the disk shelves.

a. Place the power supply on/off switches to the "O" off position.

b.

Disconnect the power cords from the external power source for the cabinet.

Note -

All power cords must be disconnected to completely remove power from the disk shelf.

Configuring the Appliance 63

Shutting Down a Clustered Configuration (CLI)

For more information, see “Powering Off a Disk Shelf” in Oracle ZFS Storage Appliance

Installation Guide.

Shutting Down a Clustered Configuration (CLI)

Use this procedure to shut down a clustered configuration.

Note -

For the purpose of this procedure, the clustered controllers are referred to as controller-a

and controller-b.

1.

2.

Verify the cluster state of each controller, using the following commands:

In the following example, controller-a is the owner and in the active state. Its peer, controller-b

, is the standby controller and in the stripped state.

controller-a:>configuration cluster controller-a:configuration cluster> show state = AKCS_OWNER description = Active (takeover completed) peer_asn = 365ed33c-3b9d-c533-9349-8014e9da0408 peer_hostname = controller-b peer_state = AKCS_STRIPPED peer_description = Ready (waiting for failback)

Use the following table to verify the status of each controller: controller-a

AKCS_CLUSTERED

AKCS_OWNER

AKCS_OWNER

AKCS_OWNER

controller-b

AKCS_CLUSTERED

AKCS_STRIPPED rebooting unknown

Condition

Both controllers are running in a normal clustered condition.

controller-a

owns all of the resources and is the active controller.

controller-b

, is in standby mode and has no resources. To limit the number of times a pool is moved, shut down the STRIPPED controller first.

controller-b

is rebooting and controller-a

has all resources.

controller-b

is powered off or rebooting, all of its cluster interconnect links are down,

64 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

controller-a controller-b Condition

or clustering has not yet been configured.

Note -

If the status of each controller does not agree, the cluster may be experiencing a problem. Contact Oracle Support before proceeding.

3.

Shut down the controller-b, using the following commands:

controller-b:configuration cluster> cd / controller-b:> maintenance system poweroff

This will turn off power to the appliance. Are you sure? (Y/N)Y

Note -

If both controllers have a status of AKCS_CLUSTERED, a takeover of the surviving controller begins automatically.

4.

5.

6.

7.

From controller-a, use the show command to verify that controller-b has been powered off and is in state OWNER/unknown.

controller-a:configuration cluster> show state = AKCS_OWNER description = Active (takeover completed) peer_asn = 365ed33c-3b9d-c533-9349-8014e9da0408 peer_hostname = controller-b peer_state = OWNER/unknown peer_description =

Shut down controller-a using the following commands:

controller-a:configuration cluster> cd / controller-a:> maintenance system poweroff

This will turn off power to the appliance. Are you sure? (Y/N) Y

(Optional) To confirm that both controllers are powered off, log into the Oracle

ILOM and enter:

->show /SYS power_state

For information about accessing ILOM, see “Logging in to Oracle ILOM Remotely Using a

Command Line Interface” in Oracle ZFS Storage Appliance Customer Service Manual .

Power off the disk shelves.

a. Place the power supply on/off switches to the "O" off position.

Configuring the Appliance 65

Shutting Down a Clustered Configuration (CLI)

b.

Disconnect the power cords from the external power source for the cabinet.

Note -

All power cords must be disconnected to completely remove power from the disk shelf.

For more information, see “Powering Off a Disk Shelf” in Oracle ZFS Storage Appliance

Installation Guide.

Related Topics

“Understanding Clustering” on page 66

“Cluster Terminology” on page 66

“Cluster Resource Management” on page 71

“Cluster Takeover and Failback” on page 74

“Configuration Changes in a Clustered Environment” on page 76

Cluster Terminology

The terms defined here are used throughout the document. In most cases, they are explained in greater context and detail along with the broader concepts involved. The cluster states and resource types are described in the next section. Refer back to this section for reference as needed.

Export: the process of making a resource inactive on a particular controller

Failback: the process of moving from AKCS_OWNER state to AKCS_CLUSTERED, in which all foreign resources (those assigned to the peer) are exported, then imported by the peer

Import: the process of making a resource active on a particular controller

Peer: the other appliance in a cluster

Rejoin: to retrieve and resynchronize the resource map from the peer

Resource: a physical or virtual object present, and possibly active, on one or both controllers

Takeover: the process of moving from AKCS_CLUSTERED or AKCS_STRIPPED state to

AKCS_OWNER, in which all resources are imported

Understanding Clustering

The clustering subsystem incorporated into the series consists of three main building blocks

(see the following figure). The cluster I/O subsystem and the hardware device provide

66 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI) a transport for inter-controller communication within the cluster and are responsible for monitoring the peer's state. This transport is used by the resource manager, which allows data service providers and other management subsystems to interface with the clustering system.

Finally, the cluster management user interfaces provide the setup task, resource allocation and assignment, monitoring, and takeover and failback operations. Each of these building blocks is described in detail in the following sections.

FIGURE 2

Clustering Subsystem

Unconfiguring Clustering

Unconfiguring clustering is a destructive operation that returns the clustered controllers to standalone controllers. There are two reasons to unconfigure clustering:

You no longer wish to use clustering; instead, you wish to configure two independent storage appliances.

You are replacing a failed storage controller with new hardware or a storage controller with factory-fresh appliance software (typically this replacement is performed by your service provider).

The peer node must be turned off before unconfiguration can occur. The peer node must be factory reset before being used again in the same clustered configuration.

Configuring the Appliance 67

Shutting Down a Clustered Configuration (CLI)

Caution -

Because unconfiguring a cluster may result in data loss, contact Oracle support.

Cluster Advantages and Disadvantages

It is important to understand the scope of the Oracle ZFS Storage Appliance clustering implementation. The term 'cluster' is used in the industry to refer to many different technologies with a variety of purposes. We use it here to mean a metasystem comprised of two appliance controllers and shared storage, used to provide improved availability in the case in which one of the controllers succumbs to certain hardware or software failures. A cluster contains exactly two appliances or storage controllers, referred to for brevity throughout this document as controllers. Each controller may be assigned a collection of storage, networking, and other resources from the set available to the cluster, which allows the construction of either of two major topologies. Many people use the terms active-active to describe a cluster in which there are two (or more) storage pools, one of which is assigned to each controller along with network resources used by clients to reach the data stored in that pool, and active-passive to refer to which a single storage pool is assigned to the controller designated as active along with its associated network interfaces. Both topologies are supported by the Oracle ZFS

Storage Appliance. The distinction between these is artificial; there is no software or hardware difference between them and one can switch at will simply by adding or destroying a storage pool. In both cases, if a controller fails, the other (its peer) will take control of all known resources and provide the services associated with those resources.

As an alternative to incurring hours or days of downtime while the controller is repaired, clustering allows a peer appliance to provide service while repair or replacement is performed.

In addition, clusters support rolling upgrade of software, which can reduce the business disruption associated with migrating to newer software. Some clustering technologies have certain additional capabilities beyond availability enhancement; the Oracle ZFS Storage

Appliance clustering subsystem was not designed to provide these. In particular, it does not provide for load balancing among multiple controllers, improve availability in the face of storage failure, offer clients a unified filesystem namespace across multiple appliances, or divide service responsibility across a wide geographic area for disaster recovery purposes.

These functions are likewise outside the scope of this document; however, the Oracle ZFS

Storage Appliance and the data protocols it offers support numerous other features and strategies that can improve availability:

Replication of data, which can be used for disaster recovery at one or more geographically remote sites

Client-side mirroring of data, which can be done using redundant iSCSI LUNs provided by multiple arbitrarily located storage servers

Load balancing, which is built into the NFS protocol and can be provided for some other protocols by external hardware or software (applies to read-only data)

68 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

Redundant hardware components including power supplies, network devices, and storage controllers

Fault management software that can identify failed components, remove them from service, and guide technicians to repair or replace the correct hardware

Network fabric redundancy provided by LACP and IPMP functionality

Redundant storage devices (RAID)

Additional information about other availability features can be found in the appropriate sections of this document.

When deciding between a clustered and standalone Oracle ZFS Storage Appliance configuration, it is important to weigh the costs and benefits of clustered operation. It is common practice throughout the IT industry to view clustering as an automatic architectural decision, but this thinking reflects an idealized view of clustering risks and rewards promulgated by some vendors in this space. In addition to the obvious higher up-front and ongoing hardware and support costs associated with the second controller, clustering also imposes additional technical and operational risks. Some of these risks can be mitigated by ensuring that all personnel are thoroughly trained in cluster operations; others are intrinsic to the concept of clustered operation. Such risks include:

The potential for application intolerance of protocol-dependent behaviors during takeover,

The possibility that the cluster software itself will fail or induce a failure in another subsystem that would not have occurred in standalone operation,

Increased management complexity and a higher likelihood of operator error when performing management tasks,

The possibility that multiple failures or a severe operator error will induce data loss or corruption that would not have occurred in a standalone configuration, and

Increased difficulty of recovering from unanticipated software and/or hardware states.

These costs and risks are fundamental, apply in one form or another to all clustered or clustercapable products on the market (including the Oracle ZFS Storage Appliance), and cannot be entirely eliminated or mitigated. Storage architects must weigh them against the primary benefit of clustering: the opportunity to reduce periods of unavailability from hours or days to minutes or less in the rare event of catastrophic hardware or software failure. Whether that cost/benefit analysis will favor the use of clustering in an Oracle ZFS Storage Appliance deployment will depend on local factors such as SLA terms, available support personnel and their qualifications, budget constraints, the perceived likelihood of various possible failures, and the appropriateness of alternative strategies for enhancing availability. These factors are highly site-, application-, and business-dependent and must be assessed on a case-by-case basis. Understanding the material in the rest of this section will help you make appropriate choices during the design and implementation of your unified storage infrastructure.

Related Topics

Configuring the Appliance 69

Shutting Down a Clustered Configuration (CLI)

“Shutting Down a Clustered Configuration (CLI)” on page 64

Cluster Interconnect I/O

All inter-controller communication consists of one or more messages transmitted over one of the three cluster I/O links provided by the CLUSTRON hardware (see “Controller Cluster I/

O Ports” in Oracle ZFS Storage Appliance Cabling Guide ). This device offers two low-speed serial links and one Ethernet link. The use of serial links allows for greater reliability; Ethernet links may not be serviced quickly enough by a system under extremely heavy load. False failure detection and unwanted takeover are the worst way for a clustered system to respond to load; during takeover, requests will not be serviced and will instead be enqueued by clients, leading to a flood of delayed requests after takeover in addition to already heavy load. The serial links used by the Oracle ZFS Storage Appliances are not susceptible to this failure mode.

The Ethernet link provides a higher-performance transport for non-heartbeat messages such as rejoin synchronization and provides a backup heartbeat.

All three links are formed using ordinary straight-through EIA/TIA-568B (8-wire, Gigabit

Ethernet) cables. To allow for the use of straight-through cables between two identical controllers, the cables must be used to connect opposing sockets on the two connectors as shown in “Connecting Cluster Cables” in Oracle ZFS Storage Appliance Cabling Guide.

Clustered controllers only communicate with each other over the secure private network established by the cluster interconnects, and never over network interfaces intended for service or administration. Messages fall into two general categories: regular heartbeats used to detect the failure of a remote controller, and higher-level traffic associated with the resource manager and the cluster management subsystem. Heartbeats are sent, and expected, on all three links; they are transmitted continuously at fixed intervals and are never acknowledged or retransmitted as all heartbeats are identical and contain no unique information. Other traffic may be sent over any link, normally the fastest available at the time of transmission, and this traffic is acknowledged, verified, and retransmitted as required to maintain a reliable transport for higher-level software.

Regardless of its type or origin, every message is sent as a single 128-byte packet and contains a data payload of 1 to 68 bytes and a 20-byte verification hash to ensure data integrity. The serial links run at 115200 bps with 9 data bits and a single start and stop bit; the Ethernet link runs at 1Gbps. Therefore the effective message latency on the serial links is approximately 12.2

ms. Ethernet latency varies greatly; while typical latencies are on the order of microseconds, effective latencies to the appliance management software can be much higher due to system load.

Normally, heartbeat messages are sent by each controller on all three cluster I/O links at 50ms intervals. Failure to receive any message is considered link failure after 200ms (serial links) or 500ms (Ethernet links). If all three links have failed, the peer is assumed to have failed;

70 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

■ takeover arbitration will be performed. In the case of a panic, the panicking controller will transmit a single notification message over each of the serial links; its peer will immediately begin takeover regardless of the state of any other links. Given these characteristics, the clustering subsystem normally can detect that its peer has failed within:

550ms, if the peer has stopped responding or lost power, or

30ms, if the peer has encountered a fatal software error that triggered an operating system panic.

All of the values described in this section are fixed; as an appliance, the Oracle ZFS Storage

Appliance does not offer the ability (nor is there any need) to tune these parameters. They are considered implementation details and are provided here for informational purposes only. They may be changed without notice at any time.

Note -

To avoid data corruption after a physical re-location of a cluster, verify that all cluster

cabling is installed correctly in the new location. For more information, see “Preventing Split-

Brain Conditions” on page 85

.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Cluster Resource Management

The resource manager is responsible for ensuring that the correct set of network interfaces is plumbed up, the correct storage pools are active, and the numerous configuration parameters remain in sync between two clustered controllers. Most of this subsystem's activities are invisible to administrators; however, one important aspect is exposed. Resources are classified into several types that govern when and whether the resource is imported (made active). Note that the definition of active varies by resource class; for example, a network interface belongs to the net class and is active when the interface is brought up.

The three most important resource types are singleton, private, and replica.

Replica resources - Replicas are simplest: they are never exposed to administrators and do not appear on the cluster configuration screen. Replicas always exist and are always active on both controllers. Typically, these resources simply act as containers for service properties that must be synchronized between the two controllers.

Singleton resources - Like replicas, singleton resources provide synchronization of state; however, singletons are always active on exactly one controller. Administrators can choose the controller on which each singleton should normally be active; if that controller has failed, its peer will import the singleton. Singletons are the key to clustering's availability characteristics; they are the resources one typically imagines moving from a

Configuring the Appliance 71

Shutting Down a Clustered Configuration (CLI)

■ failed controller to its surviving peer and include network interfaces and storage pools.

Because a network interface is a collection of IP addresses used by clients to find a known set of storage services, it is critical that each interface be assigned to the same controller as the storage pool clients will expect to see when accessing that interface's address(es).

In Illustration 4, all of the addresses associated with the PrimaryA interface will always be provided by the controller that has imported pool-0, while the addresses associated with

PrimaryB will always be provided by the same controller as pool-1.

Private resources - Private resources are known only to the controller to which they are assigned, and are never taken over upon failure. This is typically useful only for network interfaces; see the following discussion of specific use cases.

FIGURE 3

ZS3-2 Clustering Example

Several other resource types exist; these are implementation details that are not exposed to administrators. One such type is the symbiote, which allows one resource to follow another as it is imported and exported. The most important use of this resource type is in representing the disks and flash devices in the storage pool. These resources are known as disksets and must always be imported before the ZFS pool they contain. Each diskset consists of half the disks in an external storage enclosure; a clustered storage system may have any number of disksets attached (depending on hardware support), and each ZFS pool is formed from the storage devices in one or more disksets. Because disksets may contain ATA devices, they must be explicitly imported and exported to avoid certain affiliation-related behaviors specific to

ATA devices used in multipathed environments. Representing disks as resources provides a simple way to perform these activities at the right time. When an administrator sets or changes the ownership of a storage pool, the ownership assignment of the disksets associated with it is transparently changed at the same time. Like all symbiotes, diskset resources do not appear in the cluster configuration user interface.

72 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

TABLE 12

Resource

SINGLETON

REPLICA

PRIVATE

SYMBIOTE

Cluster Resource Management

Icon

None

None

Omnipresent

No

Yes

No

Same as parent type

Taken over on failure

Yes

N/A

No

Same as parent type

When a new resource is created, it is initially assigned to the controller on which it is being created. This ownership cannot be changed unless that controller is in the AKCS_OWNER state; it is therefore necessary either to create resources on the controller which should own them normally or to take over before changing resource ownership. It is generally possible to destroy resources from either controller, although destroying storage pools that are exported is not possible. Best results will usually be obtained by destroying resources on the controller which currently controls them, regardless of which controller is the assigned owner.

Most configuration settings, including service properties, users, roles, identity mapping rules, SMB autohome rules, and iSCSI initiator definitions are replicated on both controllers automatically. Therefore it is never necessary to configure these settings on both controllers, regardless of the cluster state. If one appliance is down when the configuration change is made, it will be replicated to the other when it rejoins the cluster on next boot, prior to providing any service. There are a small number of exceptions:

Share and LUN definitions and options may be set only on the controller which has control of the underlying pool, regardless of the controller to which that pool is ordinarily assigned.

The "Identity" service's configuration (i.e., the appliance name and location) is not replicated.

Names given to chassis are visible only on the controller on which they were assigned.

Each network route is bound to a specific interface. If each controller is assigned an interface with an address in a particular subnet, and that subnet contains a router to which the appliances should direct traffic, a route must be created for each such interface, even if the same gateway address is used. This allows each route to become active individually as control of the underlying network resources shifts between the two controllers. For more information, see

“Clustering Considerations for Networking” on page 79

.

SSH host keys are not replicated and are never shared. Therefore if no private administrative interface has been configured, you may expect key mismatches when attempting to log into the CLI using an address assigned to a node that has failed. The same limitations apply to the SSL certificates used to access the BUI.

The basic model, then, is that common configuration is transparently replicated, and administrators will assign a collection of resources to each appliance controller. Those resource

Configuring the Appliance 73

Shutting Down a Clustered Configuration (CLI) assignments in turn form the binding of network addresses to storage resources that clients expect to see. Regardless of which appliance controls the collection of resources, clients are able to access the storage they require at the network locations they expect.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Cluster Takeover and Failback

Clustered controller nodes are in one of a small set of states at any given time:

TABLE 13

Cluster States

State

UNCONFIGURED

Icon CLI/BUI Expression

Clustering is not configured

OWNER

STRIPPED

Active (takeover completed)

Ready (waiting for failback)

Description

A system that has no clustering at all is in this state. The system is either being set up or the cluster setup task has never been completed.

Clustering is configured, and this node has taken control of all shared resources in the cluster.

A system enters this state immediately after cluster setup is completed from its user interface, and when it detects that its peer has failed (i.e. after a takeover). It remains in this state until an administrator manually executes a failback operation.

Clustering is configured, and this node does not control any shared resources. A system is

STRIPPED immediately after cluster setup is completed from the user interface of the other node, or following a reboot, power disconnect, or other failure. A node remains in this state until an administrator manually

74 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

-

-

State

CLUSTERED

Icon CLI/BUI Expression

Active

Rejoining cluster ...

Unknown (disconnected or restarting)

Description

executes a fail-back operation.

Clustering is configured, and both nodes own shared resources according to their resource assignments.

If each node owns a

ZFS pool and is in the

CLUSTERED state, then the two nodes form what is commonly called an active-active cluster.

The appliance has recently rebooted, or the appliance management software is restarting after an internal failure. Resource state is being resynchronized.

The peer appliance is powered off or rebooting, all its cluster interconnect links are down, or clustering has not yet been configured.

Transitions among these states take place as part of two operations: takeover and failback.

Takeover can occur at any time, and is attempted whenever peer failure is detected. It can also be triggered manually using the cluster configuration CLI or BUI, which can be useful for testing purposes. Finally, takeover will occur when a controller boots and detects that its peer is absent. This allows service to resume normally when one controller has failed permanently or when both controllers have temporarily lost power.

Failback never occurs automatically. When a failed controller is repaired and booted, it will rejoin the cluster (resynchronizing its view of all resources, their properties, and their ownership) and proceed to wait for an administrator to perform a failback operation. Until then, the original surviving controller will continue to provide all services. This allows for a full investigation of the problem that originally triggered the takeover, validation of a new software revision, or other administrative tasks prior to the controller returning to production service.

Because failback is disruptive to clients, it should be scheduled according to business-specific needs and processes. There is one exception: Suppose that controller A has failed and controller

B has taken over. When controller A rejoins the cluster, it becomes eligible to take over if it detects that controller B is absent or has failed. The principle is that it is always better to provide service than not, even if there has not yet been an opportunity to investigate the original problem. So while failback to a previously-failed controller will never occur automatically, it may still perform takeover at any time.

Configuring the Appliance 75

Shutting Down a Clustered Configuration (CLI)

After you set up a cluster, the initial state consists of the node that initiated the setup in the

OWNER state and the other node in the STRIPPED state. After performing an initial failback operation to hand the STRIPPED node its portion of the shared resources, both nodes are

CLUSTERED. If both cluster nodes fail or are powered off, then upon simultaneous startup they will arbitrate and one of them will become the OWNER and the other STRIPPED.

During failback all foreign resources (those assigned to the peer) are exported, then imported by the peer. A pool that cannot be imported because it is faulted will trigger reboot of the

STRIPPED node. An attempt to failback with a faulted pool can reboot the STRIPPED node as a result of the import failure.

To minimize service downtime, statistics and datasets are not available during failback and takeover operations. Data is not collected, and any attempt to suspend or resume statistics is delayed until failback and takeover operations have completed and data collection automatically resumes.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Configuration Changes in a Clustered

Environment

The vast majority of appliance configuration is represented as either service properties or share/

LUN properties. While share and LUN properties are stored with the user data on the storage pool itself (and thus are always accessible to the current owner of that storage resource), service configuration is stored within each controller. To ensure that both controllers provide coherent service, all service properties must be synchronized when a change occurs or a controller that was previously down rejoins with its peer. Since all services are represented by replica resources, this synchronization is performed automatically by the appliance software any time a property is changed on either controller.

It is therefore unnecessary and redundant for administrators to replicate configuration changes.

Standard operating procedures should reflect this attribute and call for making changes to only one of the two controllers once initial cluster configuration has been completed. Note as well that the process of initial cluster configuration will replicate all existing configuration onto the newly-configured peer. Generally, then, we derive two best practices for clustered configuration changes:

Make all storage- and network-related configuration changes on the controller that currently controls (or will control, if a new resource is being created) the underlying storage or network interface resources.

76 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

Make all other changes on either controller, but not both. Site policy should specify which controller is to be considered the master for this purpose, and should in turn depend on which of the controllers is functioning and the number of storage pools that have been configured. Note that the appliance software does not make this distinction.

The problem of amnesia, in which disjoint configuration changes are made and subsequently lost on each controller while its peer is not functioning, is largely overstated. This is especially true of the Oracle ZFS Storage Appliance, in which no mechanism exists for making independent changes to system configuration on each controller. This simplification largely alleviates the need for centralized configuration repositories and argues for a simpler approach: whichever controller is currently operating is assumed to have the correct configuration, and its peer will be synchronized to it when booting. While future product enhancements may allow for selection of an alternate policy for resolving configuration divergence, this basic approach offers simplicity and ease of understanding: the second controller will adopt a set of configuration parameters that are already in use by an existing production system (and are therefore highly likely to be correct). To ensure that this remains true, administrators should ensure that a failed controller rejoins the cluster as soon as it is repaired.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Clustering Considerations for Storage

When sizing an Oracle ZFS Storage Appliance for use in a cluster configuration, two considerations are very important:

Whether all pools are owned by the same controller, or split between the two controllers.

Whether you want pools with no single point of failure (NSPF).

Assigning storage pool ownership - Perhaps the most important decision is whether all storage pools will be assigned ownership to the same controller, or split between them. There are several trade-offs to consider, as shown in

Table 14, “Clustering Considerations for Storage

Pools,” on page 78

.

Generally, pools should be configured on a single controller except when optimizing for throughput during nominal operation or when failed-over performance is not a consideration.

The exact changes in performance characteristics when in the failed-over state will depend to a great deal on the nature and size of the workload(s). Generally, the closer a controller is to providing maximum performance on any particular axis, the greater the performance degradation along that axis when the workload is taken over by that controller's peer. Of course, in the multiple pool case, this degradation will apply to both workloads.

Read cache devices are located in the controller or disk shelf, depending on your configuration.

Configuring the Appliance 77

Shutting Down a Clustered Configuration (CLI)

Read cache devices, located in a controller slot (internal L2ARC), do not follow data pools in takeover or failback situations. A read cache device is only active in a particular cluster node when the pool that is assigned to the read cache device is imported on the node where the device resides. Absent additional configuration steps, read cache will not be available for a pool that has migrated due to a failover event. In order to enable a read cache device for a pool that is not owned by the cluster peer, take over the pool on the non-owning node, and then add storage and select the cache devices for configuration. Read cache devices in a cluster node should be configured as described in the

“Configuring Storage” on page 122 . Write-optimized log

devices are located in the storage fabric and are always accessible to whichever controller has imported the pool.

If read cache devices are located in a disk shelf (external L2ARC), read cache is always available. During a failback or takeover operation, read cache remains sharable between controllers. In this case, read performance is sustained. For external read cache configuration details, see “Disk Shelf Configurations” in Oracle ZFS Storage Appliance Customer Service

Manual

.

Configuring NSPF - A second important consideration for storage is the use of pool configurations with no single point of failure (NSPF). Since the use of clustering implies that the application places a very high premium on availability, there is seldom a good reason to configure storage pools in a way that allows the failure of a single disk shelf to cause loss of availability. The downside to this approach is that NSPF configurations require a greater number of disk shelves than do configurations with a single point of failure; when the required capacity is very small, installation of enough disk shelves to provide for NSPF at the desired

RAID level may not be economical.

The following table describes storage pool ownership for cluster configurations.

TABLE 14

Clustering Considerations for Storage Pools

Variable Single controller pool ownership

Total throughput (nominal operation) Up to 50% of total CPU resources,

50% of DRAM, and 50% of total network connectivity can be used to provide service at any one time.

This is straightforward: only a single controller is ever servicing client requests, so the other is idle.

Total throughput (failed over) No change in throughput relative to nominal operation.

Multiple pools owned by different controllers

All CPU and DRAM resources can be used to provide service at any one time. Up to 50% of all network connectivity can be used at any one time (dark network devices are required on each controller to support failover).

100% of the surviving controller's resources will be used to provide service. Total throughput relative to nominal operation may range from approximately 40% to 100%, depending on utilization during nominal operation.

78 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

Variable

I/O latency

Storage flexibility

Network connectivity

Single controller pool ownership

Internal read cache is not available during a failback or takeover operation, which can significantly increase latencies for read-heavy workloads that fit into available read cache. Latency of write operations is unaffected.

With external read cache configurations (EL2ARC), read performance is unaffected. Read cache is shared between cluster peers during a failback or takeover operation, resulting in no read latency.

All available physical storage can be used by shares and LUNs.

All network devices in each controller can be used while that controller is providing service.

Multiple pools owned by different controllers

Internal read cache is not available during a failback or takeover operation, which can significantly increase latencies for read-heavy workloads that fit into available read cache. Latency of both read and write operations may be increased due to greater contention for controller resources. This is caused by running two workloads on the surviving controller instead of the usual one. When nominal workloads on each controller approach the controller's maximum capabilities, latencies in the failed-over state may be extremely high.

With external read cache configurations (EL2ARC), read performance is unaffected. Read cache is shared between cluster peers during a failback or takeover operation, resulting in no read latency.

Only the storage allocated to a particular pool can be used by that pool's shares and LUNs. Storage is not shared across pools, so if one pool fills up while the other has free space, some storage may be wasted.

Only half of all network devices in each controller can be used while that controller is providing service. Therefore each pool can be connected to only half as many physically disjoint networks.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Clustering Considerations for Networking

Network device, datalink, and interface failures do not cause a clustered subsystem controller to fail. To protect against network failures inside or outside of the appliance, IPMP and/or LACP

Configuring the Appliance 79

Shutting Down a Clustered Configuration (CLI) should be used. A comprehensive approach to availability requires the correct configuration of the network and a network-wide plan for redundancy.

FIGURE 4

Clustering for Networking

Network interfaces can be configured as either singleton or private resources, provided they have a static IP configuration. Interfaces configured using DHCP must be private and using

DHCP in clusters is discouraged. When configured as a singleton resource, all datalinks and devices used to construct an interface can be active on only one controller at a time. Likewise, corresponding devices on each controller must be attached to the same networks in order for service to be provided in a failed-over state. An example of this is shown in the previous diagram.

For a cluster to operate correctly when you construct network interfaces from devices and datalinks, it is essential that each singleton interface has a device using the same identifier and capabilities available on both controllers. Since device identifiers depend on the device type and the order in which they are first detected by the appliance, clustered controllers MUST have identical hardware installed. Each slot in both controllers must be populated with identical hardware and slots must be populated in the same order on both controllers. Your qualified

Oracle reseller or service representative can assist in planning hardware upgrades that meet these requirements.

A route is always bound explicitly to a single network interface. Routes are represented within the resource manager as symbiotes and can become active only when the interfaces to which they are bound are operational. Therefore, a route bound to an interface which is currently in standby mode (exported) has no effect until the interface is activated during the takeover process. This is important when two pools are configured and are made available to a common subnet. If a subnet is home to a router that is used by the appliances to reach one or more other networks, a separate route (for example, a second default route), must be configured and bound to each of the active and standby interfaces attached to that subnet.

Example:

80 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

Interface e1000g3 is assigned to 'alice' and e1000g4 is assigned to 'bob'.

Each interface has an address in the 172.16.27.0/24 network and can be used to provide service to clients in the 172.16.64.0/22 network, reachable via 172.16.27.1.

Two routes should be created to 172.16.64.0/22 via 172.16.27.1; one should be bound to e1000g3 and the other to e1000g4.

It is a good idea to assign each clustered controller an IP address used only for administration

(most likely on a dedicated management network) and to designate the interface as a private resource. This ensures that it is possible to reach a functioning controller from the management network even if it is in a AKCS_STRIPPED state and awaiting failback. This is important if services such as LDAP and Active Directory are in use and require access to other network resources when the controller is not providing service. If this is not practical, the service processor should be attached to a reliable network and/or serial terminal concentrator so that the controller can be managed using the system console.

If neither of these actions is taken, it is impossible to manage or monitor a newly-booted controller until failback is completed. You may want to monitor or manage the controller that is providing service for a particular storage pool. This is likely to be useful when you want to modify some aspect of the storage itself such as modifying a share property or create a new

LUN. This can be done by using one of the service interfaces to perform administrative tasks or by allocating a separate singleton interface to be used only for managing the pool to which it is matched. In either case, the interface should be assigned to the same controller as the pool it is used to manage.

Impact to NFSv4.1 clients - Certain networking changes in a cluster configuration can adversely affect the servicing of requests for NFSv4.1 clients. If the relationship between an

IP address and its owner changes, then the best practice is to remount the filesystems from the client. Unlike NFSv4.0, NFSv4.1 protocol enables client connections over multiple IP addresses to be associated with the same NFSv4.1 protocol lease. When the relationship between an IP address and its owner changes, the group of IP addresses that failover together is no longer the same, forcing the client to re-establish the lease relationships by remounting the filesystems.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Private Local IP Interfaces

Use the following guidelines when creating private local IP interfaces:

Creating an IP interface with the same name as a private IP interface on cluster peer, results in the local creation of a private IP interface.

Configuring the Appliance 81

Shutting Down a Clustered Configuration (CLI)

Datalinks in use by the peer's private interfaces can not be deleted and the delete button is greyed out.

IP interfaces that belong to an IPMP group must all be of the same type and belong to the same controller. To create an IPMP group you must use either all singleton or all private IP interfaces and your cluster node must be the owner of these interfaces.

The IPMP group type is set only at creation, and is determined by the type of underlying links.

IP interfaces that belong to IPMP groups do not appear on the Cluster:Resources page because IP interface ownership cannot be modified independently of the IPMP group ownership.

Private IPMP groups do not appear in the Cluster:Resources page because this type or ownership cannot be modified.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Clustering Considerations for InfiniBand

Like a network built on top of Ethernet devices, an InfiniBand network needs to be part of a redundant fabric topology in order to guard against network failures inside and outside of the appliance. The network topology should include IPMP to protect against network failures at the link level with a broader plan for redundancy for HCAs, switches and subnet managers.

FIGURE 5

Clustering Considerations for InfiniBand

To ensure proper cluster configuration, each controller must be populated with identical HCAs in identical slots. Furthermore, each corresponding HCA port must be configured into the same partition (pkey) on the subnet manager with identical membership privileges and attached to

82 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI) the same network. To reduce complexity and ensure proper redundancy, it is recommended that each port belong to only one partition in the InfiniBand sub-network. Network interfaces may be configured as either singleton or private resources, provided they have static IP configuration. When configured as a singleton resource, all of the IB partition datalinks and devices used to construct an interface may be active on only one controller at any given time.

A concrete example of this is shown in the illustration above. Changes to partition membership for corresponding ports must happen at the same time and in a manner consistent with the clustering rules described earlier. Your qualified Oracle reseller or service representative can assist in planning hardware upgrades that will meet these requirements.

The following illustration shows cluster configuration for subnet manager redundancy. Greater redundancy is achieved by connecting two dual-port HCAs to a redundant pair of server switches.

Configuring the Appliance 83

Shutting Down a Clustered Configuration (CLI)

FIGURE 6

Cluster Configuration for Subnet Manager Redundancy

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

84 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shutting Down a Clustered Configuration (CLI)

Preventing Split-Brain Conditions

A common failure mode in clustered systems is known as split-brain; in this condition, each of the clustered controllers believes its peer has failed and attempts takeover. Absent additional logic, this condition can cause a broad spectrum of unexpected and destructive behavior that can be difficult to diagnose or correct. The canonical trigger for this condition is the failure of the communication medium shared by the controllers; in the case of the Oracle ZFS Storage

Appliance, this would occur if the cluster I/O links fail. In addition to the built-in triple-link redundancy (only a single link is required to avoid triggering takeover), the appliance software will also perform an arbitration procedure to determine which controller should continue with takeover.

A number of arbitration mechanisms are employed by similar products; typically they entail the use of quorum disks (using SCSI reservations) or quorum servers. To support the use of ATA disks without the need for additional hardware, the Oracle ZFS Storage Appliance uses a different approach relying on the storage fabric itself to provide the required mutual exclusivity. The arbitration process consists of attempting to perform a SAS ZONE LOCK command on each of the visible SAS expanders in the storage fabric, in a predefined order.

Whichever appliance is successful in its attempts to obtain all such locks will proceed with takeover; the other will reset itself. Since a clustered appliance that boots and detects that its peer is unreachable will attempt takeover and enter the same arbitration process, it will reset in a continuous loop until at least one cluster I/O link is restored. This ensures that the subsequent failure of the other controller will not result in an extended outage. These SAS zone locks are released when failback is performed or approximately 10 seconds has elapsed since the controller in the AKCS_OWNER state most recently renewed its own access to the storage fabric.

This arbitration mechanism is simple, inexpensive, and requires no additional hardware, but it relies on the clustered appliances both having access to at least one common SAS expander in the storage fabric. Under normal conditions, each appliance has access to all expanders, and arbitration will consist of taking at least two SAS zone locks. It is possible, however, to construct multiple-failure scenarios in which the appliances do not have access to any common expander. For example, if two of the SAS cables are removed or a disk shelf is powered down, each appliance will have access to disjoint subsets of expanders. In this case, each appliance will successfully lock all reachable expanders, conclude that its peer has failed, and attempt to proceed with takeover. This can cause unrecoverable hangs due to disk affiliation conflicts and/ or severe data corruption.

Note that while the consequences of this condition are severe, it can arise only in the case of multiple failures (often only in the case of 4 or more failures). The clustering solution embedded in the Oracle ZFS Storage Appliance is designed to ensure that there is no single point of failure, and to protect both data and availability against any plausible failure without adding undue cost or complexity to the system. It is still possible that massive multiple failures

Configuring the Appliance 85

Shutting Down a Clustered Configuration (CLI) will cause loss of service and/or data, in much the same way that no RAID layout can protect against an unlimited number of disk failures.

FIGURE 7

Preventing Split-Brain

Fortunately, most such failure scenarios arise from human error and are completely preventable by installing the hardware properly and training staff in cluster setup and management best practices. Administrators should always ensure that all three cluster I/O links are connected and functional (see illustration), and that all storage cabling is connected as shown in the setup poster delivered with your appliances. It is particularly important that two paths are detected to each disk shelf (see illustration) before placing the cluster into production and at all times afterward, with the obvious exception of temporary cabling changes to support capacity increases or replacement of faulty components. Administrators should use alerts to monitor the state of cluster interconnect links and disk shelf paths and correct any failures promptly.

Ensuring that proper connectivity is maintained will protect both availability and data integrity if a hardware or software component fails.

86 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

FIGURE 8

Cluster Two Paths

Shutting Down a Clustered Configuration (CLI)

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Estimating and Reducing Takeover Impact

There is an interval during takeover and failback during which access to storage cannot be provided to clients. The length of this interval varies by configuration, and the exact effects on clients depends on the protocol(s) they are using to access data. Understanding and mitigating these effects can make the difference between a successful cluster deployment and a costly failure at the worst possible time.

NFS (all versions) clients typically hide outages from application software, causing I/O operations to be delayed while a server is unavailable. NFSv2 and NFSv3 are stateless protocols that recover almost immediately upon service restoration. NFSv4.0 and NFSv4.1 incorporate a client grace period at startup, during which I/O typically cannot be performed. The duration of this grace period can be tuned in the Oracle ZFS Storage Appliance; reducing it will reduce the apparent impact of takeover and/or failback. For planned outages, the Oracle ZFS Storage

Appliance provides grace-less recovery for NFSv4.0 and NFSv4.1 clients, which avoids the grace period delay. For more information about grace-less recovery, see the Grace period property in

“NFS Service Properties” on page 260 .

Configuring the Appliance 87

Shutting Down a Clustered Configuration (CLI)

FIGURE 9

Cluster Grace Period iSCSI behavior during service interruptions is initiator-dependent, but initiators will typically recover if service is restored within a client-specific timeout period. Check your initiator's documentation for additional details. The iSCSI target will typically be able to provide service as soon as takeover is complete, with no additional delays.

SMB, FTP, and HTTP/WebDAV are connection-oriented protocols. Because the session states associated with these services cannot be transferred along with the underlying storage and network connectivity, all clients using one of these protocols will be disconnected during a takeover or failback, and must reconnect after the operation completes.

While several factors affect takeover time (and its close relative, failback time), in most configurations these times will be dominated by the time required to import the diskset resource

(s). Typical import times for each diskset range from 15 to 20 seconds, linear in the number of disksets. Recall that a diskset consists of one half of one disk shelf, provided the disk bays in that half-disk shelf have been populated and allocated to a storage pool. Unallocated disks and empty disk bays have no effect on takeover time. The time taken to import diskset resources is unaffected by any parameters that can be tuned or altered by administrators, so administrators planning clustered deployments should either:

Limit installed storage so that clients can tolerate the related takeover times, or

Adjust client-side timeout values above the maximum expected takeover time.

Note that while diskset import usually comprises the bulk of takeover time, it is not the only factor. During the pool import process, any intent log records must be replayed, and each share

88 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Network Configuration and LUN must be shared via the appropriate service(s). The amount of time required to perform these activities for a single share or LUN is very small - on the order of tens of milliseconds but with very large share counts this can contribute significantly to takeover times. Keeping the number of shares relatively small - a few thousand or fewer - can therefore reduce these times considerably.

Failback time is normally greater than takeover time for any given configuration. This is because failback is a two-step operation: first, the source appliance exports all resources of which it is not the assigned owner, then the target appliance performs the standard takeover procedure on its own assigned resources only. Therefore it will always take longer to failback from controller A to controller B than it will take for controller A to take over from controller

B in case of failure. This additional failback time is much less dependent upon the number of disksets being exported than is the takeover time, so keeping the number of shares and LUNs small can have a greater impact on failback than on takeover. It is also important to keep in mind that failback is always initiated by an administrator, so the longer service interruption it causes can be scheduled for a time when it will cause the lowest level of business disruption.

Note -

Estimated times cited in this section refer to software/firmware version 2009.04.10,1-0.

Other versions may perform differently, and actual performance may vary. It is important to test takeover and its exact impact on client applications prior to deploying a clustered appliance in a production environment.

Related Topics

“Shutting Down a Clustered Configuration (CLI)” on page 64

Network Configuration

The Networking Configuration features lets you create a variety of advanced networking setups using your physical network ports, including link-aggregations, virtual NICs (VNICs), virtual LANs (VLANs), and multipathing groups. You can then define any number of IPv4 and

IPv6 addresses for these abstractions, for use in connecting to the various data services on the system.

There are four components to a system's network configuration:

Devices - Physical network ports. These correspond to your physical network connections or IP on InfiniBand (IPoIB) partitions.

Datalinks - The basic construct for sending and receiving packets. Datalinks may correspond 1:1 with a device (that is, with a physical network port) or IB Partition, or you may define Aggregation, VLAN and VNIC datalinks composed of other devices and datalinks.

Configuring the Appliance 89

Network Configuration

Interface - The basic construct for IP configuration and addressing. Each IP interface is associated with a single datalink, or is defined to be an IP MultiPathing (IPMP) group comprised of other interfaces.

Routing - IP routing configuration. This controls how the system will direct IP packets.

To configure the network for the appliance, use the following sections:

“Network Configuration (BUI)” on page 90

“Network Configuration (CLI)” on page 102

“Working with Network Configuration” on page 111

“Configuring Management Interfaces” on page 113

“Configuring Network Datalinks” on page 113

“Configuring Network Interfaces” on page 116

“Configuring Network IP MultiPathing (IPMP)” on page 117

“Configuring Network Performance and Availability” on page 118

“Configuring Network Routing” on page 119

Network Configuration (BUI)

When using the BUI to reconfigure networking, the system makes every effort to preserve the current networking connection to your browser. However, some network configuration changes such as deleting the specific address to which your browser is connected, will unavoidably cause the browser to lose its connection. For this reason it is recommended that you assign a particular IP address and network device for use by administrators and always leave the address configured. You can also perform particularly complex network reconfiguration tasks from the

CLI over the serial console if necessary.

The following icons are used in the Configuration > Network section:

TABLE 15

Icon

Network Configuration Icons

Description

Add new datalink, interface, or route

Edit datalink, interface, or route settings

Editing disabled

Destroy datalink, interface, route

Destruction disabled

90 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Network Configuration

Icon Description

Drag-and-drop icon

Connected network port

Connected network port with I/O activity

Disconnected network port (link down, cable problem)

Active InfiniBand port

Active InfiniBand port with I/O activity

Inactive InfiniBand port (down, init, or arm state)

InfiniBand partition device is up

InfiniBand partition device is down (subnet manager problem)

Network datalink

Network datalink VLAN or VNIC

Network datalink aggregation

Network datalink aggregation VLAN or VNIC

Network datalink IB partition

Interface is being used to send and receive packets (either up or degraded)

Interface has been disabled by the user

Interface is offline (owned by the cluster peer)

Interface has failed or has been configured with a duplicate IP address

At top right is local navigation for Configuration, Addresses and Routing, which display alternate configuration views.

The Configuration page is shown by default, and lists Devices, Datalinks, and Interfaces, along with buttons for administration. Hover over an entry to expose an additional icon, and click on any entry to highlight other components that are associated with it.

The Devices list shows links status on the right, as well as an icon to reflect the state of the network port. If ports appear disconnected, check that they are plugged into the network properly.

Configuring the Appliance 91

Configuring Management Interfaces (BUI)

To configure an IP address on a network devices, first create a datalink, and then create an interface to use that datalink. The icon may be used to do both, which will display dialogs for the Datalink and Interface properties.

There is more than one way to configure a network interface. Try clicking on the move icon for a device, then dragging it to the datalink table. Then drag the datalink over to the interfaces table. Other moves are possible. This can be helpful for complex configurations, where valid moves are highlighted.

This page shows a summary table of the current network configuration, with fields:

TABLE 16

Summary of the Current Network Configuration

Field

Network Datalink

Network Interface

Network Addresses

Host Names

Description

Datalink name and detail summary

Example

datalink1 (via igb0)

Interface name and details summary IPv4 DHCP, via datalink1

Addresses hosted by this interface 192.168.2.80/22

Resolved host names for the network addresses caji.sf.example.com

This page provides configuration of the IP routing table and associated properties, as discussed above. By default, all entries in the routing table are shown, but the table can be filtered by type by using the subnavigation bar.

To check a specific route, in the CLI use traceroute.

zfssa-source:> traceroute 10.80.198.102

traceroute: Warning: Multiple interfaces found; using 10.80.198.101 @ igb3 traceroute to 10.80.198.102 (10.80.198.102), 30 hops max, 40 byte packets

1 10.80.198.1 (10.80.198.1) 6.490 ms 0.924 ms 0.834 ms

2 10.80.198.102 (10.80.198.102) 0.152 ms 0.118 ms 0.099 ms zfssa-target:> traceroute 10.80.198.101

traceroute: Warning: Multiple interfaces found; using 10.80.198.102 @ igb3 traceroute to 10.80.198.101 (10.80.198.101), 30 hops max, 40 byte packets

1 10.80.198.1 (10.80.198.1) 1.031 ms 0.905 ms 0.769 ms

2 10.80.198.101 (10.80.198.101) 0.158 ms 0.111 ms 0.109 ms

Configuring Management Interfaces (BUI)

1.

Use the following procedure to configure management interfaces.

Go to Configuration > Network > Configuration.

92 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Management Interfaces (BUI)

4.

5.

2.

3.

Click the add icon next to Datalinks.

Set the following minimum datalink properties and click APPLY.

VNIC - Select this check box.

Name - Type a name for the datalink.

Drag the resulting datalink to the Interfaces column.

In the Network Interface dialog box, set the following minimum interface properties and click APPLY:

Name - Type a name for interface.

Enable Interface - Select this check box to enable the interface.

Allow Administration - Select this check box to make this a management interface, which enables BUI connections on port 215 and CLI connections on ssh port 22.

Note -

The Allow Administration option makes it a management interface, enabling BUI connections on port 215 and CLI connections on ssh port 22.

Use IPv4 Protocol or Use IPv6 Protocol - Select a protocol, its type of address, and enter one or more IP addresses in CIDR notation.

If clustered controllers, repeat steps 1-5 on the second controller.

6.

7.

Click the trash icon next to Untitled Interface, which is the default interface, to destroy it.

Note -

When an interface is deleted, all routes associated with the interface are also removed.

8.

In the Update Default Route dialog box, type the Default Gateway and select an

Interface from the drop-down menu. Click COMMIT WITH ROUTE.

The default gateway is the default router IP address. For the interface, select the datalink that you assigned to the first management interface.

Note -

It is strongly recommended to set a route because it enables communication with the appliance via the BUI and CLI. Without a route, the only means of communication with the appliance is through an Oracle ILOM connection to the SP.

Configuring the Appliance 93

Locking Cluster Management Interfaces (BUI)

Related Topics

For an overview of network interface configuration, see “Working with Network

Configuration” in Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 .

For further configuration, see “Configuring the Appliance” in Oracle ZFS Storage

Appliance Administration Guide, Release OS8.7.0

.

To upgrade the software on standalone controller, see “Upgrading the Software” in Oracle

ZFS Storage Appliance Customer Service Manual

.

To lock the cluster management interfaces, see “Locking Cluster Management Interfaces

(BUI)” on page 94 .

Locking Cluster Management Interfaces (BUI)

After initial configuration, clustered controllers are in an active-active state. When a failover occurs, an active controller takes over all non-private interfaces, and the peer controller becomes passive and inaccessible by its BUI and CLI. To maintain access to a controller regardless of its state, lock its management interface to make it private. The following procedure locks the management interface on each clustered controller.

Caution -

Failure to configure locked management interfaces on clustered controllers may lead to longer than necessary fault diagnosis and resolution times.

1.

2.

3.

4.

In the BUI of the first controller, navigate to Configuration > Cluster.

In the BUI of the second controller, navigate to Configuration > Cluster.

From the BUI of the first controller, choose the management interface for the first controller from the Resource list.

Click the padlock icon to lock the management interface to this controller.

The interface displays a locked icon next to its name in the Resource list.

94 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Single Port Interface (BUI)

5.

6.

From the BUI of the second controller, choose the management interface for the second controller from the Resource list.

Click the padlock icon to lock the management interface to this controller.

The interface displays a locked icon next to its name in the Resource list.

Related Topics

To upgrade the software, see “Upgrading the Software” in Oracle ZFS Storage Appliance

Customer Service Manual

.

Creating a Single Port Interface (BUI)

7.

8.

1.

2.

4.

5.

Go to Configuration > Network > Configuration.

3.

Click the Datalinks add item icon .

Optionally, type a name and select the Custom MTU button then type 9000 in the text box.

Choose a device from the Devices list.

Click APPLY.

The datalink will appear in the Datalinks list.

6.

9.

Click the Interface add item icon .

Set desired properties, and choose the datalink previously created.

Click APPLY.

The interface will appear in the Interfaces list.

The running appliance network configuration has not yet changed. When you are finished configuring interfaces, click APPLY at the top to commit the configuration.

Modifying an Interface (BUI)

1.

Go to Configuration > Network > Configuration.

Configuring the Appliance 95

Unlocking Data Interfaces (BUI)

3.

4.

5.

2.

Click the edit icon for a network datalink or network interface.

Change settings to desired values.

Click APPLY.

Click APPLY at the top of the page to commit the configuration.

1.

2.

Unlocking Data Interfaces (BUI)

Go to Configuration > Cluster.

Verify that the lock icons for data interfaces are gray, indicating that it is unlocked .

3.

4.

If the lock icons are black , click each icon to unlock the interfaces.

Click APPLY to save your changes.

Creating an LACP Aggregated Link Interface (BUI)

1.

2.

Go to Configuration > Network > Configuration.

3.

4.

5.

6.

Click the Datalinks add item icon .

Optionally set the datalink name.

Select LACP Aggregation.

Select two or more devices from the Devices list, and click APPLY.

7.

8.

Click the Interfaces add item icon .

Set desired properties, choose the aggregated link from the Datalinks list, and click APPLY.

Click APPLY at the top to commit the configuration.

96 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating an IPMP Group Using Probe-Based and Link-State Failure Detection (BUI)

Creating an IPMP Group Using Probe-Based and Link-State

Failure Detection (BUI)

3.

4.

5.

6.

7.

8.

1.

2.

Create one or more "underlying" IP interfaces that will be used as components of the IPMP

group. Each interface must have an IP address to be used as the probe source (see “Creating a

Single Port Interface (BUI)” on page 95 ).

Do not use probe-based failure detection when there no systems (other than the cluster peer) on the same subnet as the IPMP test addresses that are configured to answer ICMP echo requests.

Go to Configuration > Network > Configuration.

Click the Interface add item icon .

Optionally, change the name of the interface.

Click the IP MultiPathing Group check box.

Click the Use IPv4 Protocol and/or the Use IPv6 Protocol, and specify the IP addresses for the IPMP interface.

Choose the interfaces created in the first step from the Interfaces list.

Set each chosen interface to be either Active or Standby, as desired.

Click APPLY.

Creating an IPMP Group Using Link-State Only Failure

Detection (BUI)

Create one or more "underlying" IP interfaces with the IP address 0.0.0.0/8 to be used as the components of the IPMP group (see

“Creating a Single Port Interface (BUI)” on page 95 ).

Go to Configuration > Network > Configuration.

1.

2.

3.

Click the Interface add item icon .

Optionally, change the name of the interface.

Configuring the Appliance 97

Extending an LACP Aggregation (BUI)

6.

7.

8.

4.

5.

Click the IP MultiPathing Group check box.

Click the Use IPv4 Protocol or/and the Use IPv6 Protocol and specify the IP addresses for the IPMP interface.

Choose the interfaces created in the first step from the Interfaces list.

Set each chosen interface to be either Active or Standby, as desired.

Click APPLY.

Extending an LACP Aggregation (BUI)

1.

2.

3.

Go to Configuration > Network > Configuration.

Hover over a device in the Devices list.

4.

Click the move icon , then drag and drop the device onto an aggregation datalink.

Click APPLY at the top of the page to commit this configuration.

Extending an IPMP Group (BUI)

1.

2.

3.

Go to Configuration > Network > Configuration.

Hover over an interface in the Interfaces list.

4.

Click the move icon , then drag and drop the device onto an IPMP interface.

Click APPLY at the top of the page to commit this configuration.

Creating an InfiniBand Partition Datalink and Interface (BUI)

1.

2.

Go to Configuration > Network > Configuration.

Click the Datalinks add item icon .

98 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a VNIC Without a VLAN ID for Clustered Controllers (BUI)

5.

6.

3.

4.

Optionally, set a name.

Click the IB Partition checkbox.

Choose a device from the Partition Devices list.

Enter a four-digit hexadecimal number for the partition key, which must match what was configured on the InfiniBand subnet manager.

Choose link mode from the drop down menu.

Click APPLY. The new partition datalink will appear in the Datalinks list.

7.

8.

9.

10.

11.

12.

Click the Interface add item icon .

Set desired properties, and choose the datalink previously created.

Click APPLY.

The interface will appear in the Interfaces list.

The running appliance network configuration has not yet changed. When you are finished configuring interfaces, click APPLY at the top to commit the configuration.

Creating a VNIC Without a VLAN ID for Clustered Controllers

(BUI)

1.

2.

This example is for an active-active configuration with half of the network ports on standby.

This task creates an IP interface over a device datalink and assigns it to a head. A VNIC is built on top of the same datalink, and an IP interface is configured on top of the VNIC and assigned to the other head. Configuring one instead of multiple VNICs over a given datalink ensures peak performance. Traffic flows over the cable associated with the underlying active port on one head, as well as the underlying standby port on the other head. Thus, the otherwise idle standby port can be used with VNICs.

Go to Configuration > Network > Configuration.

When the cluster is in state AKCS_CLUSTERED, click the Datalinks add item icon .

Configuring the Appliance 99

Creating VNICs with the Same VLAN ID for Clustered Controllers (BUI)

3.

4.

5.

6.

Click the Interface add item .

Set desired properties, choose the datalink previously created, and click APPLY.

The interface appears in the Interfaces list.

7.

Optionally, set a name and MTU value.

Choose a device from the Devices list and click APPLY.

The datalink appears in the Datalinks list.

8.

Click the Datalinks add item icon .

Select the VNIC checkbox, optionally set name and MTU (equal to or less than the value in step 2), and click APPLY.

The new VNIC datalink appears in the Datalinks list.

9.

10.

11.

12.

13.

Click the Interface add item icon .

Set desired properties, choose the VNIC datalink previously created, and click

APPLY.

The interface appears in the Interfaces list.

The running appliance network configuration has not yet changed. When you are finished configuring interfaces, click APPLY at the top to commit the configuration.

Click the Cluster tab.

The two newly created interfaces appear in the Resource section with default owners.

Use the Owner pull-down list to assign one of the two interfaces to the other head and click APPLY.

Creating VNICs with the Same VLAN ID for Clustered

Controllers (BUI)

This example is for an active-active configuration with half of the network ports on standby.

This task creates two VNICs with identical VLAN IDs on top of the same device datalink.

Each VNIC is configured with an interface, and each interface is assigned to a different head.

Traffic flows over the cable associated with the underlying active port on one head, as well as

100 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a Static Route (BUI)

1.

2.

3.

the underlying standby port on the other head. Thus, the otherwise idle standby port can be used with VNICs.

Go to Configuration > Network > Configuration.

When the cluster is in state AKCS_CLUSTERED, click the Datalinks add item icon .

Select the VNIC checkbox, optionally set a name and MTU, set the VLAN ID, choose a device from the Devices list, and click APPLY.

The new VNIC datalink appears in the Datalinks list.

4.

5.

6.

7.

8.

9.

Click the Interface add item icon .

Set desired properties, choose the VNIC datalink previously created, and click

APPLY.

The interface appears in the Interfaces list.

Create another VNIC as described in steps 2 and 3 with the same Device and

VLAN ID, and create an interface for it as described in steps 4 and 5.

The running appliance network configuration has not yet changed. When you are finished configuring interfaces, click APPLY at the top to commit the configuration.

Click the Cluster tab.

The two newly created interfaces appear in the Resource section with default owners.

Use the Owner pull-down list to assign one of the two interfaces to the other head and click APPLY.

Adding a Static Route (BUI)

1.

2.

3.

4.

Go to Configuration > Network > Routing.

Click the add item icon next to Routing Table Entries.

Select a family protocol and type. Specify a destination address, gateway address, and an interface.

Click ADD.

Configuring the Appliance 101

Deleting a Static Route (BUI)

The new route will appear in the table.

Deleting a Static Route (BUI)

1.

2.

Go to Configuration > Network > Routing.

Hover over the route entry, then click the trash icon on the right.

Network Configuration (CLI)

Network configuration is under the configuration net, which has sub commands for devices, datalinks

, interfaces, and routing. The show command can be used with each to show the current configuration: caji:> configuration net caji:configuration net> devices show

Devices:

DEVICE UP SPEED MAC igb0 true 1000 Mbit/s 0:14:4f:9a:b9:0 igb1 true 1000 Mbit/s 0:14:4f:9a:b9:1 igb2 true 1000 Mbit/s 0:14:4f:9a:b8:fe igb3 true 1000 Mbit/s 0:14:4f:9a:b8:ff caji:configuration net> datalinks show

Datalinks:

DATALINK CLASS LINKS LABEL

igb0 device igb0 datalink1 caji:configuration net> interfaces show

Interfaces:

INTERFACE STATE CLASS LINKS ADDRS LABEL

igb0 up ip igb0 192.168.2.80/22 caji caji:configuration net> routing show

Properties:

multihoming = loose

Routes:

ROUTE DESTINATION GATEWAY INTERFACE TYPE

102 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Deleting a Static Route (BUI) route-000 0.0.0.0/0 192.168.1.1 igb0 dhcp route-001 192.168.0.0/22 192.168.2.142 igb0 system

Type help in each section to see the relevant commands for creating and configuring datalinks, interfaces, and routes. Subcommands that are valid in this context:

help [topic] => Get context-sensitive help. If [topic] is specified,

it must be one of "builtins", "commands","general",

"help", "script" or "properties".

show => Show information pertinent to the current context

commit => Commit current state, including any changes

abort => Abort creation of "vnic"

done => Finish operating on "vnic"

get [prop] => Get value for property [prop]. ("help properties"

for valid properties.) If [prop] is not specified,

returns values for all properties.

set [prop] => Set property [prop] to [value]. ("help properties"

for valid properties.) For properties taking list

values, [value] should be a comma-separated list of

values.

available => Get values that can be assigned to the links

parameter when creating a network component.

The available command is used to see what values can be assigned to the links parameter when creating a network component. The following shows the output from the CLI command available

: caji:configuration net datalinks> device caji:configuration net datalinks device (uncommitted)> available igb7,igb6 caji:configuration net datalinks> vnic caji:configuration net datalinks vnic (uncommitted)> available igb5,igb4,aggr2,aggr1 caji:configuration net datalinks> vlan caji:configuration net datalinks vlan (uncommitted)> available igb5,igb4,aggr2,aggr1 caji:configuration net datalinks> aggregation caji:configuration net datalinks aggregation (uncommitted)> available igb7,igb6

Configuring the Appliance 103

Deleting a Static Route (BUI) caji:configuration net interfaces> ip caji:configuration net interfaces ip (uncommitted)> available aggr2,aggr1 caji:configuration net interfaces> ipmp caji:configuration net interfaces ipmp (uncommitted)> available vnic4,vnic3,igb5,igb4

The following demonstrates creating a datalink using the device command, and interface using the ip command: caji:configuration net> datalinks caji:configuration net datalinks> device caji:configuration net datalinks device (uncommitted)> set links=igb1

links = igb1 (uncommitted) caji:configuration net datalinks device (uncommitted)> set label=datalink2

label = datalink2 (uncommitted) caji:configuration net datalinks device (uncommitted)> set mtu=9000

mtu = 9000 (uncommitted) caji:configuration net datalinks device (uncommitted)> commit caji:configuration net datalinks> show

Datalinks:

DATALINK CLASS LINKS LABEL

igb0 device igb0 datalink1

igb1 device igb1 datalink2 caji:configuration net datalinks> cd ..

caji:configuration net> interfaces caji:configuration net interfaces> ip caji:configuration net interfaces ip (uncommitted)> set label="caji2"

label = caji2 (uncommitted) caji:configuration net interfaces ip (uncommitted)> set links=igb1

links = igb1 (uncommitted) caji:configuration net interfaces ip (uncommitted)> set v4addrs=10.0.1.1/8

v4addrs = 10.0.1.1/8 (uncommitted) caji:configuration net interfaces ip (uncommitted)> commit caji:configuration net interfaces> show

Interfaces:

INTERFACE STATE CLASS LINKS ADDRS LABEL

igb0 up ip igb0 192.168.2.80/22 caji

igb1 up ip igb1 10.0.1.1/8 caji2

The following demonstrates creating a default route via 10.0.1.2 over the new igb1 IP interface: caji:configuration net routing> create

104 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Management Interfaces (CLI) caji:configuration net route (uncommitted)> set family=IPv4

family = IPv4 (uncommitted) caji:configuration net route (uncommitted)> set destination=0.0.0.0

destination = 0.0.0.0 (uncommitted) caji:configuration net route (uncommitted)> set mask=0

mask = 0 (uncommitted) caji:configuration net route (uncommitted)> set interface=igb1

interface = igb1 (uncommitted) caji:configuration net route (uncommitted)> set gateway=10.0.1.2

gateway = 10.0.1.2 (uncommitted) caji:configuration net route (uncommitted)> commit

1.

2.

3.

Configuring Management Interfaces (CLI)

Use the following procedure to configure management interfaces.

Go to configuration net, and then enter datalinks.

hostname:> configuration net hostname:configuration net> datalinks

Enter show to view the datalink(s).

hostname:configuration net datalinks> show

Datalinks:

DATALINK CLASS LINKS STATE ID LABEL igb0 device igb0 up - Untitled Datalink

Create a VNIC for the management datalink by going to the vnic context and setting its label to indicate that the link is for management, and optionally assign a VLAN ID. Enter commit and then enter cd .. to return to the correct context for the next step.

hostname:configuration net datalinks> vnic hostname:configuration net datalinks vnic (uncommitted)> set links=igb0

links = igb0 (uncommitted) hostname:configuration net datalinks vnic (uncommitted)> set label=management-datalink-1

label = management-datalink-1 (uncommitted) hostname:configuration net datalinks vnic (uncommitted)> commit hostname:configuration net datalinks vnic> cd ..

To assign a VLAN ID: hostname:configuration net datalinks vnic> set id=100

id = 100 (uncommitted) hostname:configuration net datalinks vnic (uncommitted)> commit

Configuring the Appliance 105

Configuring Management Interfaces (CLI)

4.

5.

6.

hostname:configuration net datalinks vnic> cd ..

If clustered controllers, create a VNIC for the second management datalink by going to the vnic context and setting a unique label, and optionally assign a

VLAN ID. Enter commit and then enter cd .. to return to the correct context for the next step.

hostname:configuration net datalinks> vnic hostname:configuration net datalinks vnic (uncommitted)> set links=igb0

links = igb0 (uncommitted) hostname:configuration net datalinks vnic (uncommitted)> set label=management-datalink-2

label = management-datalink-2 (uncommitted) hostname:configuration net datalinks vnic (uncommitted)> commit hostname:configuration net datalinks vnic> cd ..

To assign a VLAN ID: hostname:configuration net datalinks vnic (uncommitted)> set id=100

id = 100 (uncommitted) hostname:configuration net datalinks vnic> commit hostname:configuration net datalinks vnic> cd ..

Create an IP interface for the controller and assign it to the VNIC.

hostname:configuration net> interfaces hostname:configuration net interfaces> ip hostname:configuration net interfaces ip (uncommitted)> set v4addrs=192.168.1.101/24

v4addrs = 192.168.1.101/24 (uncommitted) hostname:configuration net interfaces ip (uncommitted)> set label=management-

controller-1

label = management-controller-1 (uncommitted) hostname:configuration net interfaces ip (uncommitted)> set links=vnic1

links = vnic1 (uncommitted) hostname:configuration net interfaces ip (uncommitted)> commit

If clustered controllers, create an IP interface and assign it to the VNIC for the second controller. After entering commit, enter done.

hostname:configuration net interfaces> ip hostname:configuration net interfaces ip (uncommitted)> set v4addrs=192.168.1.102/24

v4addrs = 192.168.1.102/24 (uncommitted) hostname:configuration net interfaces ip (uncommitted)> set label=management-

controller-2

label = management-controller-2 (uncommitted) hostname:configuration net interfaces ip (uncommitted)> set links=vnic2

links = vnic2 (uncommitted) hostname:configuration net datalinks vnic (uncommitted)> commit hostname:configuration net datalinks> done

106 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Management Interfaces (CLI)

7.

8.

Configure routing for the first controller. If clustered controllers, configure routing for the second controller. After entering commit, enter done.

First controller: hostname:configuration net> routing hostname:configuration net routing> create hostname:configuration net route (uncommitted)> set destination=0.0.0.0

destination = 0.0.0.0 (uncommitted) hostname:configuration net route (uncommitted)> set mask=0

mask = 0 (uncommitted) hostname:configuration net route (uncommitted)> set interface=vnic1

interface = vnic1 (uncommitted) hostname:configuration net route (uncommitted)> set gateway=192.168.1.1

gateway = 192.168.1.1 (uncommitted) hostname:configuration net route (uncommitted)> set family=IPv4

family = IPv4 hostname:configuration net route (uncommitted)> commit hostname:configuration net route> done

Second controller: hostname:configuration net> routing hostname:configuration net routing> create hostname:configuration net route (uncommitted)> set destination=0.0.0.0

destination = 0.0.0.0 (uncommitted) hostname:configuration net route (uncommitted)> set mask=0

mask = 0 (uncommitted) hostname:configuration net route (uncommitted)> set interface=vnic2

interface = vnic2 (uncommitted) hostname:configuration net route (uncommitted)> set gateway=192.168.1.1

gateway = 192.168.1.1 (uncommitted) hostname:configuration net route (uncommitted)> set family=IPv4

family = IPv4 hostname:configuration net route (uncommitted)> commit hostname:configuration net route> done

Destroy the default interface, which is named Untitled Interface, enter cd .. and then enter done.

Note -

When an interface is deleted, all routes associated with the interface are also removed.

hostname:configuration net> interfaces hostname:configuration net interfaces> show

Interfaces:

INTERFACE STATE CLASS LINKS ADDRS LABEL igb0 up ip igb0 192.168.1.101/24 Untitled Interface

Configuring the Appliance 107

Configuring Network Interfaces (CLI) vnic1 duplicate ip vnic1 192.168.1.101/24 management-controller-1 vnic2 duplicate ip vnic2 192.168.1.102/24 management-controller-2 hostname:configuration net interfaces> destroy igb0

This will destroy "igb0" and any networking objects exclusively built over it.

Are you sure? (Y/N) y hostname:configuration net interfaces> cd .. hostname:configuration net> done

Related Topics

For further configuration, see “Configuring the Appliance” in Oracle ZFS Storage

Appliance Administration Guide, Release OS8.7.0

.

To upgrade the software on a standalone controller, see “Upgrading the Software” in Oracle

ZFS Storage Appliance Customer Service Manual

.

To lock the management interfaces, see

“Locking Cluster Management Interfaces

(CLI)” on page 109 .

Configuring Network Interfaces (CLI)

Before You Begin

To ensure the appropriate network interfaces are used for the replication connections between source and target appliances, configure static /32 (host-specific) routes.

If you are setting up replication for a cluster configuration, select a singleton (unlocked) network interface so that following a cluster takeover or failback, the interface will move to the node where the replication work is being done. The two source cluster nodes can replicate to the same target node only if the target node provides two IP addresses, one for use by each node in the source cluster. Replicating to the same target IP address from both nodes of a source cluster is not supported.

1.

Navigate to configuration services routing on the source appliance.

Use a static /32 (host-specific) route to the target system IP address via the dedicated network interface. In the following example, mask=32 means this is a host-specific route.

host_source:configuration services routing> create

host_source:configuration services route (uncommitted)> get

family = (unset)

destination = (unset)

mask = (unset)

gateway = (unset)

interface = (unset)

host_source:configuration services route (uncommitted)> set family=IPv4

108 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Locking Cluster Management Interfaces (CLI)

2.

3.

host_source:configuration services route (uncommitted)> set destination=203.34.56.78

host_source:configuration services route (uncommitted)> set mask=32

host_source:configuration services route (uncommitted)> set gateway=203.34.56.254

host_source:configuration services route (uncommitted)> set interface=nge3

host_source:configuration services route (uncommitted)> commit

host_source:configuration services routing> show

route-000 0.0.0.0/0 203.24.30.254 nge0 static

route-001 203.24.30.0/32 203.24.30.28 nge0 dynamic

route-002 203.24.150.0/32 203.24.150.10 ibd0 dynamic

route-003 203.24.101.65/32 203.24.30.254 nge1 inactive

route-005 203.34.56.78/32 203.34.56.254 nge3 static

After defining the static route from the source appliance to the target appliance, repeat these steps on the target appliance to define the static route from the target back to the source.

To ensure traffic is routed through the correct source and target interfaces, use the traceroute command.

For information about using traceroute, see

“Configuring Network Routing” on page 119 .

Note -

When an interface is deleted, all routes associated with the interface are also removed.

Related Topics

“Remote Replication Workflow” on page 507

“Remote Replication Concepts” on page 576

Locking Cluster Management Interfaces (CLI)

After initial configuration, clustered controllers are in an active-active state. When a failover occurs, an active controller takes over all non-private interfaces, and the peer controller becomes passive and inaccessible by its BUI and CLI. To maintain access to a controller regardless of its state, lock its management interface to make it private. The following procedure locks the management interface on each clustered controller.

Caution -

Failure to configure locked management interfaces on clustered controllers may lead to longer than necessary fault diagnosis and resolution times.

1.

On the first controller, go to configuration cluster resources and select the management interface for the first controller, prefacing it with net/.

controller-a:> configuration cluster resources select net/igb0

Configuring the Appliance 109

Adding a Static Route (CLI)

2.

3.

4.

Lock the interface by setting the type to private:

configuration cluster resources (uncommitted)> set type=private configuration cluster resources (uncommitted)> commit

On the second controller, go to configuration cluster resources and select the management interface for the second controller, prefacing it with net/.

controller-b:> configuration cluster resources select net/igb1

Lock the interface by setting the type to private:

configuration cluster resources (uncommitted)> set type=private configuration cluster resources (uncommitted)> commit

Related Topics

To upgrade the software, see “Upgrading the Software” in Oracle ZFS Storage Appliance

Customer Service Manual

.

Adding a Static Route (CLI)

3.

4.

1.

2.

Go to configuration net routing.

Enter create.

Type show to list required properties, and set each.

Enter commit.

Deleting a Static Route (CLI)

1.

2.

3.

Go to configuration net routing.

Type show to list routes, and route names (e.g., route-002).

Enter destroy route name.

1.

Unlocking Data Interfaces (CLI)

Go to configuration cluster resources.

110 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing the Multihoming Property to Strict (CLI)

2.

3.

4.

hostname:> configuration cluster resources

Enter show.

All data interfaces should have a TYPE set to singleton.

hostname:configuration cluster resources> show

Resources:

RESOURCE OWNER TYPE LABEL CHANGES DETAILS net/vnic2 zs34-02 private mgmt-02 no 10.80.218.170

net/vnic3 zs34-02 private data-01 no 10.80.216.46

net/vnic4 zs34-02 singleton data-02 no 10.80.216.47

zfs/pool-01 zs34-01 singleton no zfs/pool-02 zs34-02 singleton no 53.5T

If a data interface has a type set to private, select the resource and set the type to singleton.

hostname:configuration cluster resources> select net/vnic3 hostname:configuration cluster resources net/vnic3> set type=singleton

type = singleton

Enter commit.

hostname:configuration cluster resources> commit

Changing the Multihoming Property to Strict (CLI)

1.

2.

3.

Go to configuration net routing.

Enter set multihoming=strict.

Enter commit.

Working with Network Configuration

In the appliance model, network devices are created by the system to represent the available network or InfiniBand ports; they have no configurable settings. Datalinks are a layer 2 entity and must be created to apply settings such as LACP to these network devices. Interfaces are a layer 3 entity containing the IP settings, which they make available via a datalink. This model has separated network interface settings into two parts: datalinks for layer 2 settings and interfaces for layer 3 settings.

Configuring the Appliance 111

Changing the Multihoming Property to Strict (CLI)

The Devices column corresponds to the physical network interface card (NIC) ports on the controller and are typically labeled igb0, igb1, igb2, and igb3. Port NET-0 corresponds to device igb0, port NET-1 to igb1, and so on. It is strongly recommended to use one NIC port per controller as a management interface. This column also contains the physical InfiniBand ports on the controller, and are typically labeled ibp0, ibp1, ibp2, and ibp3.

The Datalinks column corresponds to the construct for sending and receiving packets for a specific network device. They support VLANs, VNICs, IB partitions, and LACP aggregation.

Datalinks are required to complete network configuration, even if they do not apply specific settings to network devices.

The datalink entity (which we named "aggr1") groups the network devices in a configurable way (LACP aggregation policy). The interface entity (which we named "phobos") provides configurable IP address settings, which it makes available on the network via the datalink. The network devices (named "igb1", "igb2", ..., by the system) have no direct settings.

The Interfaces column corresponds to configurable IP address settings and other properties for datalinks. Interfaces can be available via a single datalink or as defined in an IP MultiPathing

(IPMP) group comprising a pool of datalinks, which allows automatic migration of IP addresses from failed to working datalinks.

An example of a single IP address on a single port (common configuration) is:

Devices - igb0

Datalink - datalink1

112 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing the Multihoming Property to Strict (CLI)

Interface - deimos (192.168.2.80/22)

The following configuration is for a 3-way link aggregation:

Devices - igb1, igb2, igb3

Datalink - aggr1 (LACP aggregation)

Interface - phobos (192.168.2.81/22)

Configuring Management Interfaces

If you did not set a management interface during initial configuration, use the following procedures to configure a network interface card (NIC) port as a management interface. A management interface is a network interface with administrative access.

The physical ports correspond to the interfaces, from which you can select to make a management interface. All standalone controllers should have at least one NIC port configured as a management interface. All cluster installations should have at least one NIC port on each controller configured as a management interface. In addition, the NIC instance number must be unique on each clustered controller.

For clustered controllers, it is recommended that you lock the management interfaces.

To configure management interfaces and lock cluster management interfaces, use the following procedures:

“Configuring Management Interfaces (BUI)” on page 92

“Configuring Management Interfaces (CLI)” on page 105

“Locking Cluster Management Interfaces (BUI)” on page 94

“Locking Cluster Management Interfaces (CLI)” on page 109

Configuring Network Datalinks

Network datalinks manage devices, and are used by interfaces. They support:

Link Aggregation Control Protocol (LACP) - LACP is used to bundle multiple network devices such that they behave as one. This improves performance (by increasing bandwidth) and reliability (by protecting from network port failure); however, the appliance must be connected to a switch that supports LACP and has it enabled for those ports.

InfiniBand (IB) Partitions - InfiniBand partitions connect to logically isolated IB fabric domains.

Virtual LANs (VLANs) - VLANs are used to improve local network security and isolation.

VLANs are recommended for administering the appliance; otherwise, use VNICs.

Configuring the Appliance 113

Changing the Multihoming Property to Strict (CLI)

Virtual Network Interface Cards (VNICs) - VNICs allow single or aggregated

Ethernet datalinks to be split into multiple virtual (Ethernet) datalinks. VNICs can be optionally tagged with VLAN IDs, and can allow physical network port sharing in a cluster. Step-by-step instructions can be found in

“Clustering Considerations for

Networking” on page 79

below.

Note -

VNIC-based and VLAN-based datalinks cannot share the same VLAN ID.

The IEEE802.3ad (link aggregation) standard does not explicitly support aggregations across multiple switches, but some vendors provide multi-switch support via proprietary extensions. If a switch configured with those extensions conforms to the IEEE standard and the extensions are transparent to the end-nodes, its use is supported with the appliance. If an issue is encountered,

Oracle support may require it to be reproduced on a single-switch configuration.

The following datalink settings are available:

TABLE 17

Property

Name

Speed

Datalink Settings

Duplex

VLAN

VLAN ID

VNIC

MTU

Description

Use the defined custom name. For example: "internal",

"external", "adminnet", etc.

Use the defined speed. Valid values are auto, 10, 100,

1000 and 10000, representing autonegotiation, forced

10Mbit/sec, forced 100Mbit/sec, forced 1Gbit/sec and forced 10Gbit/sec. Speed and duplex must be either both forced to specific values or both set to autonegotiate. Not all networking devices support forcing to all possible speed/duplex combinations. Disabling autonegotiation is strongly discouraged. However, if the switch has autonegotiation disabled, it may be necessary to force speed (and duplex) to ensure the datalink runs at the expected speed and duplex.

Use the defined transmission direction. Valid CLI values are auto, half, and full, representing autonegotiation, half- and full-duplex respectively. Speed and duplex must be either both forced to specific values or both set to autonegotiate.

Use VLAN headers.

Use the defined VLAN identifier; optional for VNICs.

Use a VNIC.

Use the defined maximum transmission unit (MTU) size. The default MTU is 1500 bytes. Specify a lower

MTU (minimum 1280) to leave packet headroom (for example, for tunneling protocols). Specify a larger MTU

(maximum 9000) to improve network performance.

All systems and switches on the same LAN must be configured with the chosen MTU. After the MTU value

114 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Property

LACP Aggregation

LACP Policy

LACP Mode

LACP Timer

IB Partition

Partition Key

IB Link Mode

Changing the Multihoming Property to Strict (CLI)

Description

is set and the new network configuration is committed to the system, you can return to the network screen and view the datalink status to see the exact MTU value in bytes that was selected. Note that a VLAN or VNIC cannot be configured with an MTU value larger than that of the underlying datalink.

Use multiple network device LACP aggregation.

Use the defined LACP policy for selecting an outbound port. L2 hashes the source and destination MAC address;

L3 uses the source and destination IP address; L4 uses the source and destination transport level port

Use the defined LACP communication mode. Active mode will send and receive LACP messages to negotiate connections and monitor the link status. Passive mode will listen for LACP messages only. Off mode will use the aggregated link but not detect link failure or switch configuration changes. Some network switch configurations, including Cisco Etherchannel, do not use the LACP protocol: the LACP mode should be set to "off" when using non-LACP aggregation in your network.

Use the defined interval between LACP messages for

Active mode.

Use IB Partitions.

Use the partition (fabric domain) in which the underlying port device is a member. The partition key (pkey) is found on and configured by the subnet manager. The pkey may be defined before configuring the subnet manager but the datalink will remain "down" until the subnet partition has been properly configured with the port GUID as a member. It is important to keep partition membership for HCA ports consistent with

“IPMP

Configuration” on page 342

and “Appliance Cluster

Configuration” on page 58

rules on the subnet manager.

Use the defined IB Link Mode. IPoIB provides two link modes: Connected (the default) and Unreliable

Datagram. Connected mode provides higher throughput and is recommended over Unreliable Datagram. Use

Unreliable Datagram only if technically required.

Connected mode uses IB queue pairs and dedicates a local queue pair to communicate with a dedicated remote queue pair. Connected mode uses an MTU of 65520 and provides higher throughput than Unreliable Datagram.

Unreliable Datagram lets a local queue pair communicate with multiple other queue pairs on any host and messages are communicated unacknowledged at the IB layer.

Unreliable Datagram mode uses an MTU of 2044 and yields a lower throughput rate.

Configuring the Appliance 115

Changing the Multihoming Property to Strict (CLI)

Configuring Network Interfaces

Interfaces configure IP addresses via datalinks. They support the following:

IPv4 and IPv6 protocols.

IPMP - IP MultiPathing, to improve network reliability by allowing IP addresses to automatically migrate from failed to working datalinks.

For information on how to configure network interfaces, see

“Configuring Network Interfaces

(CLI)” on page 108

.

The following interface settings are available:

TABLE 18

Property

Name

Enable Interface

Interface Settings

Allow Administration

IPv4 Configure with

IPv4 Address/Mask

IPv6 Configure with

IPv6 Address/Mask

Directly Reachable Network(s)

IP MultiPathing Group

Description

Custom name for the interface

Enable this interface to be used for IP traffic. If an interface is disabled, the appliance will no longer send or receive IP traffic over it, or make use of any IP addresses configured on it. At present, disabling an active IP interface in an IPMP group will not trigger activation of a standby interface.

Allow connections to the appliance administration BUI or CLI over this interface. If your network environment included a separate administration network, this could be enabled for the administration network only to improve security

Either "Static Address List" manually entered, or

"DHCP" for dynamically requested

One or more IPv4 addresses in CIDR notation

(192.168.1.1/24)

Either "Static Address List" manually entered, or "IPv6

AutoConfiguration" to use automatically generated linklocal address (and site-local if an IPv6 router responds)

One or more IPv6 addresses in CIDR notation (1080::8:

800:200C:417A/32)

Directly reachable subnet(s), expressed as an IP address and mask in CIDR notation, that the local IP address is not a member of, but to which the datalink of its interface is physically connected. This improves scalability by conserving IP addresses, and could ease traffic congestion through core switches and routers.

Configure IP multipathing, where a pool of datalinks can be used for redundancy

116 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing the Multihoming Property to Strict (CLI)

Configuring Network IP MultiPathing (IPMP)

IP MultiPathing groups are used to provide IP addresses that will remain available in the event of an IP interface failure (such as a physical wire disconnection or a failure of the connection between a network device and its switch) or in the event of a path failure between the system and its network gateways. The system detects failures by monitoring the IP interface's underlying datalink for link-up and link-down notifications, and optionally by probing using test addresses that can be assigned to each IP interface in the group, described below. Any number of IP interfaces can be placed into an IPMP group so long as they are all on the same link (LAN, IB partition, or VLAN), and any number of highly-available addresses can be assigned to an IPMP group.

Each IP interface in an IPMP group is designated either active or standby:

Active - The IP interface will be used to send and receive data so long as IPMP has determined it is functioning correctly.

Standby - The IP interface will only be used to send and receive data if an active interface

(or a previously activated standby) stops functioning.

Multiple active and standby IP interfaces can be configured, but each IPMP group must be configured with at least one active IP interface. IPMP will strive to activate as many standbys as necessary to preserve the configured number of active interfaces. For example, if an IPMP group is configured with two active interfaces and two standby interfaces and all interfaces are functioning correctly, only the two active interfaces will be used to send and receive data. If an active interface fails, one of the standby interfaces will be activated. If the other active interface fails (or the activated standby fails), the second standby interface will be activated. If the active interfaces are subsequently repaired, the standby interfaces will again be deactivated.

IP interface failures can be discovered by either link-based detection or probe-based detection

(i.e., a test address is configured).

If probe-based failure detection is enabled on an IP interface, the system will determine which target systems to probe dynamically. First, the routing table will be scanned for gateways

(routers) on the same subnet as the IP interface's test address and up to five will be selected. If no gateways on the same subnet were found, the system will send a multicast ICMP probe (to

224.0.01. for IPv4 or ff02::1 for IPv6) and select the first five systems on the same subnet that respond. Therefore, for network failure detection and repair using IPMP, you should be sure that at least one neighbor on each link or the default gateway responds to ICMP echo requests.

IPMP works with both IPv4 and IPv6 address configurations. In the case of IPv6, the interface's link-local address is used as the test address.

Note -

Do not use probe-based failure detection when there no systems (other than the cluster peer) on the same subnet as the IPMP test addresses that are configured to answer ICMP echo requests.

Configuring the Appliance 117

Changing the Multihoming Property to Strict (CLI)

The system will probe selected target systems in round-robin fashion. If five consecutive probes are unanswered, the IP interface will be considered failed. Conversely, if ten consecutive probes are answered, the system will consider a previously failed IP interface as repaired. You can set the system's IPMP probe failure detection time from the IPMP screen. This time indirectly controls the probing rate and the repair interval -- for instance, a failure detection time of

10 seconds means that the system will send probes at roughly two second intervals and that the system will need 20 seconds to detect a probe-based interface repair. You cannot directly control the system's selected targeted systems, though it can be indirectly controlled through the routing table.

The system will monitor the routing table and automatically adjust its selected target systems as necessary. For instance, if the system using multicast-discovered targets but a route is subsequently added that has a gateway on the same subnet as the IP interface's test address, the system will automatically switch to probing the gateway. Similarly, if multicast-discovered targets are being probed, the system will periodically refresh its set of chosen targets (e.g., because some previously selected targets have become unresponsive).

For step-by-step instructions on building IPMP groups, see: “IPMP

Configuration” on page 342 .

For information about private local interfaces, see “Appliance Cluster

Configuration” on page 58

.

Configuring Network Performance and Availability

IPMP and link aggregation are different technologies available in the appliance to achieve improved network performance as well as maintain network availability. In general, you deploy link aggregation to obtain better network performance, while you use IPMP to ensure high availability. The two technologies complement each other and can be deployed together to provide the combined benefits of network performance and availability.

In link aggregations, incoming traffic is spread over the multiple links that comprise the aggregation. Thus, networking performance is enhanced as more NICs are installed to add links to the aggregation. IPMP's traffic uses the IPMP interface's data addresses as they are bound to the available active interfaces. If, for example, all the data traffic is flowing between only two IP addresses but not necessarily over the same connection, then adding more NICs will not improve performance with IPMP because only two IP addresses remain usable.

Performance can be affected by the number of VNICs/VLANs configured on a datalink for a given device, as well as by using a VLAN ID. Configuring multiple VNICs over a given device may impact the performance of all datalinks over that device by up to five percent, even when VNICs are not in use. If more than eight VNICs/VLANs are configured over a given datalink, performance may degrade significantly. Also, if a datalink uses a VLAN ID, all datalink performance for that device may be impacted by an additional five percent.

118 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing the Multihoming Property to Strict (CLI)

Configuring Network Routing

The system provides a single IP routing table, consisting of a collection of routing table entries.

When an IP packet needs to be sent to a given destination, the system selects the routing entry whose destination most closely matches the packet's destination address (subject to the system's multihoming policy; see below). It then uses the information in the routing entry to determine what IP interface to send the packet on and, if the destination is not directly reachable, the nexthop gateway to use. If no routing entries match the destination, the packet will be dropped. If multiple routing entries tie for closest match (and are not otherwise prioritized by multihoming policy), the system will load-spread across those entries on a per-connection basis.

The system does not act as a router.

The routing table is comprised of routing entries, each of which has the following fields:

TABLE 19

Field

Destination

Gateway

Family

Type

Status

Interface

Routing Entry Fields

Description

Range of IP destination addresses (in

CIDR notation) that can match the route

Next hop (IP address) to send the packet to (except for "system" routes

-- see below)

Internet protocol

Origin of the route

Route status

IP interface the packet will be sent on

Examples

192.168.0.0/22

192.168.2.80

IPv4, IPv6 dhcp, direct, static, system active, inactive (static or direct route associated with a disabled or offline

IP interface) igb0

A routing entry with a "destination" field of 0.0.0.0/0 matches any packet (if no other route matches more precisely), and is thus known as a 'default' route. In the BUI, default routes are distinguished from non-default routes by an additional property:

TABLE 20

Kind

Distinguishing Default from Non-default Routes

Route kind Default, Network

As above, a given packet will be sent on the IP interface specified in the routing entry's

"interface" field. If an IPMP interface is specified, then one of the active IP interfaces in the

Configuring the Appliance 119

Changing the Multihoming Property to Strict (CLI)

IPMP group will be chosen randomly on a per-connection basis and automatically refreshed if the chosen IP interface subsequently becomes unusable. Conversely, if a given IP interface is part of an IPMP group, it cannot be specified in the "interface" field because such a route would not be highly-available.

Routing entries come from a number of different origins, as identified by the "type" field.

Although the origin of a routing entry has no bearing on how it is used by the system, its origin does control if and how it can be edited or deleted. The system supports the following types of routes:

Supported Route Types

TABLE 21

Type

Static

Dynamic

DHCP

System

Direct

Description

Created and managed by the appliance administrator.

Created automatically by the appliance via the RIP and

RIPng dynamic routing protocols (if enabled).

Created automatically by the appliance part of enabling an IP interface that is configured to use DHCP. A DHCP route will be created for each default route provided by the DHCP server.

Created automatically by the appliance as part of enabling an IP interface. A system route will be created for each IP subnet the appliance can directly reach.

Since these routes are directly reachable, the "gateway" field instead identifies the appliance's IP address on that subnet.

Created and managed as a network interface property:

Directly Reachable Network(s). Directly reachable subnet that the local IP address is not a member of, but to which the datalink of its interface is physically connected. This improves scalability by conserving IP addresses, and could ease traffic congestion through core switches and routers.

Note that direct routes are configured as network interfaces using either the Configuration >

Network BUI screen or the configuration net interfaces CLI context. Direct routes are not managed via the Routing BUI screen nor the routing CLI context.

TABLE 22

Routing Properties

Property

Multihoming model

Description

Controls the system policy for accepting and transmitting IP packets when multiple IP interfaces are simultaneously enabled. Allowed values are

"loose" (default), "adaptive", and "strict". See the discussion below.

120 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing the Multihoming Property to Strict (CLI)

If a system is configured with more than one IP interface, then there may be multiple equivalent routes to a given destination, forcing the system to choose which IP interface to send a packet on. Similarly, a packet may arrive on one IP interface, but be destined to an IP address that is hosted on another IP interface. The system's behavior in such situations is determined by the selected multihoming policy. Three policies are supported:

Multihoming Policies

TABLE 23

Policy

Loose

Adaptive

Strict

Description

Do not enforce any binding between an IP packet and the IP interface used to send or receive it: 1) An IP packet will be accepted on an IP interface so long as its destination IP address is up on the appliance. 2)

An IP packet will be transmitted over the IP interface tied to the route that most specifically matches an IP packet's destination address, without any regard for the

IP addresses hosted on that IP interface. If no eligible routes exist, drop the packet.

Identical to loose, except prefer routes with a gateway address on the same subnet as the packet's source IP address: 1) An IP packet will be accepted on an IP interface so long as its destination IP address is up on the appliance. 2) An IP packet will be transmitted over the IP interface tied to the route that most specifically matches an IP packet's destination address. If multiple routes are equally specific, prefer routes that have a gateway address on the same subnet as the packet's source address. If no eligible routes exist, drop the packet.

Require a strict binding between an IP packet and the IP interface used to send or receive it: 1) An IP packet will be accepted on an IP interface so long as its destination

IP address is up on that IP interface. 2) An IP packet will only be transmitted over an IP interface if its source

IP address is up on that IP interface. To enforce this, when matching against the available routes, the appliance will ignore any routes that have gateway addresses on a different subnet from the packet's source address. If no eligible routes remain, drop the packet.

When selecting the multihoming policy, a key consideration is whether any of the appliance's

IP interfaces will be dedicated to administration (for example, for dedicated BUI access) and thus accessed over a separate administration network. In particular, if a default route is created to provide remote access to the administration network, and a separate default route is created to provide remote access to storage protocols, then the default system policy of "loose" may cause the administrative default route to be used for storage traffic. By switching the policy to

"adaptive" or "strict", the appliance will consider the IP address associated with the request as part of selecting the route for the reply. If no route can be found on the same IP interface, the

Configuring the Appliance 121

Configuring Storage

"adaptive" policy will cause the system to use any available route, whereas the "strict" policy will cause the system to drop the packet.

Configuring Storage

The appliance uses storage pools to manage physical storage devices. After configuring these pools based on physical characteristics and the desired level of data redundancy, you can store filesystems and LUNs, collectively known as shares, in these pools. Shares, which are contained in projects, automatically grow within the disk space allocated to the pool, and pools can span multiple storage devices. Although there is no need to statically size shares, you can control space usage using quotas and reservations. For more information, see

“Space

Management for Shares” on page 432

.

To configure and manage storage, use these tasks:

Creating a Storage Pool -

BUI ,

CLI

Importing an Existing Storage Pool -

BUI

,

CLI

Configuring an All-Flash Storage Pool -

BUI

,

CLI

Adding a Disk Shelf to an Existing Storage Pool -

BUI ,

CLI

Adding a Cache, Meta, or Log Device to an Existing Storage Pool -

BUI ,

CLI

Removing a Cache or Log Device from an Existing Storage Pool -

BUI ,

CLI

Unconfiguring a Storage Pool -

BUI

,

CLI

Renaming a Storage Pool -

BUI ,

CLI

Scrubbing a Storage Pool - BUI ,

CLI

Viewing Pool and Device Status

To understand storage basics, use these topics:

“Storage Pool Concepts” on page 150

“Data Profiles for Storage Pools” on page 152

“Space Management for Shares” on page 432

Creating a Storage Pool (BUI)

Storage pools store data and can be created during or after initial configuration. Pools can contain data drives, and log, read cache, and meta devices. The following task assumes that

122 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Storage Pool (BUI) initial configuration has been completed. Creating and configuring a storage pool is a two-step process. First, the storage devices are verified for presence and minimum functionality, and you assign drives or even entire disk shelves to the pool. Second, you select a profile for the drives based on your storage needs. If for some reason a pool is unconfigured, you can import it as described in

“Importing an Existing Storage Pool (BUI)” on page 128 .

To reduce redundant data, which can be especially prevalent in replication workloads, consider the benefits of using deduplication. Allocate meta devices if deduplication will be enabled

for projects or shares in this pool. For more information, see Data Deduplication . There is

also an all-flash storage pool, which utilizes SSDs as data devices and optional log devices,

but does not contain read cache or meta devices. See “Configuring an All-Flash Storage Pool

(BUI)” on page 130

.

Before You Begin

For recommendations on how many drives to select per pool, see “Number of Devices per

Pool” on page 150 .

To understand the different data profiles, see “Data Profiles for Storage

Pools” on page 152 .

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to Maintenance > System.

To use the enhanced data depulication feature in a storage pool, upgrade to software release

OS8.7.0 or later and accept all deferred updates, including Data Deduplication v2. See

“Data Deduplication v2 Deferred Update” in Oracle ZFS Storage Appliance Customer

Service Manual

.

1.

Go to Configuration > Storage.

2.

3.

4.

Next to Available Pools, click the add icon .

Type a name for the storage pool and click APPLY.

Select the number of data drives for the storage pool for each disk shelf. You can also select available log, cache, and meta devices.

Configuring the Appliance 123

Creating a Storage Pool (BUI)

For more information on log, cache, and meta devices, see “Data Profiles for Storage

Pools” on page 152

.

5.

6.

7.

Caution -

Once a data disk has been added to a pool, it cannot be removed without destroying the pool entirely and losing all data.

If all attached disk shelves do not appear, click ABORT, check the disk shelf cabling and power, and begin this procedure again.

If all drives are the same size or rotational speed, or if one size is selected among multiple sizes, the maximum number of drives available is allocated by default. If the storage device contains drives of different rotational speeds or models, no drives are allocated by default.

It is strongly recommended that pools include only devices of the same size and rotational speed to provide consistent performance characteristics.

Monitor or limit space usage because you may experience reduced performance when pools approach full capacity.

Click COMMIT.

The drives are allocated to the storage pool, and verified for presence and minimum functionality. If verification fails, click ABORT, fix the problem, and begin this procedure again. If you allocate a pool with missing or failed devices, you will not be able to add the missing or failed devices later.

On the Choose Storage Profile screen, select the desired data profile that meets your reliability, availability, serviceability, and performance goals.

For a description of each profile, click on the data profile name, or see “Data Profiles for

Storage Pools” on page 152 .

If you allocated log, cache, or meta devices, select the appropriate profiles.

124 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Storage Pool (CLI)

For log devices, click Log Profile and select either the mirrored or striped profile. If you allocated an even number of log devices to the pool, select the mirrored profile.

Caution -

A double failure can cause loss of data from a log in a striped configuration. It is highly recommended to configure a mirrored log profile for added redundancy. For more

information, see “Data Profiles for Storage Pools” on page 152 .

For cache devices, the profile is always striped, as shown under Cache Profile.

For meta devices, click Metadata Profile and select either the mirrored or striped profile.

Note -

Once meta devices are added to a storage pool, they cannot be removed from the pool.

8.

Click COMMIT.

Related Topics

“Data Profiles for Storage Pools” on page 152

“Importing an Existing Storage Pool (BUI)” on page 128

“Adding a Disk Shelf to an Existing Storage Pool (BUI)” on page 133

“Renaming a Storage Pool (BUI)” on page 145

“Storage Pool Concepts” on page 150

Data Deduplication

Creating a Storage Pool (CLI)

Storage pools store data and can be created during or after initial configuration. Pools can contain data drives, and log, read cache, and meta devices. The following task assumes that initial configuration has been completed. Creating and configuring a storage pool is a two-step process. First, the storage devices are verified for presence and minimum functionality, and you assign drives or even entire disk shelves to the pool. Second, you select a profile for the drives based on your storage needs. If for some reason a pool is unconfigured, you can import it as described in

“Importing an Existing Storage Pool (CLI)” on page 128

.

To reduce redundant data, which can be especially prevalent in replication workloads, consider the benefits of using deduplication. Allocate meta devices if deduplication will be enabled

for projects or shares in this pool. For more information, see Data Deduplication . There is

also an all-flash storage pool, which utilizes SSDs as data devices and optional log devices,

Configuring the Appliance 125

Creating a Storage Pool (CLI)

Before You Begin

but does not contain read cache or meta devices. See “Configuring an All-Flash Storage Pool

(CLI)” on page 131

.

For recommendations on how many drives to select per pool, see “Number of Devices per

Pool” on page 150 .

To understand the different data profiles, see

“Data Profiles for Storage

Pools” on page 152 .

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to maintenance system updates.

To use the enhanced data depulication feature in a storage pool, upgrade to software release

OS8.7.0 or later and accept all deferred updates, including Data Deduplication v2. See

“Data Deduplication v2 Deferred Update” in Oracle ZFS Storage Appliance Customer

Service Manual.

1.

2.

Go to configuration storage.

Enter config and a name for the new storage pool.

hostname: configuration storage> config pool0 hostname: configuration storage (pool0) verify>

3.

Enter show to see the device information for the pool:

hostname:configuration storage (pool0) verify> show

ID STATUS ALLOCATION DATA LOG CACHE META RPM

0 ok custom 0 0 0/4 0/4 1.86T

1 ok custom 0 0/2 34G 0 0 15000

2 ok custom 0 0/2 34G 0 0 15000

4.

Enter set and the disk shelf or controller ID, and the number of data drives to use. You can also select available cache, meta, and log devices.

For more information on log, cache, and meta devices, see “Data Profiles for Storage

Pools” on page 152

.

Caution -

Once a data disk has been added to a pool, it cannot be removed without destroying the pool entirely and losing all data.

ID "0" is the controller, and the remaining IDs are the disk shelves. In the following example,

1-data=8

allocates eight data drives from the first disk shelf.

hostname:configuration storage (pool1) verify> set 1-data=8

1-data = 8

This example allocates one cache device from the controller:

126 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Storage Pool (CLI)

5.

6.

hostname:configuration storage (pool1) verify> set 0-cache=1

0-cache = 1

This example allocates one meta device from the controller: hostname:configuration storage (pool1) verify> set 0-meta=1

0-meta = 1

Enter done.

hostname:configuration storage (pool1) verify> done

Enter show to display the profile.

hostname:configuration storage (pool1) config> show

PROFILE CAPCITY NSPF DESCRIPTION log_profile = log_stripe 17G no Striped log

Note -

If you allocated cache devices to the pool, the profile is always striped.

7.

If you allocated log devices to the pool, enter set log_profile= and set the log profile to either log_mirror or log_stripe. Use log_mirror if the pool contains an even number of log devices.

Caution -

A double failure can cause loss of data from a log in a striped configuration. It is highly recommended to configure a mirrored log profile for added redundancy. For more

information, see “Data Profiles for Storage Pools” on page 152 .

8.

9.

hostname:configuration storage (pool1)> set log_profile=log_mirror

If you allocated meta devices to the pool, enter set meta_profile= and set the meta profile to either meta_mirror or meta_stripe.

hostname:configuration storage (pool1)> set meta_profile=meta_mirror

Enter done to complete the task.

hostname:configuration storage (pool1)> done

Related Topics

“Data Profiles for Storage Pools” on page 152

“Importing an Existing Storage Pool (CLI)” on page 128

“Adding a Disk Shelf to an Existing Storage Pool (CLI)” on page 135

Configuring the Appliance 127

Importing an Existing Storage Pool (BUI)

“Renaming a Storage Pool (CLI)” on page 146

“Storage Pool Concepts” on page 150

Data Deduplication

Before You Begin

1.

4.

5.

2.

3.

Importing an Existing Storage Pool (BUI)

The import action allows you to import an unconfigured storage pool. A storage pool can be unconfigured because of an inadvertent action, factory reset, or service operation to recover user data. Importing a storage pool requires scanning all attached storage devices and discovering any existing state. This can take a significant amount of time, during which no other storage configuration activities can take place.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to Maintenance > System.

Go to Configuration > Storage.

A list of storage pools is displayed, including some identifying characteristics. If the storage has been destroyed or is incomplete, the storage pool is not importable. Unlike storage configuration, the storage pool name is not initially shown, but it is shown after selecting the storage pool.

Click IMPORT.

Select the storage pool you want to import.

By default, the previous storage pool names are displayed.

To rename the storage pool, click the pool name and change it.

Click COMMIT.

Related Topics

“Unconfiguring a Storage Pool (BUI)” on page 143

“Renaming a Storage Pool (BUI)” on page 145

Importing an Existing Storage Pool (CLI)

The import action allows you to import an unconfigured storage pool. A storage pool can be unconfigured because of an inadvertent action, factory reset, or service operation to recover

128 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Importing an Existing Storage Pool (CLI)

Before You Begin

1.

2.

user data. Importing a storage pool required iterating over all attached storage devices and discovering any existing state. This can take a significant amount of time, during which no other storage configuration activities can take place.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to maintenance system updates.

Go to configuration storage.

Enter import.

hostname:configuration storage (pool0)> import

Search for storage. Begin the process of searching for existing storage pools.

3.

4.

Subcommands that are valid in this context:

help [topic] => Get context-sensitive help. If [topic] is specified,

it must be one of "builtins", "commands", "general",

"help" or "script".

show => Show information pertinent to the current context

abort => Abort this task (potentially resulting in a

misconfigured system)

done => Finish operating on "discover" hostname:configuration storage (pool0) discover>

Enter done.

Enter show.

hostname:configuration storage (pool0)> show

Pools:

POOL OWNER DATA PROFILE LOG PROFILE STATUS ERRORS

-> pool0 hostname mirror log_stripe online 0

pool1 hostname - - exported -

Properties:

pool = pool0

status = online

errors = 0

owner = hostname

profile = mirror

log_profile = log_stripe

Configuring the Appliance 129

Configuring an All-Flash Storage Pool (BUI)

5.

cache_profile = cache_stripe

scrub = none requested

Enter set pool= and the name of the pool you want to import.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

6.

hostname:configuration storage select> set pool=pool1

pool = pool1

A message reminds you to verify that storage is correctly attached and functioning.

Enter done.

Related Topics

“Unconfiguring a Storage Pool (CLI)” on page 144

“Renaming a Storage Pool (CLI)” on page 146

Before You Begin

Configuring an All-Flash Storage Pool (BUI)

An all-flash storage pool utilizes SSDs as data devices and optional log devices, but does not contain read cache or meta devices. All-flash pools are suitable for virtualization environments or backup workloads.

Follow the cabling guidelines for all-flash shelves described in “Cabinet and Cabling

Guidelines” in Oracle ZFS Storage Appliance Cabling Guide .

For recommendations on how many drives to select per pool, as well as other considerations

and guidelines, see “Storage Pool Concepts” on page 150 .

To understand the different data profiles, see

“Data Profiles for Storage

Pools” on page 152 .

Note -

Do not perform a pool configuration operation while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to Maintenance > System.

1.

2.

3.

Go to Configuration > Storage.

Click the add icon above the list of storage pools.

From the Verify and allocate devices screen, select the storage type SSD, and then select a device size.

130 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring an All-Flash Storage Pool (CLI)

4.

For each SSD disk shelf, select the number of drives to include in the pool.

Note -

An all-flash pool cannot contain read cache devices or meta devices.

8.

9.

5.

6.

7.

(Optional) Select log devices to add to the all-flash pool.

Click COMMIT.

On the Configure Added Storage screen, select the data profile appropriate for your workload that balances performance, availability, and capacity.

For a description of available profiles, see

“Data Profiles for Storage Pools” on page 152

.

(Optional) If you allocated log devices, select an appropriate profile.

Click COMMIT.

Related Topics

All-Flash Storage Configuration

“Setting a Threshold Alert for SSD Endurance (BUI)” in Oracle ZFS Storage Appliance

Customer Service Manual

Configuring an All-Flash Storage Pool (CLI)

Before You Begin

An all-flash storage pool utilizes SSDs as data devices and optional log devices, but does not contain read cache or meta devices. All-flash pools are suitable for virtualization environments or backup workloads.

Follow the cabling guidelines for all-flash shelves described in “Cabinet and Cabling

Guidelines” in Oracle ZFS Storage Appliance Cabling Guide .

Configuring the Appliance 131

Configuring an All-Flash Storage Pool (CLI)

For recommendations on how many drives to select per pool, as well as other considerations

and guidelines, see “Storage Pool Concepts” on page 150 .

To understand the different data profiles, see

“Data Profiles for Storage

Pools” on page 152 .

Note -

Do not perform a pool configuration operation while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to maintenance system updates.

1.

Verify SSDs are correctly attached and functioning.

If any devices are missing or malfunctioning, make the necessary corrections.

Note -

An all-flash pool cannot contain read cache devices or meta devices.

2.

3.

4.

5.

Go to configuration storage, enter config and a unique name for the pool:

hostname:configuration storage> config allflashpool

Instructions and subcommands that can be used in this context are displayed.

Show the available devices for the pool.

hostname:configuration storage verify> show

ID STATUS ALLOCATION DATA LOG CACHE RPM TYPE

-- ------- ---------- ----------- ----------- ----------- -----

------

0 ok custom 0 0 0

system

1 ok custom 0/7 3.46T 0/2 373G 0 ssd

2 ok custom 0/24 6.55T 0 0 ssd

----------- ----------- -----------

0 0 0

List the available properties:

hostname:configuration storage verify> help properties

0 => Chassis 0

1-data => Chassis 1 data

1-log => Chassis 1 log

2 => Chassis 2

2-data => Chassis 2 data

Assign the devices to the pool, as shown in this example:

hostname:configuration storage verify> set 1-data=3 2-data=3

132 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a Disk Shelf to an Existing Storage Pool (BUI)

6.

7.

8.

9.

10.

11.

1-data = 3

2-data = 3

This example assigns 3 devices from chassis 1 (1-data=3) and 3 devices from chassis 2 (2data=3) to the pool.

(Optional) Select log devices to add to the all-flash pool.

Enter done to close verify.

hostname:configuration storage verify> done

Show the available storage profile types:

hostname:configuration storage config>show

Select the data profile appropriate for your workload, that balances performance, availability, and capacity.

For a description of available profiles, see

“Data Profiles for Storage Pools” on page 152

.

hostname:configuration storage config>set profile=

(Optional) If you allocated log devices, select an appropriate profile.

Enter done.

hostname:configuration storage config> done

Related Topics

All-Flash Storage Configuration

“Setting a Threshold Alert for SSD Endurance (CLI)” in Oracle ZFS Storage Appliance

Customer Service Manual

Adding a Disk Shelf to an Existing Storage Pool

(BUI)

Before You Begin

Use the following task to add a disk shelf to an existing storage pool.

For recommendations on how many drives to select per pool, as well as other considerations and guidelines, see

“Storage Pool Concepts” on page 150 .

Configuring the Appliance 133

Adding a Disk Shelf to an Existing Storage Pool (BUI)

You must select the same data profile currently used in the existing pool. To understand the different data profiles, see

“Data Profiles for Storage Pools” on page 152

.

If there is insufficient storage to configure the system for the data profile and its options, some attributes may not be supported. For example, it is impossible to preserve NSPF characteristics when adding a single disk shelf to a double parity RAID configuration with the NSPF option. You can add the disk shelf, but cannot use the NSPF option.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to Maintenance > System.

Caution -

Once a disk has been added to a pool, it cannot be removed without destroying the pool entirely and losing all data.

4.

5.

8.

9.

6.

7.

2.

3.

1.

Install the new disk shelf using “Adding a New Disk Shelf” in Oracle ZFS Storage

Appliance Customer Service Manual

.

Go to Configuration > Storage.

From the Available Pools list, select an online pool to which to add the disk shelf.

Click ADD.

For this disk shelf, select the number of data drives for the storage pool.

If the new disk shelf does not appear, click ABORT, check the disk shelf cabling and power, and begin this procedure again.

If all drives are the same size or rotational speed, or if one size is selected among multiple sizes, the maximum number of drives available is allocated by default. If the storage device contains drives of different rotational speeds or models, no drives are allocated by default.

It is strongly recommended that pools include only devices of the same size and rotational speed to provide consistent performance characteristics.

Monitor or limit space usage because you may experience reduced performance when pools approach full capacity.

(Optional) Add any cache or log devices from the disk shelf to the pool.

Click COMMIT.

For data drives, select the same data profile used in the existing pool.

If you allocated log or cache devices, select the appropriate profiles.

134 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a Disk Shelf to an Existing Storage Pool (CLI)

For log devices, click Log Profile and select either the mirrored or striped profile. If you allocated an even number of log devices to the pool, select the mirrored profile.

10.

Caution -

A double failure can cause loss of data from a log in a striped configuration. It is highly recommended to configure a mirrored log profile for added redundancy. For more

information, see “Data Profiles for Storage Pools” on page 152 .

For cache devices, the profile is always striped, as shown under Cache Profile.

Click COMMIT.

Related Topics

“Unconfiguring a Storage Pool (BUI)” on page 143

“Adding a Cache, Meta, or Log Device to an Existing Storage Pool (BUI)” on page 137

Before You Begin

Adding a Disk Shelf to an Existing Storage Pool

(CLI)

Use the following task to add a disk shelf to an existing storage pool.

For recommendations on how many drives to select per pool, as well as other considerations and guidelines, see

“Storage Pool Concepts” on page 150 .

You must select the same data profile currently used in the existing pool. To understand the

different data profiles, see “Data Profiles for Storage Pools” on page 152

.

If there is insufficient storage to configure the system for the data profile and its options, some attributes may not be supported. For example, it is impossible to preserve NSPF characteristics when adding a single disk shelf to a double parity RAID configuration with the NSPF option. You can add the disk shelf, but cannot use the NSPF option.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to maintenance system updates.

Caution -

Once a disk has been added to a pool, it cannot be removed without destroying the pool entirely and losing all data.

1.

2.

Install the new disk shelf using “Adding a New Disk Shelf” in Oracle ZFS Storage

Appliance Customer Service Manual

.

Go to configuration storage.

Configuring the Appliance 135

Adding a Disk Shelf to an Existing Storage Pool (CLI)

3.

If you have multiple pools, a default pool is selected and displayed. If this is not the pool to which you want to add the device, enter set pool= and specify another online pool.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

4.

5.

6.

7.

8.

hostname:configuration storage (pool0)> set pool=pool1

pool = pool1

A message reminds you to verify that the device is correctly installed. Note that mixing device types and speeds is strongly discouraged.

Enter add

.

hostname:configuration storage (pool1)> add

Enter show to see the device information for the pool:

hostname:configuration storage (pool1) verify> show

ID STATUS ALLOCATION DATA LOG CACHE RPM

0 ok custom 0 0 0/4 1.86T

1 ok custom 0 0/2 34G 0 15000

2 ok custom 0 0/2 34G 0 15000

Specify which disk shelf or the controller and the number of data drives to use.

ID "0" is the controller, and the remaining IDs are the disk shelves. In the following example,

1-data=8

allocates eight data drives from the first disk shelf.

hostname:configuration storage (pool1) verify> set 1-data=8

1-data = 8

(Optional) Specify which disk shelf or the controller and the number of log or cache devices to use.

ID "0" is the controller, and the remaining IDs are the disk shelves. In the following example,

set 0-cache=1

allocates one cache device from the controller: hostname:configuration storage (pool1) verify> set 0-cache=1

0-cache = 1

Enter done.

hostname:configuration storage (pool1) verify> done

The storage devices are verified for presence and minimum functionality. If verification fails, fix the problem, and begin this procedure again. If you allocate a pool with missing or failed devices, you will not be able to add the missing or failed devices later.

136 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a Cache, Meta, or Log Device to an Existing Storage Pool (BUI)

9.

10.

11.

12.

Enter show to display the profile.

hostname:configuration storage (pool1) config> show

PROFILE CAPACITY NSPF DESCRIPTION log_profile 17G no Striped log

Enter the same data profile as the remainder of the pool by entering set profile= and the profile name.

Enter done.

If you allocated log devices to the pool, enter set log_profile= and either log_mirror

or log_stripe. Use log_mirror if the pool contains an even number of log devices.

hostname:configuration storage (pool1)> set log_profile=log_mirror

Note -

If you allocated cache devices to the pool, the profile is always striped.

13.

Enter done.

Related Topics

“Unconfiguring a Storage Pool (CLI)” on page 144

“Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI)” on page 138

Adding a Cache, Meta, or Log Device to an

Existing Storage Pool (BUI)

Before You Begin

1.

Use the following task to add a log, read cache, or meta device to an existing storage pool.

For recommendations on how many drives to select per pool, as well as other considerations and guidelines, see

“Storage Pool Concepts” on page 150 .

You must select the same data profile currently used in the existing pool. To understand the

different data profiles, see “Data Profiles for Storage Pools” on page 152

.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to Maintenance > System.

Install the new log, read cache, or meta device into the first available and appropriate slot. To determine the appropriate slot, see “Disk Shelf

Configurations” in Oracle ZFS Storage Appliance Customer Service Manual .

Configuring the Appliance 137

Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI)

4.

5.

2.

3.

6.

Go to Configuration > Storage.

From the Available Pools list, select an online pool to which to add the device.

Click ADD.

Select the device to add to the pool and click COMMIT.

Select the appropriate profiles.

For log devices, click Log Profile and select either the mirrored or striped profile. Use the mirrored profile if the pool now contains an even number of log devices.

Caution -

A double failure can cause loss of data from a log in a striped configuration. It is highly recommended to configure a mirrored log profile for added redundancy. For more

information, see “Data Profiles for Storage Pools” on page 152

.

7.

For cache devices, the profile is always striped, as shown under Cache Profile.

For meta devices, click Metadata Profile and select either the mirrored or striped profile.

The striped profile is recommended for better peformanace in the event of a meta device failure.

Click COMMIT.

Related Topics

“Removing a Cache or Log Device from an Existing Storage Pool (BUI)” on page 141

“Adding a Disk Shelf to an Existing Storage Pool (BUI)” on page 133

“Data Profiles for Storage Pools” on page 152

“Storage Pool Concepts” on page 150

Adding a Cache, Meta, or Log Device to an

Existing Storage Pool (CLI)

Before You Begin

Use the following task to add a read cache device or log device to an existing storage pool.

For recommendations on how many drives to select per pool, as well as other considerations

and guidelines, see “Storage Pool Concepts” on page 150 .

138 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI)

1.

2.

3.

You must select the same data profile currently used in the existing pool. To understand the

different data profiles, see “Data Profiles for Storage Pools” on page 152

.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to maintenance system updates.

Install the new log, read cache, or meta device into the first available and appropriate slot. To determine the appropriate slot, see “Disk Shelf

Configurations” in Oracle ZFS Storage Appliance Customer Service Manual .

Go to configuration storage.

If you have multiple pools, a default pool is selected and displayed. If this is not the pool to which you want to add a device, enter set pool= and specify another online pool.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

4.

5.

6.

7.

hostname:configuration storage (pool0)> set pool=pool1

pool = pool1

A message reminds you to verify that storage is correctly attached and functioning.

Enter add:

hostname:configuration storage (pool1)> add

Enter show to display device information for the pool.

hostname:configuration storage (pool1) verify> show

ID STATUS ALLOCATION DATA LOG CACHE META RPM

0 ok custom 0 0 0/4 0/4 1.86T

1 ok custom 0 0/2 34G 0 0 15000

2 ok custom 0 0/2 34G 0/2 0 15000

Enter set and use tab completion to see if cache, meta, and log devices are available.

hostname:configuration storage (pool1) verify> set

0-cache 1-data 2-cache 2-meta 2-log

Enter set and the disk shelf or controller ID, and the number of log, cache, or meta devices to use.

ID "0" is the controller, and the remaining IDs are the disk shelves. In the following example,

2-log=1

allocates one log device from the second disk shelf.

Configuring the Appliance 139

Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI) hostname:configuration storage (pool1) verify> set 2-log=1

2-log = 1

Note -

A value of "1-log=2" would allocate two log devices from the first disk shelf.

8.

9.

This example allocates one cache device from the second disk shelf.

hostname:configuration storage (pool1) verify> set 2-cache=1

2-cache = 1

This example allocates one meta device from the second disk shelf: hostname:configuration storage (pool1) verify> set 2-meta=1

2-meta = 1

Enter done.

hostname:configuration storage (pool1) verify> done

Enter show to display the profile.

hostname:configuration storage (pool1) config> show

PROFILE CAPCTY NSPF DESCRIPTION log_profile = log_stripe 17G no Striped log

Note -

If you allocated cache devices to the pool, the profile is always striped.

10.

If you allocated log devices to the pool, enter set log_profile= and set the log profile to either log_mirror or log_stripe. Use log_mirror if the pool now contains an even number of log devices.

Caution -

A double failure can cause loss of data from a log in a striped configuration. It is highly recommended to configure a mirrored log profile for added redundancy. For more

information, see “Data Profiles for Storage Pools” on page 152

.

11.

12.

hostname:configuration storage (pool1)> set log_profile=log_mirror

If you allocated meta devices to the pool, enter set meta_profile= and set the meta profile to either meta_mirror or meta_stripe.

hostname:configuration storage (pool1)> set meta_profile=meta_mirror

Enter done to complete the task.

140 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Removing a Cache or Log Device from an Existing Storage Pool (BUI) hostname:configuration storage (pool1)> done

Related Topics

“Removing a Cache or Log Device from an Existing Storage Pool (CLI)” on page 142

“Adding a Disk Shelf to an Existing Storage Pool (CLI)” on page 135

“Data Profiles for Storage Pools” on page 152

“Storage Pool Concepts” on page 150

Removing a Cache or Log Device from an Existing

Storage Pool (BUI)

Use the following task to remove a read cache or log device from an existing storage pool. This capability is useful when preparing for a system update that requires the removal of certain cache devices.

Note -

Meta devices cannot be removed from a storage pool.

Before You Begin

3.

4.

1.

2.

If a pool has cache devices on both controllers of a clustered configuration, you must perform this procedure on each controller.

To add a device to a different, existing storage pool, see

“Adding a Cache, Meta, or Log Device to an Existing Storage Pool (BUI)” on page 137

.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to Maintenance > System.

Go to Configuration > Storage.

From the Available Pools list, select an online pool from which to remove the device.

Click REMOVE.

Select the number of log and cache devices to be removed from the storage pool.

Note -

If the log devices use a mirrored profile, a message reminds you to select an even number of log devices to remove. If they use a striped profile, you may remove an even or odd number of devices.

Configuring the Appliance 141

Removing a Cache or Log Device from an Existing Storage Pool (CLI)

5.

Click COMMIT.

Related Topics

“Adding a Cache, Meta, or Log Device to an Existing Storage Pool (BUI)” on page 137

Removing a Cache or Log Device from an Existing

Storage Pool (CLI)

Use the following task to remove a read cache or log device from an existing storage pool. This capability is useful when preparing for a system update that requires the removal of certain cache devices.

Note -

Meta devices cannot be removed from a storage pool.

Before You Begin

If a pool has cache devices on both controllers of a clustered configuration, you must perform this procedure on each controller.

To add a device to a different, existing storage pool, see “Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI)” on page 138 .

Do not perform a pool configuration operation while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to maintenance system updates.

1.

2.

Go to configuration storage.

If you have multiple pools, a default pool is displayed and selected. If this is not the pool to which you want to add the device, enter set pool= and specify another online pool.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

3.

hostname:configuration storage (pool0)> set pool=pool1

pool = pool1

Enter show to see the device information for the pool.

hostname:configuration storage (pool1) verify> show

ID STATUS ALLOCATION DATA LOG CACHE META RPM

0 ok custom 0 0 0/4 0/4 1.86T

142 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Unconfiguring a Storage Pool (BUI)

4.

5.

6.

1 ok custom 0 0/2 34G 0 0 15000

2 ok custom 0 0/2 34G 0/2 0 15000

Enter remove.

hostname:configuration storage (pool1)> remove

Specify the controller or disk shelf, and the number of log or cache devices to remove.

ID "0" is the controller, and the remaining IDs are the disk shelves. In the following example,

1-log=2

removes two log devices from the first disk shelf: hostname:configuration storage (pool1) remove> set 1-log=2

1-log = 2

This example removes one cache device from the controller: hostname:configuration storage (pool1) remove> set 0-cache=1

0-cache = 1

Enter done.

hostname:configuration storage (pool1) remove> done

Note -

If the log devices use a mirrored profile, a message reminds you to select an even number of log devices to remove. If the log devices use a striped profile, you may remove an even or odd number of devices.

Related Topics

“Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI)” on page 138

Unconfiguring a Storage Pool (BUI)

Unconfiguring a storage pool removes any active filesystems and LUNs and makes the raw storage available for future storage configuration. This process can be undone by importing the unconfigured storage pool, if the raw storage has not since been used as part of an active storage pool.

Caution -

Unconfiguring a pool renders data inaccessible, creates the potential for data loss, and fails inbound replications.

Configuring the Appliance 143

Unconfiguring a Storage Pool (CLI)

Before You Begin

Do not unconfigure a pool while a disk firmware upgrade is occurring. To check if an upgrade is in progress, navigate to Maintenance > System.

Do not unconfigure a pool while the peer controller is down or unreachable.

If an error message reports that the target is in use, wait and try the operation again.

1.

2.

3.

Go to Configuration > Storage.

From the Available Pools list, select an online pool to unconfigure.

Click UNCONFIG.

Related Topics

“Importing an Existing Storage Pool (BUI)” on page 128

“Renaming a Storage Pool (BUI)” on page 145

Unconfiguring a Storage Pool (CLI)

Unconfiguring a storage pool removes any active filesystems and LUNs and makes the raw storage available for future storage configuration. This process can be undone by importing the unconfigured storage pool, if the raw storage has not since been used as part of an active storage pool.

Caution -

Unconfiguring a pool renders data inaccessible, creates the potential for data loss, and fails inbound replications.

Before You Begin

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to maintenance system updates.

Do not unconfigure a pool while the peer controller is down or unreachable.

If an error message reports that the target is in use, wait and try the operation again.

1.

2.

Go to configuration storage.

If you have multiple pools, a default pool is selected and displayed. If this is not the pool you want to unconfigure, enter set pool= and specify another online pool.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

144 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Renaming a Storage Pool (BUI)

3.

4.

hostname:configuration storage (pool0)> set pool=pool1

pool = pool1

Enter unconfig.

hostname:configuration storage (pool1)> unconfig

Enter done.

Related Topics

“Importing an Existing Storage Pool (CLI)” on page 128

“Renaming a Storage Pool (CLI)” on page 146

Renaming a Storage Pool (BUI)

Before You Begin

To rename a storage pool, you must unconfigure it and then immediately import it with a new name. While storage is unconfigured, data will be inaccessible and there is a potential for data loss. Importing a storage pool can take a considerable amount of time.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to Maintenance > System.

Do not rename a pool while the peer controller is down or unreachable.

1.

2.

3.

4.

5.

6.

Go to Configuration > Storage.

From the Available Pools list, select the online pool to rename.

Click UNCONFIG, then COMMIT.

Click IMPORT, then select the storage pool you just unconfigured.

Click the storage pool name and change it.

Click COMMIT.

Related Topics

“Unconfiguring a Storage Pool (BUI)” on page 143

Configuring the Appliance 145

Renaming a Storage Pool (CLI)

“Importing an Existing Storage Pool (BUI)” on page 128

Renaming a Storage Pool (CLI)

Before You Begin

To rename a storage pool, you must unconfigure it and then immediately import it with a new name. While storage is unconfigured, data will be inaccessible and there is a potential for data loss. Importing a storage pool can take a considerable amount of time.

Do not perform a pool configuration operation while a disk firmware upgrade is occurring.

To check if an upgrade is in progress, navigate to maintenance system updates.

Do not rename a pool while the peer controller is down or unreachable.

1.

2.

Go to configuration storage.

If you have multiple pools, a default pool is selected and displayed. If this is not the pool you want to rename, enter set pool= and specify another online pool.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

3.

4.

5.

hostname:configuration storage (pool0)> set pool=pool1

pool = pool1

Enter unconfig.

hostname:configuration storage (pool1)> unconfig

Enter done.

Enter import.

hostname:configuration storage> import

Search for storage. Begin the process of searching for existing storage pools.

Subcommands that are valid in this context:

help [topic] => Get context-sensitive help. If [topic] is specified,

it must be one of "builtins", "commands", "general",

"help" or "script".

show => Show information pertinent to the current context

146 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Scrubbing a Storage Pool (BUI)

6.

7.

8.

9.

abort => Abort this task (potentially resulting in a

misconfigured system)

done => Finish operating on "discover" hostname:configuration storage> discover>

Enter done.

To select the storage pool you just unconfigured, enter set pool= and the pool name.

hostname:configuration storage select> set pool=pool1

pool = pool1

To rename the storage pool, enter set name= and a new name.

hostname:configuration storage (pool1)> set name=NewPool

pool = NewPool

Enter done.

Related Topics

“Unconfiguring a Storage Pool (CLI)” on page 144

“Importing an Existing Storage Pool (CLI)” on page 128

1.

2.

3.

Scrubbing a Storage Pool (BUI)

Scrubbing a storage pool verifies the content by checking for errors. If any unrecoverable errors are found, either through a scrub or through normal operation, the BUI displays the affected files.

In general, a scrub should be performed as often as your oldest backup expires, at a minimum.

The recommended time frame for performing a scrub is quarterly. A scrub should also be run before performing a software upgrade.

Go to Configuration > Storage.

From the Available Pools list, select the online pool to scrub.

Click SCRUB.

Configuring the Appliance 147

Scrubbing a Storage Pool (CLI)

4.

The scrub status is displayed, including the date and time of the scrub, the number of errors, and the filenames with errors.

(Optional) To stop the scrub, click STOP.

Clicking SCRUB again resumes the scrub from where it was stopped.

Related Topics

“Storage Pool Concepts” on page 150

1.

2.

Scrubbing a Storage Pool (CLI)

Scrubbing a storage pool verifies the content by checking for errors. If any unrecoverable errors are found, either through a scrub or through normal operation, the CLI displays the affected files. If desired, the scrub process can be stopped before completion.

In general, a scrub should be performed as often as your oldest backup expires, at a minimum.

The recommended time frame for performing a scrub is quarterly. A scrub should also be run before performing a software upgrade.

Go to configuration storage.

If you have multiple pools, a default pool is selected and displayed. If this is not the pool you want to scrub, enter set pool= and specify another online pool.

Note -

If you have a single pool, the pool name is not displayed, but it is selected.

3.

4.

hostname:configuration storage (pool0)> set pool=pool1

pool = pool1

Enter scrub start.

hostname:configuration storage (pool1)> scrub start

(Optional) Stop the scrub before it has completed by entering scrub stop.

hostname:configuration storage (pool1)> scrub stop

Entering scrub start again resumes the scrub from where it was stopped.

Related Topics

“Storage Pool Concepts” on page 150

148 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing Pool and Device Status (BUI)

1.

2.

Viewing Pool and Device Status (BUI)

You can check the status of pool and component devices. If there is a problem with a pool, details about device status will also be listed.

Navigate to Configuration > Storage.

Click a pool to select it and see more details.

Refer to the following table for a description of the pool status.

3.

Pool Status

Online

Degraded

Faulted

Offline

Unavailable

Exported

Description

A pool that has all devices operating normally.

A pool with one or more failed devices, but the data is still available due to a redundant configuration.

One or more component devices are offline and there are insufficient replicas to continue functioning.

A pool was explicitly taken offline.

A pool with corrupted metadata, or one or more unavailable devices and insufficient replicas to continue functioning.

A pool is active on the cluster peer and is ready for a cluster failback to occur.

View the selected pool's device statuses under the Device Status section.

Refer to the following table for a description of the device status.

4.

Device Status

Online

Degraded

Faulted

Offline

Removed

Hot Spare

Unavailable

Description

The device is online and functioning. You may not see this status, and instead see the message

"No device faults have been detected in the storage pool."

The device is not in an optimal state. Either it is expected to fail soon, or a spare has not finished resilvering yet.

The device is faulty; more information can be found in the maintenance logs.

The device was explicitly taken offline; no reads or writes will occur to this device until it has been onlined.

The device has been physically removed.

This spare device is actively being used as a data disk in the pool as a replacement for a device that failed.

The device could not be opened or the pool could not detect this device.

To see more detailed pool and device error information, navigate to Maintenance

> Problems for active errors, or Maintenance > Logs for a history of all problems.

Configuring the Appliance 149

Viewing Pool and Device Status (BUI)

Storage Pool Concepts

Storage is configured in pools that are characterized by their underlying data redundancy, and provide space that is shared across all filesystems and LUNs. More information about how storage pools relate to individual filesystems or LUNs can be found in

“About Storage Pools,

Projects, and Shares” on page 399

.

Storage Pool Configuration

Pools can be created by configuring a new pool, or importing an existing pool. Importing an existing pool is only used to import pools previously configured on an Oracle ZFS Storage

Appliance, and is useful in case of accidental reconfiguration, such as when moving pools between controllers, or due to catastrophic controller failure.

Multiple Pools

Each controller can have any number of pools, and each pool can be assigned ownership independently in a cluster. With the ability to control access to log and cache devices on a pershare basis, the recommended mode of operation is a single pool. While arbitrary number of pools are supported, creating multiple pools with the same redundancy characteristics owned by the same cluster head is not advised. Doing so will result in poor performance, suboptimal allocation of resources, artificial partitioning of storage, and additional administrative complexity. Configuring multiple pools on the same host is only recommended when drastically different redundancy or performance characteristics are desired, for example a mirrored pool for databases and a RAID-Z pool for streaming workloads.

Number of Devices per Pool

Drives within all of the chassis can be allocated individually; however, care should be taken when allocating disks from disk shelves to ensure optimal pool configurations. In general, fewer pools with more disks per pool are preferred because they simplify management and provide a higher percentage of overall usable capacity.

While the system can allocate storage in any increment desired, it is recommended that each allocation include a minimum of 8 disks across all disk shelves and ideally many more.

Drive Characteristics and Performance

Follow these restrictions when configuring storage pools:

150 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing Pool and Device Status (BUI)

All data disks contained within a head node or disk shelf must have the same rotational speed (media rotation rate). The appliance software will detect misconfigurations and generate a fault for the condition.

Due to unpredictable performance issues, avoid mixing different disk rotational speeds within the same pool.

For optimal performance, do not combine disk shelves with different disk rotational speeds on the same SAS fabric (HBA connection). Such a mixture operates correctly, but likely results in slower performance of the faster devices.

When creating a new pool, avoid mixing different data disk capacities because all disks are then limited to the smallest capacity disk in the pool. When adding a higher capacity disk to an existing pool, the larger disk's capacity is maintained. However, the system preferentially writes to new disks until they begin to reach the same capacity utilization as the old disks.

To maintain performance, add as many new higher capacity disks as the total number of disks in the original pool.

Storage Pool Capacity

When allocating raw storage to pools, keep in mind that filling pools completely will result in significantly reduced performance, especially when writing to shares or LUNs. These effects become more noticeable as the pool reaches full capacity.

All-Flash Storage Configuration

The Oracle Storage Drive Enclosure DE3-24P can be configured as all-flash storage with fully populated flash-based SSD data devices and optional log devices. All-flash storage provides low-latency I/O that increases workload performance.

An all-flash storage pool contains data SSDs and optional log devices. Read flash cache and meta devices cannot be part of an all-flash pool. The remaining lifetime of SSDs can be monitored using threshold alerts.

Related Topics

Configuring an All-Flash Storage Pool

BUI

,

CLI

“Disk Shelf Configurations” in Oracle ZFS Storage Appliance Customer Service Manual

“SSD Endurance” in Oracle ZFS Storage Appliance Customer Service Manual

Configuring the Appliance 151

Viewing Pool and Device Status (BUI)

Data Profiles for Storage Pools

After storage devices are physically verified and resources are allocated for a storage pool, the next step is to choose a storage profile that reflects your reliability, availability, serviceability

(RAS), and performance goals. The set of possible profiles presented depends on your available storage. The following table lists all possible profiles and their descriptions.

TABLE 24

Data Profiles

Data Profile

Dual Parity Options

Triple mirrored

Double parity RAID

Single Parity Options

Mirrored

Single parity RAID, narrow stripes

Other

Striped

Description

Data is triply mirrored, yielding a very highly reliable and high-performing system (for example, storage for a critical database). This configuration is intended for situations in which maximum performance and availability are required. Compared with a two-way mirror, a three-way mirror adds additional IOPS per stored block and higher level protection against failures.

Note: A controller without expansion storage should not be configured with triple mirroring.

RAID in which each stripe contains two parity disks.

As with triple mirroring, this yields high availability, as data remains available with the failure of any two disks.

Double parity RAID is a higher capacity option than the mirroring options and is intended either for highthroughput sequential-access workloads (such as backup) or for storing large amounts of data with low randomread component.

Data is mirrored, reducing capacity by half, but yielding a highly reliable and high-performing system.

Recommended when space is considered ample, but performance is at a premium (for example, database storage).

RAID in which each stripe is kept to three data disks and a single parity disk. For situations in which single parity protection is acceptable, single parity RAID offers a much higher capacity option than simple mirroring.

This higher capacity needs to be balanced against a lower random read capability than mirrored options.

Single parity RAID can be considered for non-critical applications with a moderate random read component.

For pure streaming workloads, give preference to the

Double parity RAID option which has higher capacity and more throughput.

Data is striped across disks, with no redundancy. While this maximizes both performance and capacity, a single

152 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing Pool and Device Status (BUI)

Data Profile

Triple parity RAID, wide stripes

Description

disk failure will result in data loss. This configuration is not recommended. For pure streaming workloads, consider using Double parity RAID. Due to nonredundancy, disks configured in a striped profile will not receive firmware updates, unless the configured storage pools are in an exported state.

RAID in which each stripe has three disks for parity.

This is the highest capacity option apart from Striped

Data. Resilvering data after one or more drive failures can take significantly longer due to the wide stripes and low random I/O performance. As with other RAID configurations, the presence of cache can mitigate the effects on read performance. This configuration is not generally recommended.

Note -

Earlier software versions supported double parity with wide stripes. This has been supplanted by triple parity with wide stripes, as it adds significantly better reliability. Pools configured as double parity with wide stripes under a previous software version continue to be supported, but newly-configured or reconfigured pools cannot select that option.

NSPF Option

For expandable systems, some profiles may be available with an 'NSPF' option. This stands for

'no single point of failure' and indicates that data is arranged in mirrors or RAID stripes such that a pathological disk shelf failure will not result in data loss. Note that systems are already configured with redundancy across nearly all components. Each disk shelf has redundant paths, redundant controllers, and redundant power supplies and fans. The only failure that NSPF protects against is disk backplane failure (a mostly passive component), or gross administrative misconduct (detaching both paths to one disk shelf). In general, adopting NSPF will result in lower capacity, as it has more stringent requirements on stripe width.

Log Devices

Log devices can be configured using only striped or mirrored profiles. Log devices are only used in the event of node failure. For data to be lost with unmirrored logs, it is necessary for both the device to fail and the node to reboot immediately after. This a highly-unlikely event, however mirroring log devices can make this effectively impossible, requiring two simultaneous device failures and node failure within a very small time window.

Note -

When different sized log devices are in different chassis, only striped log profiles can be created.

Configuring the Appliance 153

Viewing Pool and Device Status (BUI)

Cache Devices

In a cluster configuration, cache devices installed in controller slots are available only to the controller which has the storage pool imported. In a cluster, it is possible to configure cache devices on both controllers to be part of the same pool. To do this, take over the pool on the passive node, then add storage, and select the cache devices. This has the effect of having half the global cache devices configured at any one time. While the data on the cache devices will be lost on failover, the new cache devices can be used on the new controller.

Cache devices installed in disk shelf slots, when added to a pool, are automatically imported during a cluster failback or takeover. No additional pool configuration is required.

Meta Devices

A meta device is a cache device used to store deduplicated metadata and other metadata for projects and shares. Meta devices can be allocated to a storage pool, but not an all-flash storage pool, during and after storage pool creation. However, they cannot be re-configured as normal cache devices for a pool, nor can they be removed from a pool.

Before using meta devices and the deduplication feature for new and existing storage pools, accept the deferred software update for Data Deduplication v2, introduced with software version OS8.7.0 (2013.1.7.0). If replicating to other systems, both the replication source and

targets must have this deferred update. For more information, see Data Deduplication

, and

“Data Deduplication v2 Deferred Update” in Oracle ZFS Storage Appliance Customer Service

Manual

.

Hot Spares

Hot spares are allocated as a percentage of total pool size and are independent of the profile chosen (with the exception of striped, which doesn't support hot spares). Because hot spares are allocated for each storage configuration step, it is much more efficient to configure storage as a whole than it is to add storage in small increments.

Related Topics:

Creating a Storage Pool ( BUI

,

CLI ).

Adding a Cache, Meta, or Log Device to an Existing Storage Pool ( BUI ,

CLI ).

154 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Understanding the Appliance Status

Understanding the Appliance Status

The Status section provides a summary of appliance status and configuration options. Use the following sections for conceptual and procedural information about appliance status views and related service configuration:

“About the Oracle ZFS Storage Appliance” on page 19

“Dashboard Status” on page 156

“Summary of Memory Use” on page 161

“Disk Activity Dashboard” on page 162

“Dashboard CLI” on page 164

“Running the Dashboard Continuously” on page 165

“Status Dashboard Settings” on page 166

“Changing the Displayed Activity Statistics” on page 168

“Changing the Activity Thresholds” on page 168

“NDMP Status” on page 169

“NDMP States” on page 170

Configuring the Appliance 155

Understanding the Appliance Status

Dashboard Status

The Dashboard summarizes appliance status.

The Status Dashboard provides links to all the main screens of the browser user interface (BUI).

Over 100 visible items on the Dashboard link to associated BUI screens indicated by a border or highlighted text that appears on mouse-over. The sections that follow describe the areas of the

Dashboard in detail.

Dashboard Usage

The Usage area of the Dashboard provides a summary of your storage pool and main memory usage. The name of the pool appears at the top right of the Usage area. If multiple pools are configured, use the pull-down list to select the desired pool to display.

156 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

FIGURE 10

Status Dashboard Usage

Understanding the Appliance Status

The total pool capacity is displayed at the top of this area. The Storage pie-chart details the used, available, and free space. To go to the Shares screen for the pool, click the Storage piechart.

Dashboard Services

This area of the Dashboard shows the status of services on the appliance, with a light icon to show the state of each service.

Configuring the Appliance 157

Understanding the Appliance Status

FIGURE 11

Services Dashboard

Most services are green to indicate that the service is online, or grey to indicate that the service is disabled. For a reference of all possible states and icon colors, see

“Browser User Interface

(BUI)” on page 22

for a reference of all possible states and icon colors.

To go to the associated configuration screen, click on a service name. The Properties screen appears with configurable fields, restart, enable, and disable icons, and a link to the associated

Logs screen for the service.

Dashboard Hardware

This area of the Dashboard shows an overview of hardware on the appliance.

158 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

FIGURE 12

Hardware Dashboard

Understanding the Appliance Status

If there is a known fault, the amber fault icon appears.

To go to the Hardware screen for a detailed look at hardware state, click the name of a hardware component.

Dashboard Activity

The activity area of the Dashboard shows graphs of eight performance statistics by default. The example in this section shows Disk operations/sec. The statistical average is plotted in blue and the maximum appears in light grey.

FIGURE 13

Disk Activity Dashboard

Configuring the Appliance 159

Understanding the Appliance Status

To go to the Analytics worksheet for an activity, click one of the four graphs (day, hour, minute, second) for the statistic you want to evaluate.

To view the average for each graph, mouse-over a graph and the average appears in the tooltip.

The weather icon in the upper-left provides a report of activity according to thresholds you can

customize for each statistic on the “Status Dashboard Settings” on page 166

screen.

TABLE 25

Summary of Statistic Graphs

Summary of Statistic Graphs

7-day graph (7d)

24-hour graph (24h)

60-minute graph (60m)

1-second graph

A bar chart, with each bar representing one day.

A bar chart, with each bar representing one hour.

A line plot, representing activity over one hour (also visible as the first one-hour bar in the 24-hour graph).

A line plot, representing instantaneous activity reporting.

The average for the selected plot is shown numerically above the graph. To change the average that appears, select the average you want, either 7d, 24h, or 60m.

The vertical scale of all graphs is printed on the top right, and all graphs are scaled to this same height. The height is calculated from the selected graph (plus a margin). The height will rescale based on activity in the selected graph, with the exception of utilization graphs which have a fixed height of 100 percent.

Since the height can rescale, 60 minutes of idle activity may look similar to 60 minutes of busy activity. Always check the height of the graphs before trying to interpret what they mean.

Understanding some statistics may not be obvious - you might wonder, for a particular appliance in your environment, whether 1000 NFSv3 ops/sec is considered busy or idle. This is where the 24-hour and 7-day plots can help, to provide historic data next to the current activity for comparison.

The plot height is calculated from the selected plot. By default, the 60-minute plot is selected.

So, the height is the maximum activity during that 60-minute interval (plus a margin). To rescale all plots to span the highest activity during the previous 7 days, select 7d. This makes it easy to see how current activity compares to the last day or week.

The weather icon is intended to grab your attention when something is unusually busy or idle.

To go to the weather threshold configuration page, click the weather icon. There is no good or bad threshold, rather the BUI provides a gradient of levels for each activity statistic. The statistics on which weather icons are based provide an approximate understanding for appliance performance that you should customize to your workload, as follows:

Different environments have different acceptable levels for performance (latency), and so there is no one-size-fits-all threshold.

160 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Understanding the Appliance Status

The statistics on the Dashboard are based on operations/sec and bytes/sec, so you should use

Analytics worksheets for an accurate understanding of system performance.

Recent Alerts

FIGURE 14

Recent Alerts

This section shows the last four appliance alerts. Click the box to go to the Logs screen to examine all recent alerts in detail.

Summary of Memory Use

The total system physical memory is displayed at the top of this area. To the left is a pie-chart showing memory usage by component. To go to the Analytics worksheet for dynamic memory usage broken down by application name, click the Memory pie-chart.

TABLE 26

Summary of Pool Usage

Summary Pool Usage

Used

Avail

Free

Compression

Dedup

Space used by this pool including data and snapshots.

Amount of physical disk space available. Space available for file data (as reported in the Shares screen) will be less than this, due to the consumption of filesystem metadata.

Amount of space available, within the LUN capacity, less unused space that is reserved by projects and shares within a pool. Provides the free disk space available when disk space is allocated by reservation in advance and/or when LUNs are created.

Current compression ratio achieved by this pool. Ratio will display 1x if compression is disabled.

Current data deduplication ratio achieved by this pool.

Ratio will display 1x if data deduplication is disabled.

Configuring the Appliance 161

Understanding the Appliance Status

TABLE 27

Summary of Main Memory Usage

Summary of main memory (RAM) usage

Cache

Unused

Mgmt

Other

Kernel

Bytes in use by the filesystem cache to improve performance.

Bytes not currently in use. After booting, this value will decrease as space is used by the filesystem cache.

Bytes in use by the appliance management software.

Bytes in use by miscellaneous operating system software.

Bytes in use by the operating system kernel.

Note that users need the analytics/component create+read authorization to view the memory usage. Without this authorization, the memory details do not appear on the Dashboard.

Disk Activity Dashboard

The activity area of the Dashboard shows graphs of eight performance statistics by default. The example in this section shows Disk operations/sec. The statistical average is plotted in blue and the maximum appears in light grey.

FIGURE 15

Disk Activity Dashboard

To go to the Analytics worksheet for an activity, click one of the four graphs (day, hour, minute, second) for the statistic you want to evaluate.

162 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Understanding the Appliance Status

To view the average for each graph, mouse-over a graph and the average appears in the tooltip.

The weather icon in the upper-left provides a report of activity according to thresholds you can customize for each statistic on the Status Settings screen.

TABLE 28

Summary of Statistic Graphs

Summary of Statistic Graphs

7-day graph (7d)

24-hour graph (24h)

60-minute graph (60m)

1-second graph

A bar chart, with each bar representing one day.

A bar chart, with each bar representing one hour.

A line plot, representing activity over one hour (also visible as the first one-hour bar in the 24-hour graph).

A line plot, representing instantaneous activity reporting.

The average for the selected plot is shown numerically above the graph. To change the average that appears, select the average you want, either 7d, 24h, or 60m.

The vertical scale of all graphs is printed on the top right, and all graphs are scaled to this same height. The height is calculated from the selected graph (plus a margin). The height will rescale based on activity in the selected graph, with the exception of utilization graphs which have a fixed height of 100 percent.

Since the height can rescale, 60 minutes of idle activity may look similar to 60 minutes of busy activity. Always check the height of the graphs before trying to interpret what they mean.

Understanding some statistics may not be obvious - you might wonder, for a particular appliance in your environment, whether 1000 NFSv3 ops/sec is considered busy or idle. This is where the 24-hour and 7-day plots can help, to provide historic data next to the current activity for comparison.

The plot height is calculated from the selected plot. By default, the 60-minute plot is selected.

So, the height is the maximum activity during that 60-minute interval (plus a margin). To rescale all plots to span the highest activity during the previous 7 days, select 7d. This makes it easy to see how current activity compares to the last day or week.

The weather icon is intended to grab your attention when something is unusually busy or idle.

To go to the weather threshold configuration page, click the weather icon. There is no good or bad threshold, rather the BUI provides a gradient of levels for each activity statistic. The statistics on which weather icons are based provide an approximate understanding for appliance performance that you should customize to your workload, as follows:

Different environments have different acceptable levels for performance (latency), and so there is no one-size-fits-all threshold.

The statistics on the Dashboard are based on operations/sec and bytes/sec, so you should use

Analytics worksheets for an accurate understanding of system performance.

Configuring the Appliance 163

Understanding the Appliance Status

Dashboard CLI

A text version of the Status > Dashboard screen is available from the CLI by typing status dashboard

: cuttlefish:> status dashboard

Storage:

pool_0:

Used 497G bytes

Avail 8.58T bytes

Free 8.43T bytes

State online

Compression 1x

Memory:

Cache 30.1G bytes

Unused 2.18G bytes

Mgmt 343M bytes

Other 474M bytes

Kernel 38.9G bytes

Services:

ad disabled smb disabled

dns online ftp disabled

http online identity online

idmap online ipmp online

iscsi online ldap disabled

ndmp online nfs online

nis online ntp online

routing online scrk maintenance

snmp online ssh online

tags online vscan online

Hardware:

CPU online Cards online

Disks faulted Fans online

Memory online PSU online

Activity:

CPU 1 %util Sunny

Disk 32 ops/sec Sunny

iSCSI 0 ops/sec Sunny

NDMP 0 bytes/sec Sunny

NFSv3 0 ops/sec Sunny

NFSv4 0 ops/sec Sunny

Network 13K bytes/sec Sunny

SMB 0 ops/sec Sunny

164 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Running the Dashboard Continuously

Recent Alerts:

2013-6-15 07:46: A cluster interconnect link has been restored.

The previous descriptions in this section apply, with the following differences:

The activity plots are not rendered in text (although we have thought about using aalib).

The storage usage section will list details for all available pools in the CLI, whereas the BUI only has room to summarize one.

Separate views are available, for example status activity show: caji:> status activity show

Activity:

CPU 10 %util Sunny

Disk 478 ops/sec Partly Cloudy

iSCSI 0 ops/sec Sunny

NDMP 0 bytes/sec Sunny

NFSv3 681 ops/sec Partly Cloudy

NFSv4 0 ops/sec Sunny

Network 22.8M bytes/sec Partly Cloudy

SMB 0 ops/sec Sunny caji:>

Running the Dashboard Continuously

1.

2.

3.

You might experience browser memory issues if you leave the Dashboard screen open in a browser continuously (24x7). The browser will increase in size (memory leaks), and need to be closed and reopened. Browsers are fairly good at managing memory when browsing through different websites (and opening and closing tabs). The issue is that the Dashboard screen is left running and not closed, which opens and reopens images for the activity plots, thus degrading image rendering performance.

If you experience this problem while using Firefox, disable the memory cache as follows:

Open about:config

Filter on "memory"

Set browser.cache.memory.enable = false.

Configuring the Appliance 165

Running the Dashboard Continuously

Status Dashboard Settings

The Status > Settings screen enables you to customize the Status Dashboard, including the statistics that appear and thresholds that indicate activity through the weather icons.

Use the layout tab to select the graphs that appear in the dashboard activity area, as defined in the following table.

TABLE 29

Name

<empty>

CPU

ARC Ratio

HTTP

Disk iSCSI

FC

NDMP

NFSv2

NFSv3

Status Layout Settings

-

Units

utilization utilization operations/sec operations/sec operations/sec operations/sec bytes/sec operations/sec operations/sec

Description

No graph will be displayed in this location.

Average cycles the appliance CPUs are busy. CPU cycles includes memory wait cycles.

Average ARC hit/miss percentage.

A drop in the hit rate indicates a potential performance problem.

Average number of HTTP operations.

Average number of operations to the physical storage devices.

Average number of iSCSI operations.

Average number of Fibre Channel operations.

Average NDMP network bytes.

Average number of NFSv2 operations.

Average number of NFSv3 operations.

166 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Running the Dashboard Continuously

Name

NFSv4.0

NFSv4.1

Network

SMB

SMB2

SMB3

FTP

SFTP

Units

operations/sec operations/sec bytes/sec operations/sec operations/sec operations/sec bytes/sec bytes/sec

Description

Average number of NFSv4.0

operations.

Average number of NFSv4.1

operations.

Average bytes/sec across all physical network interfaces.

Average number of SMB operations.

Average number of SMB2 operations.

Average number of SMB3 operations.

Average number of FTP bytes.

Average number of SFTP bytes.

Note that to reduce the network traffic required to refresh the Dashboard, configure some of the activity graphs as "<empty>".

Use the Thresholds screen to configure the dashboard activity weather icons. The defaults provided are based on heavy workloads and may not be suitable for your environment.

FIGURE 16

Dashboard Activity Settings

The weather icon that appears on the Dashboard is closest to the threshold value setting for the current activity - measured as a 60 second average. For example, if CPU utilization was at 41%,

Configuring the Appliance 167

Changing the Displayed Activity Statistics by default, the Cloudy weather icon would appear because its threshold is 40% (closest to the actual activity). Select the Custom radio button to configure thresholds and be sure to configure them in the order they appear on the screen.

The dashboard currently cannot be configured from the CLI. Settings saved in the BUI will apply to the dashboard that is visible from the CLI.

1.

2.

3.

Changing the Displayed Activity Statistics

Go to the Status > Settings > Layout screen.

Choose the statistics you want to display on the Dashboard from the drop-down menus.

To save your choices, click the Apply button.

3.

4.

1.

2.

Changing the Activity Thresholds

Go to the Status > Settings > Thresholds screen.

Choose the statistic to configure from the drop-down menu.

Click the Custom radio button.

Customize the values in the list, in the order they appear. Some statistics will provide a Units drop-down, so that Kilo/Mega/Giga can be selected.

168 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing the Activity Thresholds

5.

To save your configuration, click the Apply button.

NDMP Status

When the NDMP service has been configured and is active, the Status=>NDMP page shows the

NDMP devices and recent client activity. A green indicator shows that the device is online and a gray indicator shows that the device is offline.

To resort the NDMP Device list, click on the Devices column headings. To display details about a device, double click on the device.

NDMP status is not available from the CLI.

FIGURE 17

NDMP Status BUI

TABLE 30

Field

Type

Path

Vendor

Model

WWN

NDMP Status - Devices

Description

Type of NDMP device

Path of the NDMP device

Device vendor name

Device model name

World Wide Name

Examples

Robot, Tape drive

/dev/rmt/14bn

STK

T1000C

50:01:04:F0:00:AC:BB:27

Configuring the Appliance 169

Configuring Storage Area Network (SAN)

Field

Serial

Description

Device serial number

TABLE 31

Field

ID

Active

Remote Client

Authenticated

Data State

Mover State

Current Operation

Progress

NDMP Status - Recent Activity

Description

NDMP backup ID

Backup currently active

NDMP client address and port

Shows if the client has completed authentication yet

See Data State

See Mover State

Current NDMP operation

A progress bar for this backup

Examples

576001000203

Examples

49

No

192.168.1.219:4760

Yes, No

Active, Idle, ...

Active, Idle, ...

Backup, Restore, None

NDMP States

The NDMP Data State shows the state of the backup or restore operation. Possible values are:

Active - The data is being backed up or restored.

Idle - Backup or restore has not yet started or has already finished.

Connected - Connection is established, but backup or restore has not yet begun.

Halted - Backup or restore has finished successfully or has failed or aborted.

Listen - Operation is waiting to receive a remote connection.

The NDMP Mover State shows the state of the NDMP device subsystem. Examples for tape devices are:

Active - Data is being read from or written to the tape.

Idle - Tape operation has not yet started or has already finished.

Paused - Tape has reached the end or is waiting to be changed.

Halted - Read/write operation has finished successfully or has failed or aborted.

Listen - Operation is waiting to receive a remote connection.

Configuring Storage Area Network (SAN)

The SAN configuration page lets you connect your appliance to your Storage Area Network

(SAN). A SAN is made up of three basic components:

170 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring FC Port Modes (BUI)

A client that will access the storage on the network

A storage appliance that will provide the storage on the network

A network that will link the client to the storage

To configure SAN, use the following sections:

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Configuring SAN iSCSI Initiators

Creating an Analytics Worksheet (BUI)

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

To learn more about SAN, see the following:

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

1.

Configuring FC Port Modes (BUI)

To use FC ports, set them to Target mode on the Configuration > SAN screen of the BUI, using the drop-down menu shown in the following image. You

Configuring the Appliance 171

Configuring FC Port Modes (BUI)

must have root permissions to perform this action. Note that in a cluster configuration, you set ports to Target mode on each server separately.

2.

After setting desired ports to Target, click the Apply button. A confirmation message will appear notifying you that the appliance will reboot immediately.

Confirm that you want to reboot.

3.

When the appliance boots, the active FC targets appear with the icon and, on mouse-over, the move icon appears.

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

172 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Discovering FC Ports (BUI)

Discovering FC Ports (BUI)

1.

Click the info icon to view the Discovered Ports dialog where you can troubleshoot link errors. In the Discovered Ports dialog, click a WWN in the list to view associated link errors.

2.

In the Discovered Ports dialog, click a WWN in the list to view associated link errors.

Configuring the Appliance 173

Creating FC Initiator Groups (BUI)

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Creating FC Initiator Groups (BUI)

1.

Create and manage initiator groups on the Initiators screen. Click the add icon to view unaliased ports. Click a WWN in the list to add a meaningful alias in the Alias field.

174 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating FC Initiator Groups (BUI)

2.

On the Initiators page, drag initiators to the FC Initiator Groups list to create new groups or add to existing groups.

3.

Click the Apply button to commit the new Initiator Group. Now you can create a

LUN that has exclusive access to the client initiator group.

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Configuring the Appliance 175

Associating a LUN with an FC Initiator Group (BUI)

1.

Associating a LUN with an FC Initiator Group (BUI)

To create the LUN, roll-over the initiator group and click the add LUN icon.

The Create LUN dialog appears with the associated initiator group selected.

2.

Set the name and size and click Apply to add the LUN to the storage pool.

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

176 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing FC Port Modes (CLI)

Changing FC Port Modes (CLI)

To change FC port modes, use the following CLI commands:

dory:configuration san fc targets> set targets="wwn.2101001B32A11639"

targets = wwn.2101001B32A11639 (uncommitted) dory:configuration san fc targets> commit

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Discovering FC Ports (CLI)

To discover FC Ports, use the following CLI commands:

dory:configuration san fc targets> show

Properties:

targets = wwn.2100001B32811639,wwn.2101001B32A12239

Targets:

NAME MODE WWN PORT SPEED target-000 target wwn.2100001B32811639 PCIe 5: Port 1 4 Gbit/s target-001 initiator wwn.2101001B32A11639 PCIe 5: Port 2 0 Gbit/s target-002 initiator wwn.2100001B32812239 PCIe 2: Port 1 0 Gbit/s target-003 target wwn.2101001B32A12239 PCIe 2: Port 2 0 Gbit/s dory:configuration san fc targets> select target-000 dory:configuration san fc targets target-000> show

Properties:

wwn = wwn.2100001B32811639

port = PCIe 5: Port 1

mode = target

speed = 4 Gbit/s

discovered_ports = 6

link_failure_count = 0

loss_of_sync_count = 0

loss_of_signal_count = 0

protocol_error_count = 0

Configuring the Appliance 177

Creating FC Initiator Groups (CLI)

invalid_tx_word_count = 0

invalid_crc_count = 0

Ports:

PORT WWN ALIAS MANUFACTURER port-000 wwn.2100001B3281A339 longjaw-1 QLogic Corporation port-001 wwn.2101001B32A1A339 longjaw-2 QLogic Corporation port-002 wwn.2100001B3281AC39 thicktail-1 QLogic Corporation port-003 wwn.2101001B32A1AC39 thicktail-2 QLogic Corporation port-004 wwn.2100001B3281E339 <none> QLogic Corporation port-005 wwn.2101001B32A1E339 <none> QLogic Corporation

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Creating FC Initiator Groups (CLI)

To create FC initiator groups, use the following CLI commands:

dory:configuration san fc initiators> create dory:configuration san fc initiators (uncommitted)> set name=lefteye dory:configuration san fc initiators (uncommitted)>

set initiators=wwn.2101001B32A1AC39,wwn.2100001B3281AC39

dory:configuration san fc initiators (uncommitted)> commit dory:configuration san fc initiators> list

GROUP NAME group-001 lefteye

|

+-> INITIATORS

wwn.2101001B32A1AC39

wwn.2100001B3281AC39

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

178 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Associating a LUN with an FC Initiator Group (CLI)

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Associating a LUN with an FC Initiator Group (CLI)

The following example demonstrates creating a LUN called lefty and associating it with the fera

initiator group.

To associate a LUN with an FC initiator group, use the following CLI commands:

dory:shares default> lun lefty dory:shares default/lefty (uncommitted)> set volsize=10

volsize = 10 (uncommitted) dory:shares default/lefty (uncommitted)> set initiatorgroup=fera

initiatorgroup = default (uncommitted) dory:shares default/lefty (uncommitted)> commit

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Scripting Aliases for Initiators and Initiator Groups

(CLI)

Refer to CLI Usage and

Simple CLI Scripting and Batching Commands

for information about how to modify and use the following example script.

To script aliases for initiators and initiator groups, use the following CLI commands:

script

Configuring the Appliance 179

Scripting Aliases for Initiators and Initiator Groups (CLI)

/*

* This script creates both aliases for initiators and initiator

* groups, as specified by the below data structure. In this

* particular example, there are five initiator groups, each of

* which is associated with a single host (thicktail, longjaw, etc.),

* and each initiator group consists of two initiators, each of which

* is associated with one of the two ports on the FC HBA. (Note that

* there is nothing in the code that uses this data structure that

* assumes the number of initiators per group.)

*/

groups = {

thicktail: {

'thicktail-1': 'wwn.2100001b3281ac39',

'thicktail-2': 'wwn.2101001b32a1ac39'

},

longjaw: {

'longjaw-1': 'wwn.2100001b3281a339',

'longjaw-2': 'wwn.2101001b32a1a339'

},

tecopa: {

'tecopa-1': 'wwn.2100001b3281e339',

'tecopa-2': 'wwn.2101001b32a1e339'

},

spinedace: {

'spinedace-1': 'wwn.2100001b3281df39',

'spinedace-2': 'wwn.2101001b32a1df39'

},

fera: {

'fera-1': 'wwn.2100001b32817939',

'fera-2': 'wwn.2101001b32a17939'

}

};

for (group in groups) {

initiators = [];

for (initiator in groups[group]) {

printf('Adding %s for %s ... ',

groups[group][initiator], initiator);

try {

run('select alias=' + initiator);

printf('(already exists)\n');

run('cd ..');

} catch (err) {

if (err.code != EAKSH_ENTITY_BADSELECT)

throw err;

run('create');

set('alias', initiator);

set('initiator', groups[group][initiator]);

run('commit');

180 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating an Analytics Worksheet (BUI)

printf('done\n');

}

run('select alias=' + initiator);

initiators.push(get('initiator'));

run('cd ..');

}

printf('Creating group for %s ... ', group);

run('groups');

try {

run('select name=' + group);

printf('(already exists)\n');

run('cd ..');

} catch (err) {

if (err.code != EAKSH_ENTITY_BADSELECT)

throw err;

run('create');

set('name', group);

run('set initiators=' + initiators);

run('commit');

printf('done\n');

}

run('cd ..');

}

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Creating an Analytics Worksheet (BUI)

To create an analytics worksheet for observing operations by initiator, complete the following:

Go to the Analytics screen.

1.

2.

3.

Click the add icon for Add Statistic. A menu of all statistics appears.

Select iSCSI operations > Broken down by initiator under the Protocols section of the menu. A graph of the current operations by initiator appears.

Configuring the Appliance 181

Configuring SAN iSER Targets

4.

To observe more detailed analytics, select the initiator from the field to the left of the graph and click the icon. A menu of detailed analytics appears.

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Configuring SAN iSER Targets

1.

2.

In the BUI, iSER targets are managed as iSCSI targets on the Configuration > SAN screen.

To configure ibp(x) interfaces, select the ibp(x) interface (or ipmp) you want, and drag it to the Datalinks list to create the datalink on the Configuration > Network screen.

Drag the Datalink to the Interfaces list to create a new interface.

182 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SAN iSER Targets

3.

To create an iSER target, on the Configuration > SAN page, click the iSCSI

Targets link.

4.

5.

To add a new iSER target with an alias, click the add icon.

To create a target group, drag the target you just created to the iSCSI Target

Group list.

6.

To create an initiator, click the Initiator link and then click the iSCSI initiators link.

7.

8.

9.

To add a new initiator, click the add icon.

Enter the Initiator IQN and an alias and click OK. Creating an initiator group is optional but if you don't create a group, the LUN associated with the target will be available to all initiators.

To create a group, drag the initiator to the iSCSI Initiator Groups list.

Configuring the Appliance 183

Configuring SAN iSER Targets

10.

11.

To create a LUN, on the Shares page, click LUN.

Click the add icon and associate the new LUN with target or initiator groups you created already using the Target Group and Initiator Groups menu.

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

184 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with an Auto-generated

IQN (CLI)

To add an iSCSI target with an auto-generated IQN, use the following CLI commands:

ahi:configuration san iscsi targets> create ahi:configuration san iscsi targets target (uncommitted)> set alias="Target 0" ahi:configuration san iscsi targets target (uncommitted)> set auth=none ahi:configuration san iscsi targets target (uncommitted)> set interfaces=igb1 ahi:configuration san iscsi targets target (uncommitted)> commit ahi:configuration san iscsi targets> list

TARGET ALIAS target-000 Target 0

|

+-> IQN

iqn.1986-03.com.sun:02:daf0161f-9f5d-e01a-b5c5-e1efa9578416

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Adding an iSCSI Target with a Specific IQN and

RADIUS Authentication (CLI)

To add an iSCSI target with a specific IQN and RADIUS authentication, use the following CLI commands:

ahi:configuration san iscsi targets> create ahi:configuration san iscsi targets target (uncommitted)> set alias="Target 1" ahi:configuration san iscsi targets target (uncommitted)>

set iqn=iqn.2001-02.com.acme:12345 ahi:configuration san iscsi targets target (uncommitted)> set auth=radius ahi:configuration san iscsi targets target (uncommitted)> set interfaces=igb1

Configuring the Appliance 185

Adding an iSCSI Initiator with CHAP Authentication (CLI) ahi:configuration san iscsi targets target (uncommitted)> commit ahi:configuration san iscsi targets> list

TARGET ALIAS target-000 Target 0

|

+-> IQN

iqn.1986-03.com.sun:02:daf0161f-9f5d-e01a-b5c5-e1efa9578416 target-001 Target 1

|

+-> IQN

iqn.2001-02.com.acme:12345

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Adding an iSCSI Initiator with CHAP

Authentication (CLI)

To add an iSCSI initiator with CHAP authentication, use the following CLI commands:

ahi:configuration san iscsi initiators> create ahi:configuration san iscsi initiators initiator (uncommitted)>

set initiator=iqn.2001-02.com.acme:initiator12345 ahi:configuration san iscsi initiators initiator (uncommitted)> set alias="Init 0" ahi:configuration san iscsi initiators initiator (uncommitted)>

set chapuser=thisismychapuser ahi:configuration san iscsi initiators initiator (uncommitted)>

set chapsecret=123456789012abc ahi:configuration san iscsi initiators initiator (uncommitted)> commit ahi:configuration san iscsi initiators> list

NAME ALIAS initiator-000 Init 0

|

+-> INITIATOR

iqn.2001-02.com.acme:initiator12345

186 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an iSCSI Target Group (CLI)

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Adding an iSCSI Target Group (CLI)

To add an iSCSI target group, use the following CLI commands:

ahi:configuration san iscsi targets groups> create ahi:configuration san iscsi targets group (uncommitted)> set name=tg0 ahi:configuration san iscsi targets group (uncommitted)>

set targets=iqn.2001-02.com.acme:12345,

iqn.1986-03.com.sun:02:daf0161f-9f5d-e01a-b5c5-e1efa9578416 ahi:configuration san iscsi targets group (uncommitted)> commit ahi:configuration san iscsi targets groups> list

GROUP NAME group-000 tg0

|

+-> TARGETS

iqn.2001-02.com.acme:12345

iqn.1986-03.com.sun:02:daf0161f-9f5d-e01a-b5c5-e1efa9578416

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Adding an iSCSI Initiator Group (CLI)

To add an iSCSI initiator group, use the following CLI commands:

Configuring the Appliance 187

Configuring SRP Target (BUI) ahi:configuration san iscsi initiators groups> create ahi:configuration san iscsi initiators group (uncommitted)> set name=ig0 ahi:configuration san iscsi initiators group (uncommitted)>

set initiators=iqn.2001-02.com.acme:initiator12345 ahi:configuration san iscsi initiators group (uncommitted)> commit ahi:configuration san iscsi initiators groups> list

GROUP NAME group-000 ig0

|

+-> INITIATORS

iqn.2001-02.com.acme:initiator12345

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

1.

4.

5.

2.

3.

6.

Configuring SRP Target (BUI)

This procedure describes the steps for configuring SRP targets.

Connect HCA ports to IB interfaces.

The targets are automatically discovered by the appliance.

To create the target group, go to the Configuration > SAN screen.

Click the Target link and then click SRP targets.

The SRP targets page appears.

7.

To create the target group, use the move icon to drag a target to the Target

Groups list.

Click Apply.

188 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SRP Targets (CLI)

8.

9.

(Optional) To create an initiator and initiator group on the Initiator screen, click the icon, collect GUID from initiator, assign it a name, and drag it to initiator group.

To create a LUN and associate it with the SRP target and initiators you created in the previous steps, go to the Shares screen.

10.

Click the LUN link and then click the LUN icon. Use the Target Group and

Initiator Group menus on the Create LUN dialog to select the SRP groups to associate with the LUN.

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Configuring SRP Targets (CLI)

The following example demonstrates how to create an SRP target group named targetSRPgroup using the CLI configuration san targets srp groups context:

To configure SRP targets, use the following CLI commands:

swallower:configuration san targets srp groups> create swallower:configuration san targets srp group (uncommitted)> set name=targetSRPgroup

name = targetSRPgroup (uncommitted) swallower:configuration san targets srp group (uncommitted)> set targets=eui.0002C903000489A4

targets = eui.0002C903000489A4 (uncommitted) swallower:configuration san targets srp group (uncommitted)> commit swallower:configuration san targets srp groups> list

GROUP NAME group-000 targetSRPgroup

|

+-> TARGETS

eui.0002C903000489A4

Configuring the Appliance 189

Configuring SRP Targets (CLI)

Example 1

Creating a LUN associated with the Target SRP Group using the CLI

The following example shows how to create a LUN and associate it with the targetSRPgroup using the CLI shares CLI context: swallower:shares default> lun mylun swallower:shares default/mylun (uncommitted)> set targetgroup=targetSRPgroup

targetgroup = targetSRPgroup (uncommitted) swallower:shares default/mylun (uncommitted)> set volsize=10

volsize = 10 (uncommitted) swallower:shares default/mylun (uncommitted)> commit swallower:shares default> list

Filesystems:

NAME SIZE MOUNTPOINT test 38K /export/test

LUNs:

NAME SIZE GUID mylun 10G 600144F0E9D19FFB00004B82DF490001

Related Topics

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSER Target Configuration

SAN SRP Configuration

SAN Terminology

Understanding SAN

These three components remain the same regardless of which protocol is used on the network.

In some cases, the network may even be a cable between the initiator and the target, but in most cases, there is some type of switching involved.

Targets and initiators are configured by protocol. Refer to the documentation on a

particular protocol ( “SAN Fibre Channel Configuration” on page 192

,

iSCSI or

“SRP

Configuration” on page 305 ) for details.

Target and initiator groups define sets of targets and initiators that can be associated with LUNs.

A LUN that is associated with a target group can only be seen via the targets in the group. If a

LUN is not explicitly associated with a target group, it is in the default target group and will be accessible via all targets, regardless of protocol. Similarly, a LUN can only be seen by the

190 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SRP Targets (CLI) initiators in the group or groups to which it belongs. If a LUN is not explicitly associated with an initiator group, it is in the default initiator group and can be accessed by all initiators. While using the default initiator group can be useful for evaluation purposes, its use is discouraged since it may result in exposure of the LUN to unwanted or conflicting initiators.

To avoid possible LUN conflicts when an initiator belongs to multiple groups, configure initiators within all groups before associating groups with LUNs.

To configure targets, go to the Configuration > SAN BUI page, use Fibre Channel, iSCSI, and

SRP to navigate, and then configure the Ports, Initiator, and Target Groups controls.

To associate a LUN, go to the Shares > Shares > Protocols page and then configure the Target

Group and Initiator Group controls.

FIGURE 18

Associate a LUN

Configuring the Appliance 191

Configuring SRP Targets (CLI)

Use the configuration san context of the CLI to operate on targets and initiators by protocol type. Then, use the shares CLI context to create LUNs and associate them with target and initiator groups.

Related Topics

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Configuring SAN iSCSI Initiators

Creating an Analytics Worksheet (BUI)

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

SAN Fibre Channel Configuration

Fibre Channel (FC) is a gigabit-speed networking technology used nearly exclusively as a transport for SCSI. FC is one of several block protocols supported by the appliance; to share

LUNs via FC, the appliance must be equipped with one or more optional FC cards.

By default, all FC ports are configured to be in target mode. If the appliance is used to connect to a tape SAN for backup, one or more ports must be configured in initiator mode. To configure a port for initiator mode, the appliance must be reset. Multiple ports can be configured for initiator mode simultaneously.

Each FC port is assigned a World Wide Name (WWN), and, as with other block protocols, FC targets may be grouped into SAN target and initiator groups, allowing port bandwidth to be

192 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SRP Targets (CLI) dedicated to specific LUNs or groups of LUNs. Once an FC port is configured as a target, the remotely discovered ports can be examined and verified.

Refer to the Implementing Fibre Channel SAN Boot with Oracle's Sun ZFS Storage Appliance white paper at http://www.oracle.com/technetwork/articles/servers-storage-admin/ fbsanboot-365291.html

for details on FC SAN boot solutions using the Oracle ZFS Storage

Appliance.

In a cluster, initiators will have two paths (or sets of paths) to each LUN: one path (or set of paths) will be to the head that has imported the storage associated with the LUN; the other path

(or set of paths) will be to that head's clustered peer. The first path (or set of paths) is active; the second path (or set of paths) is standby. In the event of a takeover, the active paths will become unavailable, and the standby paths will (after a short time) be transitioned to be active, after which I/O will continue. This approach to multipathing is known as asymmetric logical unit access (ALUA) and, when coupled with an ALUA-aware initiator, allows cluster takeover to be transparent to higher-level applications.

Initiators are identified by their WWN. As with other block protocols, aliases can be created for initiators. To aid in creating aliases for FC initiators, a WWN can be selected from the

WWNs of discovered ports. Also as with other block protocols, initiators can be collected into groups. When a LUN is associated with a specific initiator group, the LUN will only be visible to initiators in the group. In most FC SANs, LUNs will always be associated with the initiator group that corresponds to the system(s) for which the LUN has been created.

The appliance is an ALUA-compliant array. Properly configuring an FC initiator in an ALUA environment requires an ALUA-aware driver and may require initiator-specific tuning. See

"Oracle ZFS Storage Appliance: How to set up Client Multipathing" (Doc ID 1628999.1) for more information.

FC performance can be observed via Analytics, whereby one can breakdown operations or throughput by initiator, target, or LUN:

Configuring the Appliance 193

Configuring SRP Targets (CLI)

FIGURE 19

FC Performance

For operations, one can also breakdown by offset, latency, size and SCSI command, allowing one to understand not just the what but the how and why of FC operations.

The appliance has been designed to utilize a global set of resources to service LUNs on each head. It is therefore not generally necessary to restrict queue depths on clients as the FC ports in the appliance can handle a large number of concurrent requests. Even so, there exists the remote possibility that these queues can be overrun, resulting in SCSI transport errors. Such queue overruns are often associated with one or more of the following:

Overloaded ports on the front end - too many hosts associated with one FC port and/or too many LUNs accessed through one FC port

194 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SRP Targets (CLI)

Degraded appliance operating modes, such as a cluster takeover in what is designed to be an active-active cluster configuration

While the possibility of queue overruns is remote, it can be eliminated entirely if one is willing to limit queue depth on a per-client basis. To determine a suitable queue depth limit, one should take the number of target ports multiplied by the maximum concurrent commands per port

(2048) and divide the product by the number of LUNs provisioned. To accommodate degraded operating modes, one should sum the number of LUNs across cluster peers to determine the number of LUNs, but take as the number of target ports the minimum of the two cluster peers.

For example, in an active-active 7420 dual-headed cluster with one head having 2 FC ports and

100 LUNs and the other head having 4 FC ports and 28 LUNs, one should take the pessimal maximum queue depth to be two ports times 2048 commands divided by 100 LUNs plus 28

LUNs -- or 32 commands per LUN.

Tuning the maximum queue depth is initiator specific, but on Oracle Solaris, this is achieved by adjusting the global variable ssd_max_throttle.

To troubleshoot link-level issues such as broken optics or a poorly seated cable, look at the error statistics for each FC port. If any number is either significantly non-zero or increasing, that may be an indicator that link-level issues have been encountered, and that link-level diagnostics should be performed.

Related Topics

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Configuring SAN iSCSI Initiators

Creating an Analytics Worksheet (BUI)

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

Configuring the Appliance 195

Configuring SRP Targets (CLI)

SAN iSCSI Configuration

Internet SCSI is one of several block protocols supported by the appliance for sharing SCSI based storage.

When using the iSCSI protocol, the target portal refers to the unique combination of an IP address and TCP port number by which an initiator can contact a target.

When using the iSCSI protocol, a target portal group is a collection of target portals. Target portal groups are managed transparently; each network interface has a corresponding target portal group with that interface's active addresses. Binding a target to an interface advertises that iSCSI target using the portal group associated with that interface.

Note -

Multiple connections per session are not supported.

An IQN (iSCSI qualified name) is the unique identifier of a device in an iSCSI network. iSCSI uses the form iqn.date.authority:uniqueid for IQNs. For example, the appliance may use the

IQN: iqn.1986-03.com.sun:02:c7824a5b-f3ea-6038-c79d-ca443337d92c to identify one of its iSCSI targets. This name shows that this is an iSCSI device built by a company registered in

March of 1986. The naming authority is just the DNS name of the company reversed, in this case, "com.sun". Everything following is a unique ID that Oracle uses to identify the target.

TABLE 32

Target Property

Target IQN iSCSI Target Properties

Alias

Authentication mode

CHAP name

CHAP secret

Network interfaces

Description

The IQN for this target. The IQN can be manually specified or auto-generated.

A human-readable nickname for this target.

One of None, CHAP, or RADIUS.

If CHAP authentication is used, the CHAP username.

If CHAP authentication is used, the CHAP secret.

The interfaces whose target portals are used to export this target.

In addition to those properties, the BUI indicates whether a target is online or offline:

TABLE 33 icon

Target Status Icons

description

Target is online

Target is offline

196 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SRP Targets (CLI)

On clustered platforms, targets which have at least one active interface on that cluster node will be online. Take care when assigning interfaces to targets; a target may be configured to use portal groups on disjoint head nodes. In that situation, the target will be online on both heads yet will export different LUNs depending on the storage owned by each head node. As network interfaces migrate between cluster heads as part of takeover/failback or ownership changes, iSCSI targets will move online and offline as their respective network interfaces are imported and exported.

Targets which are bound to an IPMP interface will be advertised only via the addresses of that

IPMP group. That target will not be reachable via that group's test addresses. Targets bound to interfaces built on top of a LACP aggregation will use the address of that aggregation. If a

LACP aggregation is added to an IPMP group, a target can no longer use that aggregation's interface, as that address will become an IPMP test address.

Related Topics

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Configuring SAN iSCSI Initiators

Creating an Analytics Worksheet (BUI)

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

SAN iSCSI Initiator Configuration

iSCSI initiators have the following configurable properties.

Configuring the Appliance 197

Configuring SRP Targets (CLI)

TABLE 34

Property

Initiator IQN

Alias

Use CHAP

CHAP name

CHAP secret

SAN iSCSI Initiator Properties

Description

The IQN for this initiator.

A human-readable nickname for this initiator.

Enables or disables CHAP authentication

If CHAP authentication is used, the CHAP username.

If CHAP authentication is used, the CHAP secret.

When planning your iSCSI client configuration, you'll need the following information:

What initiators (and their IQNs) will be accessing the SAN?

If you plan on using CHAP authentication, what CHAP credentials does each initiator use?

How many iSCSI disks (LUNs) are required, and how big should they be?

Do the LUNs need to be shared between multiple initiators?

To allow the Appliance to perform CHAP authentication using RADIUS, the following pieces of information must match:

The Appliance must specify the address of the RADIUS server and a secret to use when communicating with this RADIUS server

The RADIUS server (e.g. in its clients file) must have an entry giving the address of this

Appliance and specifying the same secret as above

The RADIUS server (e.g. in its users file) must have an entry giving the CHAP name and matching CHAP secret of each initiator

If the initiator uses its IQN name as its CHAP name (the recommended configuration) then the Appliance does not need a separate Initiator entry for each Initiator box -- the RADIUS server can perform all authentication steps.

If the initiator uses a separate CHAP name, then the Appliance must have an Initiator entry for that initiator that specifies the mapping from IQN name to CHAP name. This Initiator entry does NOT need to specify the CHAP secret for the initiator.

For tips on troubleshooting common iSCSI misconfiguration, see iSCSI

.

iSCSI performance can be observed via Analytics, whereby one can breakdown operations or throughput by initiator, target, or LUN.

Related Topics

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

198 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SRP Targets (CLI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Configuring SAN iSCSI Initiators

Creating an Analytics Worksheet (BUI)

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

SAN SRP Configuration

SCSI RDMA Protocol, is a protocol supported by the appliance for sharing SCSI based storage over a network that provides RDMA services (i.e. InfiniBand).

SRP ports are shared with other IB port services such as IPoIB and RDMA. The SRP service may only operate in target mode. SRP targets have the following configurable properties.

TABLE 35

Property

Target EUI

Alias

SRP Target Properties

Description

The Extended Unique Identifier (EUI) for this target. The

EUI is automatically assigned by the system and is equal to the HCA GUID over which the SRP port service is running.

A human-readable nickname for this target.

In addition to those properties, the BUI indicates whether a target is online or offline:

TABLE 36 icon

SRP Target Status Icons

description

Target is online

Target is offline

Configuring the Appliance 199

Configuring SRP Targets (CLI)

On clustered platforms, peer targets should be configured into the same target group for highly available (multi-pathed) configurations. SRP multipathed I/O is an initiator-side configuration option.

SRP initiators have the following configurable properties.

TABLE 37

Property

Initiator EUI

Alias

SRP Initiator Properties

Description

The EUI for this initiator.

A human-readable nickname for this initiator.

SRP performance can be observed via Analytics, whereby one can breakdown operations or throughput by initiator or target.

Related Topics

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Configuring SAN iSCSI Initiators

Creating an Analytics Worksheet (BUI)

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

SAN Terminology

To configure the appliance to operate on a SAN, you should understand some basic SAN terms:

200 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

iSCSI iSER

FC

SRP

IQN

TABLE 38

Term

SCSI Target

SAN Terminology

SCSI Initiator

Logical Unit

Configuring SRP Targets (CLI)

Description

A SCSI Target is a storage system end-point that provides a service of processing SCSI commands and

I/O requests from an initiator. A SCSI Target is created by the storage system's administrator, and is identified by unique addressing methods. A SCSI Target, once configured, consists of zero or more logical units.

A SCSI Initiator is an application or production system end-point that is capable of initiating a SCSI session, sending SCSI commands and I/O requests. SCSI

Initiators are also identified by unique addressing methods (See SCSI Targets).

A Logical Unit is a term used to describe a component in a storage system. Uniquely numbered, this creates what is referred to as a Logical Unit Number, or LUN. A storage system, being highly configurable, may contain many LUNS. These LUNs, when associated with one or more SCSI Targets, forms a unique SCSI device, a device that can be accessed by one or more SCSI

Initiators.

Internet SCSI, a protocol for sharing SCSI based storage over IP networks. The appliance supports the SCSI-3

Persistent Reservations specification.

iSCSI Extension for RDMA, a protocol that maps the iSCSI protocol over a network that provides

RDMA services (i.e. InfiniBand). The iSER protocol is transparently selected by the iSCSI subsystem, based on the presence of correctly configured IB hardware. In the

CLI and BUI, all iSER-capable components (targets and initiators) are managed as iSCSI components.

Fibre Channel, a protocol for sharing SCSI based storage over a storage area network (SAN), consisting of fiberoptic cables, FC switches and HBAs. The appliance supports 4GB and 8GB Fibre Channel Arbitrated Loop

(FC-AL) topologies.

SCSI RDMA Protocol, a protocol for sharing SCSI based storage over a network that provides RDMA services (i.

e. InfiniBand).

An iSCSI qualified name, the unique identifier of a device in an iSCSI network. iSCSI uses the form iqn.

date.authority:uniqueid for IQNs. For example, the appliance may use the IQN: iqn.1986-03.com.sun:02: c7824a5b-f3ea-6038-c79d-ca443337d92c to identify one of its iSCSI targets. This name shows that this is an iSCSI device built by a company registered in March of

1986. The naming authority is just the DNS name of the company reversed, in this case, "com.sun". Everything following is a unique ID that Sun uses to identify the target.

Configuring the Appliance 201

Configuring Users

Term

Target portal

Target portal group

CHAP

RADIUS

Target group

Initiator group

Target

Initiator

Description

When using the iSCSI protocol, the target portal refers to the unique combination of an IP address and TCP port number by which an initiator can contact a target.

When using the iSCSI protocol, a target portal group is a collection of target portals. Target portal groups are managed transparently; each network interface has a corresponding target portal group with that interface's active addresses. Binding a target to an interface advertises that iSCSI target using the portal group associated with that interface.

Challenge-handshake authentication protocol, a security protocol which can authenticate a target to an initiator, an initiator to a target, or both.

A system for using a centralized server to perform CHAP authentication on behalf of storage nodes.

A set of targets. LUNs are exported over all the targets in one specific target group.

A set of initiators. When an initiator group is associated with a LUN, only initiators from that group may access the LUN.

A storage system end-point that provides a service of processing SCSI commands and I/O requests from an initiator. A target is created by the storage system administrator, and is identified by unique addressing methods. A target, once configured, consists of zero or more logical units.

An application or production system end-point that is capable of initiating a SCSI session, sending SCSI commands and I/O requests. Initiators are also identified by unique addressing methods.

Each LUN has several properties which control how the volume is exported. See

Protocols for

more information.

Configuring Users

This section describes users for the appliance, roles to manage authorizations granted to users, and how to add them to the system using the BUI or CLI.

To configure users and roles, use the following sections:

Adding an Administrator or User BUI

,

CLI

Changing a User Password BUI

,

CLI

202 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Administrator or User (BUI)

Editing Exceptions for a User BUI

,

CLI

Deleting Exceptions for a User

BUI ,

CLI

Adding a Role

BUI

,

CLI

Editing Authorizations for a Role

BUI , CLI

Deleting Authorizations from a Role

BUI , CLI

Adding a User Who can Only View the Dashboard

BUI

To understand users and roles, see the following sections:

Understanding Users and Roles

User Authorizations

Managing User Properties

Adding an Administrator or User (BUI)

1.

2.

Use the following procedure to create a user with or without the administrator role. For a

description of user types, see “Understanding Users and Roles” on page 219

.

Go to Configuration > Users.

Click the add icon next to Users.

Configuring the Appliance 203

Adding an Administrator or User (BUI)

3.

Choose the appropriate type of user from the drop-down menu.

4.

5.

6.

Enter the required properties.

(Optional) To assign roles to Local and Directory users, click the checkboxes for the appropriate roles.

Newly created Local and Directory users default to the "basic" role.

(Optional) To add exceptions for Local and Directory users: a. Click Exceptions.

b. Click the checkboxes for the exceptions you want to add.

7.

c. Click ADD in the Exceptions section.

Click ADD at the top of the dialog box.

The new user appears in the Users list.

204 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Administrator or User (CLI)

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Adding an Administrator or User (CLI)

1.

Use the following procedure to create a user with or without the administrator roles. For a

description of user types, see “Understanding Users and Roles” on page 219

.

Go to configuration users.

2.

3.

hostname:> configuration users

Type one of the following user types followed by a name.

directory

- for a Directory user (NIS, LDAP).

local

- for a Local user.

data

- for a Data-only user.

nologin

- for a no-login user.

Type get to list the required properties that need to be set.

4.

hostname:configuration users john (uncommitted)> get

logname = john

uid = (unset)

fullname = (unset)

initial_password = (unset)

require_annotation = false

Type set and the property you want to set, and then type commit.

hostname:configuration users john (uncommitted)> set initial_password=password

initial_password = ******** (uncommitted) hostname:configuration users john (uncommitted)> commit

At this point you have a created user, but haven't customized all their properties yet.

Configuring the Appliance 205

Adding an Administrator or User (CLI)

5.

6.

(Optional) To add roles for Local or Directory users, type selectand a username.

(Optional) Type show to see the full list of preferences.

You can now add roles and authorization exceptions for the user.

Example 2

Creating a Local User hostname:configuration users > local john hostname:configuration users john (uncommitted) > get

logname = john

uid = (unset)

fullname = (unset)

initial_password = (unset)

require_annotation = false hostname:configuration users john (uncommitted) > set initial_password=password

initial_password = ******** (uncommitted) hostname:configuration users john (uncommitted) > commit hostname:configuration users > select john hostname:configuration users john > show

Properties:

logname = john

type = local

uid =

fullname =

initial_password = *************

require_annotation = false

roles =

kiosk_mode = false

kiosk_screen = status/dashboard

Children:

exceptions => Configure this user's exceptions

preferences => Configure user preferences hostname:configuration users john > set roles= basic basic2 test_role1 test_role2 hostname:configuration users john > set roles=basic

roles = basic (uncommitted) hostname:configuration users john > commit hostname:configuration users > select john hostname:configuration users john > show

Properties:

logname = john

type = local

uid =

fullname =

206 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing a User Password (BUI)

initial_password = *************

require_annotation = false

roles = basic

kiosk_mode = false

kiosk_screen = status/dashboard

Children:

exceptions => Configure this user's exceptions

preferences => Configure user preferences

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Changing a User Password (BUI)

1.

2.

Use the following procedure to change a user's password. To change the password for any user other than yourself, you must have Super-User (root) privileges or a role with the user authorization/exception.

Go to Configuration > Users.

3.

4.

Click the edit icon next to the User for which you want to change the password.

In the Edit Local User dialog box, type a new Password and then type it again to confirm it.

Click APPLY.

Related Topics

Editing Exceptions for a User BUI

Editing Authorizations for a Role

BUI

Configuring the Appliance 207

Changing a User Password (CLI)

1.

Changing a User Password (CLI)

Use the following procedure to change a user's password. To change the password for any user other than yourself, you must have Super-User (root) privileges or a role with the user authorization/exception.

Go to configuration users and then enter show to view a list of users.

2.

hostname:> configuration users hostname:configuration users > show

Users:

NAME USERNAME UID TYPE

Super-User root 0 Loc

Enter select and the username of the user for which you want to change the password. Then enter show.

3.

4.

hostname:configuration users > select root hostname:configuration users root > show

Properties:

logname = root

fullname = Super-User

initial_password = *************

require_annotation = false

Children:

preferences => Configure user preferences

Enter set initial_password= and the new password.

hostname:configuration users root > set initial_password=[new password]

initial_password = ************* (uncommitted)

Enter commit.

hostname:configuration users root > commit

Related Topics

Editing Exceptions for a User

CLI

Editing Authorizations for a Role CLI

208 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Editing Exceptions for a User (BUI)

Editing Exceptions for a User (BUI)

3.

4.

1.

2.

5.

6.

Use the following procedure to edit exceptions for a user.

Go to Configuration > Users.

Hover over the user in the Users list, and click the edit icon .

Click on Exceptions.

Select Scope.

If filters are available for this scope, they are listed below the Scope selector.

Click the checkbox for each exception you want to add.

Click ADD in the Exceptions section.

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Editing Exceptions for a User (CLI)

3.

4.

5.

1.

2.

6.

7.

Use the following procedure to edit exceptions for a user.

Go to configuration users.

Type select followed by the username.

Type exceptions.

Type create.

Type set scope= followed by the scope name. Use tab-completion to see the list.

Type show to list properties.

Type set to set the desired properties to true.

Configuring the Appliance 209

Editing Exceptions for a User (CLI)

8.

Type commit.

The exception has now been added.

Example 3

Adding an Exception to Exclude Scope Authorizations

This example adds an exception to exclude svc scope authorizations for the user "brendan": hostname:configuration users brendan > exceptions hostname:configuration users brendan exceptions > create hostname:configuration users brendan auth (uncommitted) > show

Properties:

scope = (unset) hostname:configuration users brendan auth (uncommitted) > set scope=svc

scope = svc hostname:configuration users brendan auth (uncommitted) > show

Properties:

scope = svc

service = *

allow_administer = false

allow_configure = false

allow_restart = false hostname:configuration users brendan auth (uncommitted) > commit hostname:configuration users brendan exceptions > show

Auths:

NAME OBJECT PERMISSIONS auth-000 svc.* none hostname:configuration users brendan exceptions > select auth-000 hostname:configuration users brendan auth-000 > show

Properties:

scope = svc

service = *

allow_administer = false

allow_configure = false

allow_restart = false hostname:configuration users brendan auth-000 >

Example 4

Adding an Exception to Include Scope Authorizations

This example adds an exception to include a scope authorization that is not part of the role

"webadmin": hostname:configuration users brendan exceptions > create

210 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Deleting Exceptions for a User (BUI) hostname:configuration users brendan auth (uncommitted) > set scope=appliance

scope = appliance hostname:configuration users brendan auth (uncommitted) > show

Properties:

scope = appliance

service = *

allow_audit = false

allow_factoryReset = false

allow_powerOff = false

allow_reboot = false

allow_setName = false

allow_shell = false hostname:configuration users brendan auth (uncommitted) > set allow_audit=true

allow_audit = true (uncommitted) hostname:configuration users brendan auth (uncommitted) > commit hostname:configuration users brendan exceptions > show

Auths:

NAME OBJECT PERMISSIONS auth-000 svc.* none auth-001 appliance.* audit hostname:configuration users brendan exceptions >

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Deleting Exceptions for a User (BUI)

Use the following procedure to delete exceptions for a user.

Go to Configuration > Users.

1.

2.

3.

4.

Hover over the user in the Users list, and click the edit icon .

Click on Exceptions.

Hover over the exception in the bottom list, and click the trash icon .

Configuring the Appliance 211

Deleting Exceptions for a User (CLI)

5.

Click APPLY at the top of the dialog box.

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

3.

4.

1.

2.

5.

Deleting Exceptions for a User (CLI)

Use the following procedure to delete exceptions for a user.

Go to configuration users.

Type select followed by the username.

Type exceptions.

Type show to list the exceptions.

Type destroy followed by the exception name. The exception has now been destroyed.

Example 5

Deleting an Exception for a User hostname:configuration users > select john hostname:configuration users john > ls

Properties:

logname = john

type = local

uid = 2000000001

fullname = john

initial_password = *************

require_annotation = false

kiosk_mode = false

kiosk_screen = status/dashboard

Children:

exceptions => Configure this user's exceptions

preferences => Configure user preferences hostname:configuration users john > exceptions

212 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

hostname:configuration users john exceptions > show

Auths:

NAME OBJECT PERMISSIONS auth-000 ad.* domain

workgroup hostname:configuration users john exceptions > destroy auth-000

This will destroy "auth-000". Are you sure? (Y/N) hostname:configuration users john exceptions > show hostname:configuration users john exceptions >

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Adding a Role (BUI)

1.

2.

3.

4.

5.

6.

7.

Use the following procedure to add a role.

Go to Configuration > Users.

Click the add icon next to Roles.

Set the name of the role and description.

(Optional) Under Authorizations, select a scope.

If filters are available for this scope, they will appear below the Scope selector.

(Optional) Select filters for the scope if appropriate.

(Optional) Click the checkbox for each authorization to add.

Click ADD at the top of the dialog box.

The new role appears in the Roles list.

Related Topics

Understanding Users and Roles

User Authorizations

Adding a Role (BUI)

Configuring the Appliance 213

Adding a Role (CLI)

Managing User Properties

Adding a Role (CLI)

7.

8.

3.

4.

1.

2.

5.

6.

9.

Use the following procedure to add a role.

Go to configuration roles.

Type role followed by the role name you want to create.

Set the description, then type commit to commit the role.

(Optional) Type authorizations.

(Optional) Type create to add an authorization.

(Optional) Type set scope= followed by the scope name. Use tab-completion to see the list.

(Optional) Type show to see both available filters and authorizations.

(Optional) Type set to set the desired authorizations to true, and set the filters (if available). Tab-completion helps show which filter settings are valid.

Type commit.

The new role has now been added.

Example 6

Creating the Role "webadmin" hostname:> configuration roles hostname:configuration roles > role webadmin hostname:configuration roles webadmin (uncommitted) > set

description="web server administrator"

description = web server administrator (uncommitted) hostname:configuration roles webadmin (uncommitted) > commit hostname:configuration roles > show

Roles:

NAME DESCRIPTION basic Basic administration webadmin web server administrator

214 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Editing Authorizations for a Role (BUI)

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Editing Authorizations for a Role (BUI)

4.

5.

6.

1.

2.

A role is a collection of privileges that can be assigned to a user. Use the following procedure to edit authorizations for a role.

Go to Configuration > Users.

3.

7.

Hover over the role in the Roles list, and click the edit icon .

Under Authorizations, select a scope.

If filters are available for this scope, they will appear below the Scope selector.

Select filters for the scope if appropriate.

Click the checkbox for each authorization to add.

Click ADD in the Authorizations section.

The authorizations are added to the bottom of the dialog box.

Click APPLY at the top of the dialog box.

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Editing Authorizations for a Role (CLI)

A role is a collection of privileges that can be assigned to a user. Use the following procedure to edit authorizations for a role.

Configuring the Appliance 215

Editing Authorizations for a Role (CLI)

3.

4.

5.

1.

2.

6.

7.

8.

Go to configuration roles.

Type select followed by the role name.

Type authorizations.

Type create to add an authorization.

Type set scope= followed by the scope name. Use tab-completion to see the list.

Type show to see both available filters and authorizations.

Type set to set the desired authorizations to true, and set the filters (if available).

Tab-completion helps show which filter settings are valid.

Type commit.

The authorization has now been added.

Example 7

Adding the Authorization to Restart the HTTP Service

This example adds the authorization to restart the HTTP service. This example also shows the output of tab-completion, which lists valid input and is useful when determining the valid scopes and filter options.

hostname:configuration roles > select webadmin hostname:configuration roles webadmin > authorizations hostname:configuration roles webadmin authorizations > create hostname:configuration roles webadmin auth (uncommitted) > set scope=

tab ad cluster net schema update alert hardware replication stat user appliance nas role svc worksheet hostname:configuration roles webadmin auth (uncommitted) > set scope=svc

scope = svc hostname:configuration roles webadmin auth (uncommitted) > show

Properties:

scope = svc

service = *

allow_administer = false

allow_configure = false

allow_restart = false hostname:configuration roles webadmin auth (uncommitted) > set service=

tab

* ftp ipmp nis ssh ad http iscsi ntp tags smb identity ldap routing vscan

216 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Deleting Authorizations from a Role (BUI) datalink:igb0 idmap ndmp scrk dns interface:igb0 nfs snmp hostname:configuration roles webadmin auth (uncommitted) > set service=http

service = http (uncommitted) hostname:configuration roles webadmin auth (uncommitted) > set allow_restart=true

allow_restart = true (uncommitted) hostname:configuration roles webadmin auth (uncommitted) > commit hostname:configuration roles webadmin authorizations > list

NAME OBJECT PERMISSIONS auth-000 svc.http restart

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Deleting Authorizations from a Role (BUI)

1.

2.

Use the following procedure to delete authorizations from a role.

Go to Configuration > Users.

Hover over the role in the Roles list, and click the edit icon .

3.

4.

Hover over the authorization in the bottom list, and click the trash icon .

Click APPLY at the top of the dialog box.

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Deleting Authorizations from a Role (CLI)

Use the following procedure to delete authorizations from a role.

Configuring the Appliance 217

Adding a User Who Can View the Dashboard

1.

2.

3.

4.

5.

Go to configuration roles.

Type select followed by the role name.

Type authorizations.

Type show to list authorizations.

Type destroy followed by the authorization name.

Example 8

Deleting an Authorization from a Role hostname:configuration roles > select test_role1 hostname:configuration roles test_role1 > authorizations hostname:configuration roles test_role1 authorizations > show

Auths:

NAME OBJECT PERMISSIONS auth-000 ad.* domain

workgroup hostname:configuration roles test_role1 authorizations > destroy auth-000

This will destroy "auth-000". Are you sure? (Y/N) hostname:configuration roles test_role1 authorizations > show hostname:configuration roles test_role1 authorizations >

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

1.

2.

Adding a User Who Can View the Dashboard

Use the following procedure to add a user who can only view the dashboard.

Add either a Directory or Local user as described in “Adding an Administrator or

User (BUI)” on page 203 .

Select the Kiosk user checkbox. Ensure the Kiosk screen is set to status/ dashboard.

218 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a User Who Can View the Dashboard

3.

Click ADD.

The user should now be able to login, but only view the dashboard.

Related Topics

Understanding Users and Roles

User Authorizations

Managing User Properties

Understanding Users and Roles

A user can be one of the following types:

Administrator User Type

Local - A locally defined appliance administrator; can be granted privileges by assigning custom roles; can optionally have a UID specified. Although local users are supported for data services, local groups are not supported.

Directory - An appliance administrator managed by a directory service (NIS or LDAP); can be granted privileges by assigning custom roles.

Non-Administrator User Type

Data-only - A data-only user defined locally for data

(SMB, NFS, FTP, etc.) with no administrator access; can optionally have a UID specified.

No-login - A username and UID reserved for identity mapping purposes. This user type is not allowed to log in to the appliance and can optionally have a UID specified.

Local and Directory users are administrator types, and can be granted privileges by assigning custom roles.

A role is a collection of privileges that can be assigned to an administrator user type. Newly created administrator users default to the "basic" role, which enables logging in to the administrative interface, but does not allow changes. All administrator users can read most system configuration parameters, and any role can be edited to add or delete authorizations.

The use of roles is more secure than giving everyone the root password. Roles restrict users to necessary authorizations only, and also attribute their actions to their individual username in the log. For example, you can create administrator and operator roles, with different authorization levels. Staff members can be assigned any role that is suitable for their needs, without assigning unnecessary privileges.

Related Topics

Adding an Administrator or User BUI

,

CLI

Changing a User Password BUI

,

CLI

Editing Exceptions for a User BUI

,

CLI

Configuring the Appliance 219

Adding a User Who Can View the Dashboard

Deleting Exceptions for a User BUI ,

CLI

Adding a Role

BUI ,

CLI

Editing Authorizations for a Role BUI , CLI

Deleting Authorizations from a Role BUI , CLI

Adding a User Who can Only View the Dashboard BUI

User Authorizations

Authorizations allow users to perform specific tasks, such as creating shares, rebooting the appliance, and updating the system software. Authorizations are grouped into scopes, and each scope may have a set of optional filters to narrow the scope of the authorization. For example, rather than an authorization to restart all services, a filter can be used so that this authorization can restart the HTTP service only.

The following table shows the available scopes:

TABLE 39

Scope BUI

Active Directory

Alerts

Analytics

Appliance

Clustering

Datasets

Hardware

User Available Scopes, Filters, and Authorizations

Scope CLI

ad alert stat appliance cluster dataset hardware -

-

-

Filters

Domain or workgroup name

Authorizations

■ Join an Active Directory domain

■ Join a workgroup

Configure alert filters and thresholds

List of drilldowns ■ Configure analytics hostname lookup policy

■ Create a statistic with this drilldown present

■ Read a statistic with this drilldown present

Appliance name ■ Emit an audit log entry

■ Restore the appliance to factory defaults

■ Power down the appliance

■ Reboot the appliance

■ Modify the appliance name

■ Access the underlying Solaris shell

■ Failback resources to a cluster peer

■ Reset a failed cluster I/O device

■ Takeover resources from a cluster peer

■ Transfer resources to a cluster peer

Configure dataset retention policies

■ Online and offline disks

■ Configure LEDs on disks, appliance, and external enclosures

■ Configure network properties for the service processor

220 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a User Who Can View the Dashboard

Scope BUI

Keystores

Roles

SAN

Services

Scope CLI

keystore

Networking net

Projects and shares nas

Shares property schema

Update schema update

Users

Workflow

Worksheet role stmf svc user workflow worksheet

-

-

-

Filters

Keystore name

-

■ Storage pool

■ Project

■ Share

Role name

Service name

Username

■ Owner

■ Name

■ Owner

■ Name

Authorizations

■ Remove a drive as a hot spare

■ Configure a storage pool

■ Unconfigure a storage pool

■ List keys present in a per-user keystore

■ Permit keystore modifications

■ Permit read access to sensitive values in a keystore

Configure networking devices, datalinks, and interfaces

■ Configure who can access a share

■ Change general properties on a share

■ Configure protocol-specific properties

■ Change quota and reservation on a share

■ Change user and group quotas on a share

■ Clear locks held on behalf of an NFS client

■ Configure authorizations for a role

■ Change a description of a role

■ Create a role

■ Destroy a role

Configure SAN hosts and targets

■ Enable or disable service

■ Configure service properties and settings

■ Restart service

Modify property schema

■ Delete system software

■ Update system software

■ Upload system updates

■ Configure authorizations for a user

■ Change a password

■ Configure preferences for a user

■ Configure properties for a user

■ Configure roles for a user

■ Create a user

■ Delete workflow

■ Execute workflow

■ Modify worksheet

■ Read worksheet

Related Topics

Adding an Administrator or User BUI

,

CLI

Configuring the Appliance 221

Adding a User Who Can View the Dashboard

Changing a User Password BUI

,

CLI

Editing Exceptions for a User

BUI

,

CLI

Deleting Exceptions for a User BUI ,

CLI

Adding a Role

BUI ,

CLI

Editing Authorizations for a Role BUI , CLI

Deleting Authorizations from a Role BUI , CLI

Adding a User Who can Only View the Dashboard BUI

Managing User Properties

The Configuration > Users page lists both users and groups, along with buttons for administration. Hover over an entry to expose its clone, edit, and destroy buttons. Double-click a user or role, or click its edit icon , to view its edit screen. The icons are as follows:

TABLE 40

Icon

Users BUI Page Icons

Description

Add a new user or role. A new dialog box is displayed where you enter the required properties.

Open a search box. Enter a search string and hit enter to search the user or role lists for that text, and only display entries that match. Click the icon again to return to the full listing.

Clone a user or role. Add a new user or role starting with fields based on the values from this entry.

Edit a user or role.

Remove a user, role, or authorization.

Depending on the type of user, all of the following properties can be set when adding a user, and a subset of these when editing a user:

User Properties

TABLE 41

Property

Type

Username

User ID

Description

For a description of user types, see

“Understanding Users and Roles” on page 219 .

Unique name for user

Enabled only for Local, Data, and No-login users. You can either choose to have an automatically assigned user

222 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a User Who Can View the Dashboard

Property

Full Name

Password/Confirm

Require session annotation

Kiosk user

Kiosk screen

Roles

Exceptions

Description

ID or specify a user ID on your own. The self-assigned

ID is not allowed to be less than 100, or be greater than

2147483646, or equal to 60001, 60002, or 65534.

User description

For Local and Data users, type the initial password in both of these fields

If enabled, when users log in to the appliance they must provide a text description of the purpose of their login.

This annotation may be used to track work performed for requests in a ticketing system, and the ticket ID can be used as the session annotation. The session annotation appears in the log.

If enabled, the user will only be able to view the screen in the "Kiosk screen" setting. This can be used to restrict a user to only see the dashboard, for example. A kiosk user will not be able to access the appliance via the CLI.

The screen that this kiosk user is restricted to, if "Kiosk user" is enabled

The roles assigned to a Directory or Local user

These authorizations are included or excluded from those normally available for the selected roles. For example, an exception can be added to exclude all or some scope authorizations for a role assigned to a user, or to include scope authorizations for a user without that scope defined in a role.

The following properties can be set when managing roles:

TABLE 42

Property

Name

Description

Exceptions

Role Properties

Description

Name of the role as it will be shown in lists

Verbose description of role if desired

Exceptions for this role

Related Topics

Adding an Administrator or User BUI

,

CLI

Changing a User Password BUI

,

CLI

Editing Exceptions for a User BUI

,

CLI

Deleting Exceptions for a User

BUI ,

CLI

Adding a Role

BUI

,

CLI

Configuring the Appliance 223

Setting Appliance Preferences

Editing Authorizations for a Role BUI , CLI

Deleting Authorizations from a Role BUI , CLI

Adding a User Who can Only View the Dashboard BUI

Setting Appliance Preferences

This section contains preference settings for your locality, session properties, advanced analytics, and SSH keys.

To configure your preferences, use the following sections:

Setting Preferences - BUI

,

CLI

Setting SSH Public Keys -

BUI

,

CLI

Preference Properties

1.

2.

Setting Preferences (BUI)

Use the following procedure to set preferences for the current user account. If you log into the

BUI with other than your own account, the preferences are saved for that user, such as the root user.

To change preferences for user accounts other than the one currently logged in to, see “Setting

Preferences (CLI)” on page 225 .

Go to Configuration > Preferences.

Modify the properties with values described in Preference Properties .

224 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Setting Preferences (CLI)

3.

Click APPLY.

Setting Preferences (CLI)

Use the following examples to set preferences for user accounts. If you log into the CLI with other than your own account, the preferences are saved for that user, such as the root user. See

Example 2 for how to change preferences for user accounts other than the one currently logged in to.

Choose the appropriate example.

Example 9

Setting Preferences for the Current User Account

To set preferences for the current user account, use the following CLI commands.

This example shows setting the session annotation property, which can only be set for the currently logged in user.

hostname:> configuration preferences hostname:configuration preferences> show

Properties:

locale = C

login_screen = status/dashboard

session_timeout = 15

session_annotation =

advanced_analytics = false

Children:

keys => Manage SSH public keys hostname:configuration preferences> set session_annotation="Editing my user preferences"

session_annotation = Editing my user preferences (uncommitted) hostname:configuration preferences> commit

Example 10

Setting Preferences for a Different User Account

To set preferences for a different user account, use the following CLI commands. Note that you cannot set a session annotation for a user other than the currently logged in user.

This example shows enabling advanced analytics for a selected user.

hostname:> configuration users hostname:configuration users> select brendan

Configuring the Appliance 225

Setting SSH Public Keys (BUI) hostname:configuration users brendan> preferences hostname:configuration users brendan preferences> show

Properties:

locale = C

login_screen = status/dashboard

session_timeout = 15

advanced_analytics = false

Children:

keys => Manage SSH public keys hostname:configuration users brendan preferences> set advanced_analytics=true

advanced_analytics = true (uncommitted) hostname:configuration users brendan preferences> commit

Setting SSH Public Keys (BUI)

SSH public keys can be used to allow SSH connections without the use of passwords. This feature is useful for administrator convenience and for automated execution of scripts.

Use the following procedure to set SSH public keys for the current user. To set keys for other

users, see “Setting SSH Public Keys (CLI)” on page 226 .

Go to Configuration > Preferences.

3.

4.

1.

2.

Click the add icon next to SSH Public Keys.

Select a Type, and then type the SSH public key and a key comment.

Click ADD.

Setting SSH Public Keys (CLI)

SSH public keys can be used to allow SSH connections without the use of passwords. This feature is useful for administrator convenience and for automated execution of scripts.

Use the following examples to set SSH public keys for user accounts. If you log into the CLI with other than your own account, the keys are saved for that user, such as the root user. See

Example 2 for how to change keys for user accounts other than the one currently logged in to.

Choose the appropriate example.

226 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Setting SSH Public Keys (CLI)

Example 11

Setting SSH Public Keys for the Current User Account

To set SSH public keys for the current user account, use the following CLI commands.

hostname:> configuration preferences hostname:configuration preferences> show

Properties:

locale = C

login_screen = status/dashboard

session_timeout = 15

advanced_analytics = false

Children:

keys => Manage SSH public keys hostname: configuration preferences> keys hostname:configuration preferences keys> create hostname:configuration preferences key (uncommitted)> set type=DSA hostname:configuration preferences key (uncommitted)> set key="

...DSA key text..."

key = ...

DSA key text...(uncommitted) hostname:configuration preferences key (uncommitted)> set comment="fw-log1"

comment = fw-log1 (uncommitted) hostname:configuration preferences key (uncommitted)> commit hostname:configuration preferences keys> show

Keys:

NAME MODIFIED TYPE COMMENT key-000 07/12/2015 10:54:58 DSA fw-log1

Example 12

Setting SSH Public Keys for a Different User Account

To set SSH public keys for a different user account, use the following CLI commands.

hostname:> configuration users hostname:configuration users> select john hostname:configuration users john> preferences show

Properties:

locale = C

login_screen = status/dashboard

session_timeout = 15

advanced_analytics = false

Children:

keys => Manage SSH public keys

Configuring the Appliance 227

Configuring Alerts hostname: configuration users john> preferences keys hostname:configuration users john preferences keys> create hostname:configuration users john preferences key (uncommitted)> set type=DSA hostname:configuration users john preferences key (uncommitted)> set key="

...DSA key text..."

key = ...

DSA key text...(uncommitted) hostname:configuration users john preferences key (uncommitted)> set comment="fw-log2"

comment = fw-log2 (uncommitted) hostname:configuration users john preferences key (uncommitted)> commit hostname:configuration users john preferences keys> show

Keys:

NAME MODIFIED TYPE COMMENT key-001 07/13/2015 10:57:58 DSA fw-log2

Preference Properties

The following table describes the properties for setting user preferences.

TABLE 43

Preference Properties

Property

Initial login screen

Locality

Session timeout

Current session annotation

Advanced analytics statistics

SSH Public Keys

Description

First page the BUI will load after a successful login. By default, this is the Status Dashboard.

C by default. C and POSIX Localities support only

ASCII characters or plain text. ISO 8859-1 supports the following languages: Afrikaans, Basque, Catalan,

Danish, Dutch, English, Faeroese, Finnish, French,

Galician, German, Icelandic, Irish, Italian, Norwegian,

Portuguese, Spanish and Swedish.

Time after navigating away from the BUI that the browser will automatically logout the session

Annotation text added to audit logs

This will make available additional statistics in Analytics

RSA/DSA public keys. Text comments can be associated with the keys to help administrators track why they were added. In the BUI, these keys apply only for the current user; to add keys for other users, use the CLI.

Configuring Alerts

This section describes system Alerts, how they are customized, and where to find alert logs.

To monitor statistics from Analytics, create custom threshold alerts. To configure the system to respond to certain types of alerts, use Alert actions.

228 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Alert Action (BUI)

To configure alerts, use the following sections:

Adding an Alert Action (BUI)

Adding an Alert Action (CLI)

Sending Email Alerts (CLI)

Sending an SNMP Trap (CLI)

To learn more about alerts, see the following sections:

Alert Categories

Sending Syslog Messages

Executing a Workflow

Threshold Alerts

Resuming/Suspending Datasets and Worksheets

4.

5.

6.

7.

1.

2.

3.

Adding an Alert Action (BUI)

Click the add icon next to "Alert actions".

Select the Category, or pick "All events" for everything.

Either pick All Events, or a Subset of Events. If the subset is selected, customize the checkbox list to match the desired alerts events.

Use the drop down menu in "Alert actions" to select which alert type.

Enter details for the Alert action. The "TEST" button can be clicked to create a test alert and execute this alert action (useful for checking if email or SNMP is configured correctly).

The add icon next to "Alert actions" can be clicked to add multiple alerts actions.

Click "ADD" at the top right.

Related Topics

Alert Categories

Sending Syslog Messages

Executing a Workflow

Threshold Alerts

Resuming/Suspending Datasets and Worksheets

Configuring the Appliance 229

Adding an Alert Action (CLI)

Adding an Alert Action (CLI)

11.

12.

13.

5.

6.

1.

2.

3.

4.

7.

8.

9.

10.

Enter the configuration alerts actions context, and enter the create command.

Go to the "category" property by entering get category = (unset).

Enter set category=thresholds.

Enter set thresholdid=where [id is the identifier that was automatically created for the threshold alert.

Enter commit.

Enter list to determine the name, including number, of the new alert action.

Look for a threshold without an assigned action and handler.

Enter select actions-where [number is the same number identified in the previous step.

Enter action, and then enter get.

By default, the alert type is email. If this is what you want, skip to the next step.

If not, enter set handler=where [type is either snmptrap, syslog, resumedataset, suspenddataset

, resumeworksheet, suspendworksheet, or executeworkflow. Then enter get to view the needed arguments. Only snmptrap and syslog do not have arguments.

Set each needed argument. For example, to set a subject line for an email alert, enter set subject=where [subject is the desired email subject line.

Use the show command to ensure all arguments have been entered.

Enter commit, and then enter list. If necessary, correct any arguments now.

Enter done, and then enter done again.

Related Topics

Alert Categories

Sending Syslog Messages

Executing a Workflow

230 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Alert Action (CLI)

Threshold Alerts

Resuming/Suspending Datasets and Worksheets

Sending Email Alerts (CLI)

An email containing the alert details can be sent. The configuration requires an email address and email subject line. The following example shows an email threshold alert. Details on how the appliance sends mail can be configured on the SMTP service screen.

From [email protected] Mon Oct 13 15:24:47 2009

Date: Mon, 13 Oct 2009 15:24:21 +0000 (GMT)

From: Appliance on caji <[email protected]>

Subject: High CPU on caji

To: [email protected]

SUNW-MSG-ID: AK-8000-TT, TYPE: Alert, VER: 1, SEVERITY: Minor

EVENT-TIME: Mon Oct 13 15:24:12 2009

PLATFORM: i86pc, CSN: 0809QAU005, HOSTNAME: caji

SOURCE: svc:/appliance/kit/akd:default, REV: 1.0

EVENT-ID: 15a53214-c4e7-eae4-dae6-a652a51ea29b

DESC: cpu.utilization threshold of 90 is violated.

AUTO-RESPONSE: None.

IMPACT: The impact depends on what statistic is being monitored.

REC-ACTION: The suggested action depends on what statistic is being monitored.

SEE: https://192.168.2.80:215/#maintenance/alert=15a53214-c4e7-eae4-dae6-a652a51ea29b

Related Topics

Alert Categories

Sending Syslog Messages

Executing a Workflow

Threshold Alerts

Resuming/Suspending Datasets and Worksheets

Sending an SNMP Trap (CLI)

An SNMP trap containing alert details can be sent, if an SNMP trap destination is configured in the SNMP service, and that service is online. The following example sends an SNMP trap, as seen from the Net-SNMP tool snmptrapd -P.

Configuring the Appliance 231

Adding an Alert Action (CLI)

# /usr/sfw/sbin/snmptrapd -P

2009-10-13 15:31:15 NET-SNMP version 5.0.9 Started.

2009-10-13 15:31:34 caji.com [192.168.2.80]:

iso.3.6.1.2.1.1.3.0 = Timeticks: (2132104431) 246 days, 18:30:44.31

iso.3.6.1.6.3.1.1.4.1.0 = OID: iso.3.6.1.4.1.42.2.225.1.3.0.1

iso.3.6.1.4.1.42.2.225.1.2.1.2.36.55.99.102.48.97.99.100.52.45.51.48.

99.49.45.52.99.49.57.45.101.57.99.98.45.97.99.50.55.102.55.49.50.54.

98.55.57 = STRING: "7cf0acd4-30c1-4c19-e9cb-ac27f7126b79"

iso.3.6.1.4.1.42.2.225.1.2.1.3.36.55.99.102.48.97.99.100.52.45.51.48.

99.49.45.52.99.49.57.45.101.57.99.98.45.97.99.50.55.102.55.49.50.54.

98.55.57 = STRING: "alert.ak.xmlrpc.threshold.violated"

iso.3.6.1.4.1.42.2.225.1.2.1.4.36.55.99.102.48.97.99.100.52.45.51.

48.99.49.45.52.99.49.57.45.101.57.99.98.45.97.99.50.55.102.55.49.50.

54.98.55.57 = STRING: "cpu.utilization threshold of 90 is violated."

Related Topics

Alert Categories

Sending Syslog Messages

Executing a Workflow

Threshold Alerts

Resuming/Suspending Datasets and Worksheets

Alert Categories

Important appliance events trigger alerts, which includes hardware and software faults. These alerts appear in the Logs and may also be configured to execute any of the Alert actions.

Alerts are grouped into the following categories:

TABLE 44

Category

Cluster

Custom

Hardware Events

Hardware Faults

NDMP operations

Alert Categories

Network

Description

Cluster events, including link failures and peer errors

Events generated from the custom alert configuration

Appliance boot and hardware configuration changes

Any hardware fault

NDMP TAR/DUMP backup and restore start and finish events. This group is available as "NDMP: backup only" and "NDMP: restore only"

Network port, datalink, and IP interface events and failures

232 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Alert Action (CLI)

Category

Phone Home

Remote replication

Service failures

Thresholds

ZFS pool

Description

Support bundle upload events

Send and receive events and failures. This group is available as "Remote replication: source only" and

"Remote replication: target only", for just source or target events

Software services failure events

Custom alerts based on Analytics statistics

Storage pool events, including scrub and hot space activation

Sending Syslog Messages

When the Syslog service is enabled, a syslog message containing alert details can be sent to one or more remote systems. For more information about sending syslog messages, see

Syslog

Relay service

.

Executing a Workflow

Workflows can be optionally executed as alert actions. To let workflow be eligible as an alert action, its alert action must be set to true. For more information about executing a workflow, see

“Maintenance Workflows” on page 647 .

Threshold Alerts

These are alerts based on the statistics from Analytics. The following are properties when creating threshold alerts:

TABLE 45

Property

Threshold

Threshold Alert Properties exceeds/falls below

Timing: for at least only between/only during

Description

The threshold statistic is from Analytics, and is self descriptive (such as "Protocol: NFSv4.0 operations per second") defines how the threshold value is compared to the current statistic

Duration which the current statistic value must exceed/ fall below the threshold

These properties may be set so that the threshold is only sent during certain times of day - such as business hours

Configuring the Appliance 233

Adding an Alert Action (CLI)

Property

Repost alert every ... this condition persists.

Also post alert when this condition clears for at least ...

Description

If enabled, this will re-execute the alert action (such as sending email) every set interval while the threshold breech exists

Send a followup alert if the threshold breech clears for at least the set interval

The "Add Threshold Alert" dialog has been organized so that it can be read as though it is a paragraph describing the alert. The default reads:

Threshold CPU: percent utilization exceeds 95 percent.

Timing for at least 5 minutes only between 0:00 and 0:00 only during weekdays.

Repost alert every 5 minutes while this condition persists.

Also post alert when this condition clears for at least 5 minutes.

Related Topics

“Configuring a Threshold Alert (BUI)” in Oracle ZFS Storage Appliance Analytics Guide,

Release OS8.7.0

“Configuring a Threshold Alert (CLI)” in Oracle ZFS Storage Appliance Analytics Guide,

Release OS8.7.0

Adding an Alert Action (BUI)

Adding an Alert Action (CLI)

Sending Email Alerts (CLI)

Sending an SNMP Trap (CLI)

Resuming/Suspending Analytics Datasets and

Worksheets

Analytics datasets may be resumed or suspended. This is particularly useful when tracking down sporadic performance issues, and when enabling these datasets 24x7 is not desirable.

For example, imagine you noticed a spike in CPU activity once or twice a week, and other analytics showed an associated drop in NFS performance. You enable some additional datasets, but you don't quite have enough information to prove what the problem is. If you could enable the NFS by hostname and filename datasets, you are certain you will understand the cause a lot better. However those particular datasets can be heavy handed - leaving them enabled 24x7 will degrade performance for everyone. This is where the resume/suspend dataset actions may be

234 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Certificates of use. A threshold alert could be configured to resume paused NFS by hostname and filename datasets, only when the CPU activity spike is detected; a second alert can be configured to then

suspend those datasets, after a short interval of data is collected. The end result - you collect the data you need only during the issue, and minimize the performance impact of this data collection.

For more information on datasets, see “About Analytics Datasets” in Oracle ZFS Storage

Appliance Analytics Guide, Release OS8.7.0

.

These actions are to resume or suspend an entire Analytics worksheet, which may contain numerous datasets. The reasons for doing this are similar to those for resuming and suspending datasets. For more information, see “Worksheet Graphs and Plots” in Oracle ZFS Storage

Appliance Analytics Guide, Release OS8.7.0

.

Related Topics

“Configuring a Threshold Alert (BUI)” in Oracle ZFS Storage Appliance Analytics Guide

“Configuring a Threshold Alert (CLI)” in Oracle ZFS Storage Appliance Analytics Guide

“Adding an Alert Action (BUI)” on page 229

“Adding an Alert Action (CLI)” on page 230

“Sending Email Alerts (CLI)” on page 231

“Sending an SNMP Trap (CLI)” on page 231

Configuring Certificates

This section describes the use of public key certificates. Public key certificates and their trust chains provide a mechanism to digitally identify a system without having to manually exchange any secret information.

A public key certificate is a blob of data that encodes a public key value, some information about the generation of the certificate, such as a name and who signed it, a hash or checksum of the certificate, and a digital signature of the hash. Together, these values form the certificate.

The digital signature ensures that the certificate has not been modified.

The appliance supports customer-owned certificates. The life cycle of a certificate starts with generating a certificate signing request (CSR). The CSR is then sent to the certificate authority

(CA) for signature. After the signed certificate is returned from the CA, it can be installed on the appliance. If a certificate is signed by a non-root CA, you must also obtain certificates from the second- and higher-level CAs.

There are two types of certificates, that you can manage. System certificates identify the current system. Trusted certificates are those that identify remote systems.

Configuring the Appliance 235

Creating a New Server Certificate (BUI)

To manage system certificates, use the following tasks:

Creating a New System Certificate - BUI ,

CLI

Uploading CA Certificates from Non-root CAs -

BUI ,

CLI

Viewing CSR and System Certificate Details - BUI

,

CLI

Destroying a CSR or System Certificate - BUI

,

CLI

Setting the Appliance or Default System Certificate -

BUI , CLI

To manage trusted certificates, use the following tasks:

Uploading a Trusted Certificate -

BUI , CLI

Viewing Trusted Certificate Details - BUI , CLI

Destroying a Trusted Certificate - BUI , CLI

Assigning a Certificate to a Service -

BUI , CLI

Creating a New Server Certificate (BUI)

4.

5.

6.

1.

2.

3.

To create a new server certificate, use the following steps.

Go to Configuration > Settings.

Click the System tab.

To create a new CSR, click the add item icon .

To create a new CSR based on an existing CSR or certificate, hover over an existing entry and click the copy icon .

Complete the CSR form.

Click CREATE.

When prompted to open the CSR or save it, select Save File and click OK to save the CSR now, or click Cancel to save the CSR later.

7.

To save the CSR later, hover over the entry and click the download icon .

Transfer the CSR to your CA in the prescribed manner.

236 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a New Server Certificate (CLI)

8.

9.

10.

After receiving the signed certificate from the CA, click the upload icon .

Browse to the signed certificate and select it.

Click UPLOAD.

1.

2.

3.

Creating a New Server Certificate (CLI)

To create a new server certificate, use the following steps.

To create a new CSR, enter the configuration settings certificates system context, and enter the create command.

Or to create a new CSR based on existing CSR or certificate, enter the above context and then the command clone CSR or certificate number. For example: hostname:configuration settings certificates system> clone cert-000

To complete the CSR form, use the following CLI commands.

hostname:configuration settings certificates system (uncommitted)> get

subject_commonname = hostname.us.example.com

subject_organizationname = (unset)

subject_organizationalunitname = (unset)

subject_localityname = (unset)

subject_stateorprovincename = (unset)

subject_countryname = (unset)

subject_emailaddress = (unset)

dns = hostname.us.example.com

ip = 192.0.2.1

uri = (unset)

comment = (unset) hostname:configuration settings certificates system (uncommitted)> set comment="test

certificate"

comment = test certificate (uncommitted) hostname:configuration settings certificates system (uncommitted)> commit

To view the CSR, use following commands.

hostname:configuration settings certificates system> show

Properties:

default = auto

System Certificates:

Configuring the Appliance 237

Uploading CA Certificates from Non-root CAs (BUI)

4.

5.

6.

CERT TYPE SUBJECT ISSUER EXPIRES cert-000 req hostname.us.example.com cert-001 CA Joe Test CA Joe Test CA 2038-1-19 cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21 hostname:configuration settings certificates system> dump cert-000

-----BEGIN CERTIFICATE REQUEST-----

MIICwzCCAasCAQIwIjEgMB4GA1UEAxMXaG9zdG5hbWUudXMuZXhhbXBsZS5jb20w

...

lhwblMXqR/3xptwym1vy5dYBJsQLKroA8nr/xFb3nhJB8nI+dxSN

-----END CERTIFICATE REQUEST-----

Copy the CSR and transfer it to your CA in the prescribed manner.

After receiving the signed certificate from the CA, enter the configuration settings certificates system

context, and enter the import command.

hostname:configuration settings certificates system> import

("." to end)> -----BEGIN CERTIFICATE-----

("." to end)> MIID0DCCArigAwIBAgIBQDANBgkqhkiG9w0BAQUFADCBmDELMAkGA1UEBhMCVVMx

("." to end)> 2ai9ZwREdTkcjcgQDxeHNZCpcHk=

("." to end)> -----END CERTIFICATE-----

("." to end)> .

To check the imported certificates, view all certificate entries using the command show

.

hostname:configuration settings certificates system> show

Properties:

default = auto

System Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-000 req hostname.us.example.com cert-001 CA Joe Test CA Joe Test CA 2038-1-19 cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

Uploading CA Certificates from Non-root CAs

(BUI)

If your server certificate is signed by a non-root CA, you need to obtain certificates for the second- and higher-level CAs also. After obtaining these CA certificates, use the following steps to upload them.

238 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Uploading CA Certificates from Non-root CAs (CLI)

1.

2.

3.

Go to Configuration > Settings.

Click the System tab.

4.

5.

6.

Click the upload icon .

Browse to the signed certificate and select it.

Click UPLOAD.

Repeat steps 3 through 5 for each signed certificate.

1.

2.

3.

Uploading CA Certificates from Non-root CAs

(CLI)

If your server certificate is signed by a non-root CA, you also need to obtain certificates for the second- and higher-level CAs. After obtaining these CA certificates, use the following steps to upload them.

To upload a certificate, enter the configuration settings certificates system context, and enter the import command.

hostname:configuration settings certificates system> import

("." to end)> -----BEGIN CERTIFICATE-----

("." to end)> MIID0DCCArigAwIBAgIBQDANBgkqhkiG9w0BAQUFADCBmDELMAkGA1UEBhMCVVMx

...

("." to end)> 2ai9ZwREdTkcjcgQDxeHNZCpcHk=

("." to end)> -----END CERTIFICATE-----

("." to end)> .

Repeat step 1 for each signed certificate.

To check the imported certificates, view all certificate entries using the command show

.

hostname:configuration settings certificates system> show

Properties:

default = auto

System Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-000 req hostname.us.example.com cert-001 CA Joe Test CA Joe Test CA 2038-1-19

Configuring the Appliance 239

Viewing CSR and Certificate Details (BUI) cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

1.

2.

3.

Viewing CSR and Certificate Details (BUI)

To view CSR and certificate details, use the following steps.

Go to Configuration > Settings.

Click the Systems tab.

4.

Hover over an existing entry and click its information icon .

When finished, click OK to close the Details window.

1.

2.

Viewing CSR and Certificate Details (CLI)

To view CSR and certificate details, use the following steps.

To view all certificate entries, go to the configuration settings certificates system

context, and enter the show command.

hostname:configuration settings certificates system> show

Properties:

default = auto

System Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-000 req hostname.us.example.com cert-001 CA Joe Test CA Joe Test CA 2038-1-19 cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

To view the details of a CSR or certificate, use the following commands.

hostname:configuration settings certificates system> select cert-000 hostname:configuration settings certificates system cert-000> show

Properties:

uuid = 195071da-66ac-43a6-edfa-bbbd7451f1d5

subject_commonname = hostname.us.example.com

issuer_commonname = Joe Test CA

dns = hostname.us.example.com

ip = 192.0.2.1

comment = test certificate

240 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Destroying a CSR or Certificate (BUI)

notbefore = 2014-12-4 00:31:33

notafter = 2038-01-19 00:31:33

sha1fingerprint = 81:A2:4B:C4:06:A9:14:1E:3E:0B:8A:70:FB:1A:30:45:2D:93:

DD:02

md5fingerprint = B7:B2:F4:3B:BB:04:8E:11:A2:64:3D:69:BF:8A:79:CC hostname:configuration settings certificates system cert-000> done

Destroying a CSR or Certificate (BUI)

To destroy a CSR or certificate, use the following steps.

Note -

Destroying a CSR also destroys the associated private key. Therefore, importing a certificate derived from that CSR will not be possible. Destroying a certificate also destroys the associated private key. Therefore, re-importing that certificate will not be possible.

1.

2.

3.

4.

Go to Configuration > Settings.

Click the System tab.

Hover over an existing entry and click the trash icon .

Click DESTROY.

Destroying a CSR or Certificate (CLI)

To destroy a CSR or certificate, use the following steps.

Note -

Destroying a CSR also destroys the associated private key. Therefore, importing a certificate derived from that CSR will not be possible. Destroying a certificate also destroys the associated private key. Therefore, re-importing that certificate will not be possible.

1.

To view all certificate entries, go to the configuration settings certificates system

context, and enter the show command.

hostname:configuration settings certificates system> show

Properties:

default = auto

System Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES

Configuring the Appliance 241

Setting the Appliance Certificate (BUI)

2.

cert-000 req hostname.us.example.com cert-001 CA Joe Test CA Joe Test CA 2038-1-19 cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

To destroy a CSR or certificate, use the following commands.

hostname:configuration settings certificates system> destroy cert-002

Caution: Destroying a certificate issued by a certificate authority also destroys the associated private key. Re-importing the certificate will not be possible.

Destroy appliance certificate? (Y/N) Y

1.

2.

3.

4.

Setting the Appliance Certificate (BUI)

To set the appliance of default certificate, use the following steps.

Go to Configuration > Settings.

Click the Systems tab.

From the drop-down menu of system certificates, select the certificate that you want to set as the default.

Click APPLY.

1.

2.

Setting the Appliance Certificate (CLI)

To set the appliance or default certificate, use the following steps.

To view all certificate entries, go to the configuration settings certificates system

context, and enter the show command.

hostname:configuration settings certificates system> show

Properties:

default = auto

System Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-000 req hostname.us.example.com cert-001 CA Joe Test CA Joe Test CA 2038-1-19 cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

To set a certificate as the default, use the following commands.

242 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Uploading Trusted Certificates (BUI) hostname:configuration settings certificates system> set default=cert-000

default= cert-000 (uncommitted) hostname:configuration settings certificates system> commit

4.

5.

6.

1.

2.

3.

Uploading Trusted Certificates (BUI)

Use the following steps to upload a trusted certificate.

Go to Configuration > Settings.

Click the Trusted tab.

Click the upload icon .

Browse to the signed certificate and select it.

Click UPLOAD.

Repeat steps 3 through 5 for each signed certificate.

1.

2.

3.

Uploading Trusted Certificates (CLI)

Use the following steps to upload a trusted certificate.

To upload a certificate, enter the configuration settings certificates trusted context, and enter the import command.

hostname:configuration settings certificates trusted> import

("." to end)> -----BEGIN CERTIFICATE-----

("." to end)> MIID0DCCArigAwIBAgIBQDANBgkqhkiG9w0BAQUFADCBmDELMAkGA1UEBhMCVVMx

...

("." to end)> 2ai9ZwREdTkcjcgQDxeHNZCpcHk=

("." to end)> -----END CERTIFICATE-----

("." to end)> .

Repeat step 1 for each signed certificate.

To check the imported certificates, view all certificate entries using the command show

.

Configuring the Appliance 243

Viewing Trusted Certificate Details (BUI) hostname:configuration settings certificates trusted> show

Properties:

default = auto

Trusted Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

1.

2.

3.

Viewing Trusted Certificate Details (BUI)

To view trusted certificate details, use the following steps.

Go to Configuration > Settings.

Click the Trusted tab.

4.

Hover over an existing entry and click its information icon .

When finished, click OK to close the Details window.

1.

2.

Viewing Trusted Certificate Details (CLI)

To view CSR and certificate details, use the following steps.

To view all certificate entries, go to the configuration settings certificates trusted

context, and enter the show command.

hostname:configuration settings certificates system> show

Properties:

default = auto

Trusted Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

To view the details of a certificate, use the following commands.

hostname:configuration settings certificates system> select cert-000 hostname:configuration settings certificates system cert-000> show

Properties:

uuid = 195071da-66ac-43a6-edfa-bbbd7451f1d5

subject_commonname = hostname.us.example.com

244 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Destroying a Trusted Certificate (BUI)

issuer_commonname = Joe Test CA

dns = hostname.us.example.com

ip = 192.0.2.1

comment = test certificate

notbefore = 2014-12-4 00:31:33

notafter = 2038-01-19 00:31:33

sha1fingerprint = 81:A2:4B:C4:06:A9:14:1E:3E:0B:8A:70:FB:1A:30:45:2D:93:

DD:02

md5fingerprint = B7:B2:F4:3B:BB:04:8E:11:A2:64:3D:69:BF:8A:79:CC hostname:configuration settings certificates system cert-000> done

1.

2.

3.

Destroying a Trusted Certificate (BUI)

To destroy a trusted certificate, use the following steps.

Go to Configuration > Settings.

Click the Trusted tab.

4.

Hover over an existing entry and click the trash icon .

Click DESTROY.

1.

2.

Destroying a Trusted Certificate (CLI)

To destroy a trusted certificate, use the following steps.

To view all certificate entries, go to the configuration settings certificates trusted

context, and enter the show command.

hostname:configuration settings certificates trusted> show

Properties:

default = auto

Trusted Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

To destroy a certificate, use the following commands.

hostname:configuration settings certificates system> destroy cert-002

Caution: Destroying a certificate issued by a certificate authority also

Configuring the Appliance 245

Assigning a Certificate to a Service (BUI) destroys the associated private key. Re-importing the certificate will not be possible.

Destroy appliance certificate? (Y/N) Y

1.

2.

3.

Assigning a Certificate to a Service (BUI)

To assign a certificate to the LDAP service, use the following steps.

Go to Configuration > Settings.

Click the Trusted tab.

From the drop-down menu of system certificates, select the certificate that you want to assign.

4.

5.

Click the edit icon .

Select the ldap service from the list of services at the bottom of the page.

1.

2.

Assigning a Certificate to a Service (CLI)

To assign a certificate to the LDAP service, use the following steps.

To view all certificate entries, go to the configuration settings certificates trusted

context, and enter the show command.

hostname:configuration settings certificates trusted> show

Properties:

default = auto

System Certificates:

CERT TYPE SUBJECT ISSUER EXPIRES cert-002 cert hostname.us.example.com Joe Test CA 2038-1-21

Select the certificate that you want to assign the service to.

hostname:configuration settings certificates trusted> select cert-002 hostname:configuration settings certificates trusted cert-002> set services=ldap

services= ldap (uncommitted) hostname:configuration settings certificates trusted cert-002> commit

246 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Appliance Services

Appliance services are easily managed from the BUI Configuration > Services screen or the

CLI configuration services context.

Use the following tasks for viewing and managing appliance services:

“Viewing a Service in the BUI” on page 248

“Selecting a Service in the CLI” on page 249

Enabling a Service - BUI ,

CLI

Disabling a Service - BUI

,

CLI

“Viewing Service States in the CLI” on page 251

“Viewing Service Help in the CLI” on page 251

Setting Service Properties -

BUI

,

CLI

Viewing Service Logs - BUI ,

CLI

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

For information on configuring an individual service, select one of the services from the following table:

Data Services

NFS

iSCSI

SMB

FTP

HTTP

NDMP

Remote Replication

Shadow Migration

SFTP

SRP

Directory Services

NIS

LDAP

Active Directory

Identity Mapping

System Settings

DNS

IPMP

NTP

Phone Home

Dynamic Routing

Service Tags

SMTP

SNMP

Syslog

System Identity

Remote Access

SSH

RESTful API

Appliance Services 247

Managing Services

Data Services

TFTP

Virus Scan

Directory Services System Settings

Kerberos

Remote Access

Managing Services

For information about managing appliance services, use the following tasks:

“Viewing a Service in the BUI” on page 248

“Selecting a Service in the CLI” on page 249

Enabling a Service - BUI

,

CLI

Disabling a Service -

BUI

,

CLI

“Viewing Service States in the CLI” on page 251

“Viewing Service Help in the CLI” on page 251

Setting Service Properties -

BUI ,

CLI

Viewing Service Logs - BUI

,

CLI

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

1.

2.

Viewing a Service in the BUI

Go to Configuration > Services.

To view or edit the properties for a specific service, hover over the service status icon that is to the left of the service name.

The status icon turns into an arrow icon .

3.

4.

Click the arrow icon to display the properties screen for the selected service.

In any of the services screens, you can show a side panel of all services by clicking the small arrow icon to the left of the Services title (near the top left of each screen). Click this icon again to hide the list.

Related Topics

“Enabling a Service (BUI)” on page 249

248 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Selecting a Service in the CLI

“Setting Service Properties (BUI)” on page 252

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

1.

2.

Selecting a Service in the CLI

After you select a service, you can view its state, enable it, disable it, and set its properties.

Go to configuration services.

Select a service by entering its name. For example, enter nis:

hostname:configuration services> nis hostname:configuration services nis>

Related Topics

“Enabling a Service (CLI)” on page 250

“Setting Service Properties (CLI)” on page 253

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

Enabling a Service (BUI)

Use the following procedure to enable a service that is not online.

Go to Configuration > Services.

1.

2.

Click the power icon to bring the service online .

Related Topics

“Disabling a Service (BUI)” on page 250

“Setting Service Properties (BUI)” on page 252

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

Appliance Services 249

Enabling a Service (CLI)

1.

2.

Enabling a Service (CLI)

Use the following procedure to enable a service that is not online.

Go to configuration services.

Select a service, then enter the enable command to enable a service.

hostname:configuration services> nis hostname:configuration services nis> enable

Related Topics

“Disabling a Service (CLI)” on page 250

“Setting Service Properties (CLI)” on page 253

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

Disabling a Service (BUI)

Use the following procedure to disable a service that is online.

Go to Configuration > Services.

1.

2.

Click the power icon to take the service offline .

Related Topics

“Enabling a Service (BUI)” on page 249

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

1.

Disabling a Service (CLI)

Use the following procedure to disable a service that is online.

Go to configuration services.

250 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing Service States in the CLI

2.

Select the service, then enter disable command to disable it.

hostname:configuration services> nis hostname:configuration services nis> disable

Related Topics

“Enabling a Service (CLI)” on page 250

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

1.

2.

3.

Viewing Service States in the CLI

Use the following procedure to view service states.

Go to configuration services.

Enter the show command to list the current state of all services.

To view the state of an individual service, select the service and then enter show.

hostname:configuration services> nis hostname:configuration services nis> show

Properties:

<status> = online

domain = fishworks

broadcast = true

ypservers =

Related Topics

“Enabling a Service (CLI)” on page 250

“Setting Service Properties (CLI)” on page 253

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

Viewing Service Help in the CLI

Use the following procedure to display available commands for a service.

Appliance Services 251

Setting Service Properties (BUI)

1.

2.

Go to configuration services.

Select the service and enter help.

hostname:configuration services> nis hostname:configuration services nis> help

Subcommands that are valid in this context:

help [topic] => Get context-sensitive help. If [topic] is specified,

it must be one of "builtins", "commands", "general",

"help", "script" or "properties".

show => Show information pertinent to the current context

commit => Commit current state, including any changes

done => Finish operating on "nis"

enable => Enable the nis service

disable => Disable the nis service

get [prop] => Get value for property [prop]. ("help properties"

for valid properties.) If [prop] is not specified,

returns values for all properties.

set [prop] => Set property [prop] to [value]. ("help properties"

for valid properties.) For properties taking list

values, [value] should be a comma-separated list of

values.

Related Topics

“Setting Service Properties (CLI)” on page 253

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

Setting Service Properties (BUI)

The Configuration > Services screens allow you to view and modify the services. The following table describes the icons and buttons in the services screens.

252 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Setting Service Properties (CLI)

Icon Description

Go to the service screen to configure properties and view logs. This button appears when you hover over a service.

The service is enabled and working normally.

The service is offline or disabled.

The service has a problem and requires operator attention.

Enables or disables the service.

Restarts the service.

Enable/disable not available for this service.

Restarts the currently unavailable service. You must enable the service first).

1.

2.

3.

Go to Configuration > Services.

Double-click a service.

Change the properties and then click APPLY.

To reset properties, click REVERT.

Related Topics

“Enabling a Service (BUI)” on page 249

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

1.

2.

Setting Service Properties (CLI)

Use the following procedure to define properties for a service. Property names are similar to their names in the BUI, but CLI names are usually shorter and sometimes abbreviated.

Go to configuration services.

Select a service and enter show to view the list of properties you can set for that service, along with their current values.

Appliance Services 253

Viewing Service Logs (BUI)

3.

4.

hostname:configuration services> nis hostname:configuration services nis> show

Properties:

<status> = online

domain =

broadcast = true

ypservers =

Use the set command to set the properties.

hostname:configuration services nis> set domain="mydomain"

domain = mydomain (uncommitted)

After setting the properties, enter commit to save and activate the new configuration.

hostname:configuration services nis> commit hostname:configuration services nis> show

Properties:

<status> = online

domain = mydomain

broadcast = true

ypservers =

Related Topics

“Enabling a Service (CLI)” on page 250

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

1.

2.

Viewing Service Logs (BUI)

Some services provide service logs with information to help you diagnose service issues. If a

Logs button exists in the top right of a service screen, that service provides a log. Service logs can provide the times when a service changed state, and the error messages from the service.

Log content is specific to each individual service and is subject to change.

Go to Configuration > Services and double-click a service.

Click the Logs button at the top right of a service screen.

The following are common example messages:

254 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing Service Logs (CLI)

Example Log Message

Executing start method

Method "start" exited with status 0

Method "refresh" exited with status 0

Executing stop method

Enabled

Disabled

Description

The service is starting up

The service reported a successful start (0 == success)

The service successfully refreshed its configuration based on its service settings

The service is being shut down

The service state was checked to see if it should be started (such as during system boot), and it was found to be in the enabled state

The service state was checked to see if it should be started (such as during system boot), and it was found to be in the disabled state

The following log example is from the NTP service:

[ Oct 15 21:05:31 Enabled. ]

[ Oct 15 21:07:37 Executing start method (...). ]

[ Oct 15 21:13:38 Method "start" exited with status 0. ]

The first log event in the example shows that the system was booted at 21:05. The second entry at 21:07:37 records that the service began startup, which completed at 21:13:38. Due to the nature of NTP and system clock adjustment, this service can take minutes to complete startup, as shown by the log.

Related Topics

“List of Available Appliance Services” on page 256

“Required Service Ports” on page 258

Viewing Service Logs (CLI)

You cannot view service logs from the CLI. Use the BUI as described in “Viewing

Service Logs (BUI)” on page 254 .

Appliance Services 255

Viewing Service Logs (CLI)

List of Available Appliance Services

This section lists the available appliance services, along with short descriptions and port information. Certain services are always on and cannot be disabled, as described in the following table.

TABLE 46

Service

NFS

iSCSI

SMB

FTP

HTTP

NDMP

Remote Replication

Shadow Migration

SFTP

SRP

TFTP

Virus Scan

Data Services

Description

Filesystem access via the NFSv3, NFSv4.0, and NFS v4.1

protocols

LUN access via the iSCSI protocol

Filesystem access via the SMB protocol

Filesystem access via the FTP protocol

Filesystem access via the HTTP protocol

NDMP host service

Remote replication

Shadow data migration

Filesystem access via the SFTP protocol

Block access via the SRP protocol

Filesystem access via the TFTP protocol

Filesystem virus scanning

Ports Used

111 and 2049

3260 and

3205

SMB-over-

NetBIOS 139

SMB-over-

TCP 445

NetBIOS

Datagram 138

NetBIOS

Name Service

137

21

80

10000

216 and 217

218

Note -

UIDs and GIDs from 0 to 99 are reserved by the operating system vendor for use in future applications. Their use by end-system users or vendors of layered products is not supported and may cause security-related issues with future applications.

TABLE 47

Service

NIS

Directory Services

Description

Authenticate users and groups from an NIS service.

Ports Used

256 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing Service Logs (CLI)

Service

LDAP

Active Directory

Identity Mapping

Description

Authenticate users and groups from an LDAP directory.

Authenticate users with a Microsoft Active Directory Server.

Note -

Once enabled, this becomes an always-on service, and cannot be disabled.

Map between Windows entities and UNIX IDs.

Note -

Always-on service, cannot be disabled.

Ports Used

389

TABLE 48

Service

DNS

Dynamic Routing

IPMP

Kerberos

NTP

Phone Home

Service Settings

Description

Domain name service client

Note -

Always-on service, cannot be disabled.

RIP and RIPng dynamic routing protocols

IP Multipathing for IP fail-over

Note -

Always-on service, cannot be disabled.

Kerberos authentication

Network time protocol client

Product registration and support configuration

Service Tags

SMTP

SNMP

Syslog

System Identity

Ports Used

53

Product inventory support

Configure outgoing mail server

Note -

Always-on service, cannot be disabled.

SNMP for sending traps on alerts and serving appliance status information

Syslog Relay for sending syslog messages on alerts and forwarding service syslog messages

System name and location

Note -

Always-on service, cannot be disabled.

88

8000 (It depends on the port opened up in the proxy)

6481

TABLE 49

Service

SSH

REST

Remote Access Services

Description

SSH for CLI access

RESTful API

Ports Used

22

Appliance Services 257

Configuring Services

Service Description

Note -

Always-on service, cannot be disabled.

Ports Used

Required Service Ports

To provide security on a network, you can deploy firewalls within your network architecture.

Port numbers are used for creating firewall rules and to uniquely identify a transaction over a network by specifying the host and the service.

The following list shows the minimum ports required for creating firewall rules that allow full functionality of the appliance:

Inbound Ports icmp/0-65535 (PING) tcp/1920 (EM) tcp/215 (BUI) tcp/22 (SSH) udp/161 (SNMP)

Outbound Ports tcp/80 (WEB) tcp/443 (SSL WEB)

Note -

An outbound port of tcp/443 is used for sending Phone Home messages, uploading support bundles, and update notifications. For replication, use Generic Routing Encapsulation

(GRE) tunnels when possible. This lets traffic run on the back end interfaces and avoid the firewall where traffic could be slowed. If GRE tunnels are not available on the NFS core, you must run replication over the front end interface. In this case, port 216 and port 217 must also be open.

Configuring Services

For information about configuring a service, select one of the services from the following table:

Data Services

NFS

Directory Services

NIS

System Settings

DNS

Remote Access

SSH

258 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Services

Data Services

iSCSI

SMB

FTP

HTTP

NDMP

Remote Replication

Shadow Migration

SFTP

SRP

TFTP

Virus Scan

Directory Services

LDAP

Active Directory

Identity Mapping

System Settings

IPMP

NTP

Phone Home

Dynamic Routing

Service Tags

SMTP

SNMP

Syslog

System Identity

Kerberos

Related Topics

“List of Available Appliance Services” on page 256

Remote Access

RESTful API

NFS Configuration

Network File System (NFS) is an industry standard protocol to share files over a network.

The Oracle ZFS Storage Appliance supports NFS versions 2, 3, 4.0 and 4.1. For more information on how the filesystem namespace is constructed, see

“Working with Filesystem

Namespace” on page 436 . For information about NFS with local users, see

“Configuring

Users” on page 202 .

Caution -

To prevent loss of NFS service, as well as data loss, do not mount NFS filesystems using private interfaces.

To configure NFS, see the following sections:

“NFS Service Properties” on page 260

“Configuring Kerberos Realms for NFS” on page 261

“NFS Logs and Analytics” on page 262

“NFS Properties” on page 262

“NFS Naming Service Dependencies” on page 263

“Sharing a Filesystem Over NFS” on page 264

Appliance Services 259

Configuring Services

NFS Service Properties

The following NFS Service properties are available in Configuration > Services. Note that

NFSv4 is also known as NFSv4.0.

Minimum supported version - Use this drop-down list to control which versions of NFS the appliance supports.

Maximum supported version - Use this drop-down list to control which versions of NFS the appliance supports.

Note -

Setting the NFS minimum and maximum versions to the same value causes the appliance to only communicate with clients using that version. This may be useful if you find an issue with one NFS version or the other (such as the performance characteristics of an NFS version with your workload), and you want to force clients to only use the version that works best.

Maximum # of server threads - Define the maximum number of concurrent NFS requests

(from 20 to 1000). This should at least cover the number of concurrent NFS clients that you anticipate. The default value is 500.

Grace period - Define the number of seconds that all clients have to recover locking state after an appliance reboot (from 15 to 600 seconds) from an unplanned outage. This property affects only NFSv4.0 and NFSv4.1 clients (NFSv3 is stateless so there is no state to reclaim). During this period, the NFS service only processes reclaims of the old locking state. No other requests for service are processed until the grace period is over. The default grace period is 90 seconds. Reducing the grace period lets NFS clients resume operation more quickly after a server reboot, but increases the probability that a client cannot recover all of its locking state. The Oracle ZFS Storage Appliance provides grace-less recovery of the locking state for NFSv4.0 and NFSv4.1 clients during planned outages. Planned outages occur during events such as updates and appliance reboot using the CLI maintenance system reboot

command or the BUI power icon . For planned outages, the NFS service processes all requests for service without incurring the grace period delay.

Custom NFSv4 identity domain - Use this property to define the domain for mapping NFSv4.0 and NFSv4.1 users and group identities. If you do not set this property, the appliances uses DNS to obtain the identity domain, first by checking for a

_nfsv4idmapdomain

DNS resource record, and then by falling back to the DNS domain itself.

Use NFSv4 numeric id strings - Use this property to allow NFSv4.0 and NFSv4.1 clients to use numeric strings for user and group IDs. If you do not set this property, user and group

IDs are exchanged in the form of [email protected], the default. This property applies only when the authentication type is AUTH_SYS. The CLI property is use_numeric_ids.

260 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Services

Enable NFSv4 delegation - Select this property to allow clients to cache files locally and make modifications without contacting the server. This option is enabled by default and typically results in better performance; but in rare circumstances it can cause problems. You should only disable this setting after careful performance measurements of your particular workload and after validating that the setting has a measurable performance benefit. This option only affects NFSv4.0 and NFSv4.1 mounts.

Mount visibility - This property lets you limit the availability of information about share access lists and remote mounts from NFS clients. Full allows full access. Restricted restricts access such that a client can see only the shares which it is allowed to access. A client cannot see access lists for shares defined at the server or remote mounts from the server done by other clients. The property is set to Full by default.

Oracle Intelligent Storage Protocol - The NFSv4.0 and NFSv4.1 services include support for the Oracle Intelligent Storage Protocol, which lets Oracle Database NFSv4.0

and NFSv4.1 clients pass optimization information to the ZFS Storage Appliance

NFSv4.0 and NFSv4.1 server. For more information, see “Oracle Intelligent Storage

Protocol” on page 678 .

Related Topics

“NFS Properties” on page 262

Setting Service Properties

BUI ,

CLI

.

Configuring Kerberos Realms for NFS

Configuring a Kerberos realm creates certain service principals and adds the necessary keys to the system's local keytab. The NTP service must be configured before configuring Kerberized

NFS. The following service principals are created and updated to support Kerberized NFS: host/[email protected]

nfs/[email protected]

If you clustered your appliances, principals and keys are generated for each cluster node: host/[email protected]

nfs/[email protected]

host/[email protected]

nfs/[email protected]

If these principals have already been created, configuring the realm resets the password for each of those principals.

For information on setting up KDCs and Kerberized clients, see Oracle Solaris 11.1

Administration: Security Services (http://docs.oracle.com/cd/E26502_01/html/

E29015/index.html

) . For information about the appliance Kerberos service, see

“Kerberos

Appliance Services 261

Configuring Services

Configuration” on page 343 . After configuring Kerberos, change the Security mode on the

Shares->Filesystem->Protocols screen to a mode using Kerberos.

Note -

Kerberized NFS clients must access the appliance using an IP address that resolves to an FQDN for those principals. For example, if an appliance is configured with multiple

IP addresses, only the IP address that resolves to the appliance's FQDN can be used by its

Kerberized NFS clients.

NFS Logs and Analytics

These logs are available for the NFS service:

TABLE 50

Logs Available for NFS

Log

network-nfs-server:default appliance-kit-nfsconf:default network-nfs-cbd:default network-nfs-mapid:default network-nfs-status:default network-nfs-nlockmgr:default

Description

Master NFS server log

Log of appliance NFS configuration events

Log for the NFSv4.0 and NFSv4.1 callback daemon

Log for the NFSv4.0 and NFSv4.1 mapid daemon which maps NFSv4.0 and NFSv4.1 user and group credentials

Log for the NFS statd daemon - which assists crash and recovery functions for NFS locks

Log for the NFS lockd daemon - which supports record locking operations for files

You can monitor NFS activity in the Analytics section. This includes:

NFS operations per second

... by type of operation (read/write/...)

... by share name

... by client hostname

... by accessed filename

... by access latency

NFS Properties

The following table describes the mapping between CLI properties and the BUI property descriptions above.

262 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Services

Caution -

To prevent loss of NFS service, as well as data loss, do not mount NFS filesystems using private interfaces.

TABLE 51

CLI Property

version_min version_max nfsd_servers grace_period mapid_domain use_numeric_ids enable_delegation mount_visibility

NFS Properties

BUI Property

Minimum supported version

Maximum supported version

Maximum # of server threads

Grace period

Custom NFSv4 and NFSv4.1 identity domain

Use NFSv4 and NFSv4.1 numeric string ids

Enable NFSv4 and NFSv4.1 delegation

Client share information restriction level

NFS Naming Service Dependencies

Naming services, such as DNS, NIS, and LDAP, are used by the appliance to resolve host names and corresponding IP addresses, user identities, and Analytics statistics. This topic describes NFS naming service dependencies and resulting problems if naming services are not configured for the appliance.

NFS depends on information from each of the following naming services:

TABLE 52

NFS Naming Service Dependencies

Description Service

IP address and corresponding host name of NFS clients and servers DNS

User identity number and corresponding user name

Group identity number and corresponding group name

Clients belonging to netgroups

NIS/LDAP

NIS/LDAP

NIS/LDAP

If the appliance is unable to access any DNS network servers or DNS mappings are unpopulated, the following problems can occur:

Filesystem mount failure

Client is denied access to NFS shares after the filesystem has been successfully mounted

Client receives "weak authentication" errors

Appliance Services 263

Sharing a Filesystem Over NFS

NFS server unresponsive

User and group lookup failures, using either NFSv3 or NFSv4, as listed in the following table.

NFS Version

NFSv3 or NFSv4

NFSv4

NFSv4

NFSv4

NFSv4

Problem

Cannot access particular files or directories when the user is a member of 16 or more groups.

Cannot retrieve ownership information (users and groups might be shown as nobody).

Cannot change ownership of files.

Cannot retrieve ACL information.

Cannot change ACLs, including inability to change entries unrelated to the affected entries.

Setting

Set the "Use NFSv4 numeric id strings" option.

On the client, set the equivalent of the "Use NFSv4 numeric id strings" option.

Set the "Use NFSv4 numeric id strings" option.

Set the "Use NFSv4 numeric id strings".

On the client, set the equivalent of the "Use NFSv4 numeric id strings" option.

Related Topics

“DNS Configuration” on page 335

“DNS-Less Operation” on page 342

Sharing a Filesystem Over NFS

1.

2.

Go to Configuration > Services.

Check that the NFS service is enabled and online. If not, enable the service.

Caution -

To prevent loss of NFS service, as well as data loss, do not mount NFS filesystems using private interfaces.

3.

4.

Go to the Shares screen and edit an existing share or create a new share.

Click the Protocols tab of the share you are editing and check that NFS sharing is enabled.

You can also configure the NFS share mode (read/read+write) in this screen.

264 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Sharing a Filesystem Over NFS

iSCSI Configuration

When you configure a LUN on the appliance you can export that volume over an Internet Small

Computer System Interface (iSCSI) target. The iSCSI service allows iSCSI initiators to access targets using the iSCSI protocol.

The service supports discovery, management, and configuration using the iSNS protocol. The iSCSI service supports both unidirectional (target authenticates initiator) and bidirectional

(target and initiator authenticate each other) authentication using CHAP. Additionally, the service supports CHAP authentication data management in a RADIUS database.

The system performs authentication first, and authorization second, in two independent steps.

Note -

For examples of configuring iSCSI initiators and targets, see

“Configuring Storage Area

Network (SAN)” on page 170 .

TABLE 53

iSCSI Service Properties

Property

Use iSNS iSNS Server

Use RADIUS

RADIUS Server

RADIUS Server Secret

Description

Whether iSNS discovery is enabled

An iSNS server

Whether RADIUS is enabled

A RADIUS server

The RADIUS server's secret

If the local initiator has a CHAP name and a CHAP secret, the system performs authentication.

If the local initiator does not have the CHAP properties, the system does not perform any authentication and therefore all initiators are eligible for authorization.

The iSCSI service allows you to specify a global list of initiators that you can use within initiator groups.

If your initiator cannot connect to your target:

Make sure the IQN of the initiator matches the IQN identified in the initiators list.

Check that IP address of iSNS server is correct and that the iSNS server is configured.

Check that the IP address of the target is correct on the initiator side.

Check that initiator CHAP names and secrets match on both sides.

Make sure that the target CHAP name and secret do not match those of any of the initiators.

Check that the IP address and secret of the RADIUS server are correct, and that the

RADIUS server is configured.

Appliance Services 265

Sharing a Filesystem Over NFS

Check that the initiator accessing the LUN is a member of that LUN's initiator group.

Check that the targets exporting that LUN are online.

Check that the LUN's operational status is online.

Check the logical unit number for each LUN.

If, during the failover / failbacks, the iSER Reduced Copy I/Os from the Red Hat client are not surviving, modify the node.session.timeo.replacement_timeout parameter in the /etc/ iscsi/iscsid.conf

file to 300sec.

Related Topics

Setting Service Properties BUI ,

CLI

SMB Configuration

The SMB service provides access to filesystems using the SMB protocol. The supported SMB versions are: SMB 1, SMB 2.0, SMB 2.1, and SMB 3.0. To share filesystems over SMB, configure the filesystem as described in

“Filesystem Properties” on page 420

. The following tables show the supported and unsupported features for SMB 3.0 and SMB 2.1.

TABLE 54

SMB 3.0 Supported and Unsupported Features

SUPPORTED FEATURES

Transparent failover (Continuously Available shares)

Multichannel

UNSUPPORTED FEATURES

Encryption

SMB over Remote Direct Memory Access (RDMA)

Volume Shadow Copy Service (VSS) for SMB filesystems

Directory leasing

TABLE 55

SMB 2.1 Supported and Unsupported Features

SUPPORTED FEATURES

Lease

Multi-protocol negotiate request

Individual write-through operations

Multi-credit operations

UNSUPPORTED FEATURES

Branch cache

Resilient handles

Local accounts and user IDs are mapped to Windows user IDs. Note that the guest account is a special, read-only account and cannot be configured for read/write in the appliance.

266 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Sharing a Filesystem Over NFS

To configure SMB, see the following sections:

“SMB Service Properties” on page 267

“Setting Properties to Export Shares over SMB” on page 269

“NFS/SMB Interoperability” on page 269

“SMB DFS Namespaces” on page 270

“SMB Microsoft Stand-alone DFS Namespace Management Tools Support

Matrix” on page 270

“Adding DFS Namespaces to a Local SMB Group” on page 272

“SMB Autohome” on page 273

“Adding SMB Autohome Rules (CLI)” on page 273

“Adding a User to an SMB Local Group” on page 275

“SMB MMC Integration” on page 275

“SMB Share Management” on page 277

“SMB Users, Groups, and Connections” on page 279

“Listing SMB Services” on page 280

“Configuring SMB (BUI)” on page 282

“Configuring SMB Active Directory (BUI)” on page 284

“Configuring SMB Project and Share (BUI)” on page 284

“Configuring SMB Data Service (BUI)” on page 285

SMB Service Properties

Changing service properties is documented in “Setting Service Properties

(BUI)” on page 252

and

“Setting Service Properties (CLI)” on page 253

.

Minimum supported version - Choose the minimum version of SMB that the appliance supports.

Maximum supported version - Choose the maximum version of SMB that the appliance supports.

System comment - Meaningful text string.

Idle Session timeout - Timeout setting for session inactivity.

Preferred domain controller - The preferred domain controller to use when joining an

Active Directory domain. If this controller is not available, Active Directory will rely on

DNS SRV records and the Active Directory site to locate an appropriate domain controller.

For more information, see

“Active Directory Configuration” on page 318

.

Active Directory site - The site to use when joining an Active Directory domain. A site is a logical collection of machines which are all connected with high bandwidth, low latency

Appliance Services 267

Sharing a Filesystem Over NFS

■ network links. When this property is configured and the preferred domain controller is not specified, joining an Active Directory domain will prefer domain controllers located in this site over external domain controllers.

Maximum # of server threads - The maximum number of simultaneous server threads

(workers). Default is 1024.

Enable Dynamic DNS - Choose whether the appliance will use Dynamic DNS to update

DNS records in the Active Directory domain. Default is off.

Enable oplocks - Choose whether the appliance will grant opportunistic locks to SMB clients. This will improve performance for most clients. Default is on. The SMB server grants an oplock to a client process so that the client can cache data while the lock is in place. When the server revokes the oplock, the client flushes its cached data to the server.

Restrict anonymous access to share list - If this option is enabled, clients must authenticate to the SMB service before receiving a list of shares. If disabled, anonymous clients may access the list of shares.

Primary WINS server - Primary WINS address configured in the TCP/IP setup.

Secondary WINS server - Secondary WINS address configured in the TCP/IP setup.

Excluded IP addresses from WINS - IP addresses excluded from registration with WINS.

LAN Manager compatibility level - Authentication modes supported (LM, NTLM, LMv2,

NTLMv2). For more information on the supported authentication modes within each compatibility level, consult the Oracle Solaris Information Library for smb. NTLMv2 is the recommended minimum security level to avoid publicly known security vulnerabilities.

SMB signing enabled - Enables interoperability with SMB clients using the SMB signing feature. If a packet has been signed, the signature will be verified. If a packet has not been signed it will be accepted without signature verification (if SMB signing is not required see below).

SMB signing required - When SMB signing is required, all SMB packets must be signed or they will be rejected, and clients that do not support signing will be unable to connect to the server.

Ignore zero VC - When an SMB client establishes a new connection, it may request that the appliance clean up all previous connections and file locks from this client by specifying a Virtual Circuit (VC) number of zero. This protocol artifact however, does not respect network address translation (NAT) for clients or multiple DNS entries assigned to the same host. In combination, zero VC requests between masked or redundant network locations may result in unrelated active connections being reset. By default, zero VC requests are honored to prevent stale file locking, however if SMB sessions are being disconnected in error, ignoring zero VC requests may resolve the issue.

Share visibility - Use this property to set the access-based enumeration (ABE) policy for displaying available shares to clients. Valid values are "Full" and "Restricted." While "Full" allows full access, "Restricted" limits access to only shares that the client is allowed to see.

Access to shares is determined by the SMB exceptions and the share's ACL. This property is set to "Full" by default.

268 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Sharing a Filesystem Over NFS

Setting Properties to Export Shares over SMB

Several share properties must be set in certain ways when exporting a share over SMB.

TABLE 56

Property

Case Sensitivity

SMB Share Properties

Reject non UTF-8

Non-Blocking Mandatory Locking

Resource name

Share-level ACL

Description

SMB clients expect case-insensitive behavior, so this property must be "mixed'" or "'insensitive". See

“Static

Properties” on page 411

.

If non-UTF-8 filenames are allowed in a filesystem,

SMB clients may function incorrectly. See

“Static

Properties” on page 411

.

This property must be enabled to allow byte range locking to function correctly. See

“Static

Properties” on page 411

.

The name by which clients refer to the share.

For information about how this name is inherited from a project, see

“Share and Project

Protocols” on page 439

.

An ACL which adds another layer of access control beyond the ACLs stored in the filesystem. For more information on this property, see

“Access Control Lists for Filesystems” on page 453

.

The case sensitivity and reject non UTF-8 properties can only be set when creating a share.

No two SMB shares on the same system may share the same resource name. Resource names inherited from projects have special behavior. For details, see

“Shares and

Projects” on page 381 . Resource names must be less than 80 characters, and can contain any

alphanumeric characters besides the following characters:

" / \ [ ] : | < > + ; , ? * =

When access-based enumeration is enabled, clients may see directory entries for files which they cannot open. Directory entries are filtered only when the client has no access to that file.

For example, if a client attempts to open a file for read/write access but the ACL grants only read access, that open request will fail but that file will still be included in the list of entries.

NFS/SMB Interoperability

The appliance supports NFS and SMB clients accessing the same shares concurrently. To correctly configure the appliance for NFS/SMB interoperability, you must configure the following components:

Appliance Services 269

Sharing a Filesystem Over NFS

Configure the Active Directory service. See “Active Directory

Configuration” on page 318

.

Establish an Identity Mapping strategy and configure the service. See

“Identity Mapping

Configuration” on page 324

.

Configure SMB. See

“SMB Configuration” on page 266 .

Configure access control, ACL entries, and ACL inheritance on shares.

SMB and NFSv3 do not use the same access control model. For best results, configure the

ACL on the root directory from a SMB client as the SMB access control model is a more verbose model. For information on inheritable trivial ACL entries, see

“Access Control Lists for

Filesystems” on page 453 .

SMB DFS Namespaces

The Distributed File System (DFS) is a virtualization technology delivered over the SMB and

MSRPC protocols. DFS allows administrators to group shared folders located on different servers by transparently connecting them to one or more DFS namespaces. A DFS namespace is a virtual view of shared folders in an organization. An administrator can select which shared folders to present in the namespace, design the hierarchy in which those folders appear and determine the names that the shared folders show in the namespace. When a user views the namespace, the folders appear to reside in a single, high-capacity file system. Users can navigate the folders in the namespace without needing to know the server names or shared folders hosting the data.

Only one share per system may be provisioned as a standalone DFS namespace. Domain-based

DFS namespaces are not supported. Note that one DFS namespace may be provisioned per cluster, even if each cluster node has a separate storage pool. To provision a SMB share as a

DFS namespace, use the DFS Management MMC Snap-in to create a standalone namespace.

When the appliance is not joined to an Active Directory domain, additional configuration is necessary to allow Workgroup users to modify DFS namespaces. To enable an SMB local user to create or delete a DFS namespace, that user must have a separate local account created on the server. For information about steps to let the SMB local user dfsadmin manipulate DFS

namespaces, see “Adding DFS Namespaces to a Local SMB Group” on page 272

.

SMB Microsoft Stand-alone DFS Namespace Management

Tools Support Matrix

The following table lists operations (subcommands/options) of the Microsoft DFS tools on various Windows operating system versions. It identifies which of these are supported by the

DFS service on the appliance for managing a standalone DFS namespace on the appliance.

270 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Sharing a Filesystem Over NFS

y - supported

n - not supported

NA - not applicable

Microsoft Windows systems XP|2003|2003|Vista|2008|2008|Win7|

| | R2| | | R2| |

SP3| SP2| SP2| SP2| SP2| SP1| SP1|

| | | | | | | dfscmd CLI: | | | | | | |

| | | | | | |

/map [comment] [/restore] y| y| y| y| y| y| y|

/unmap y| y| y| y| y| y| y|

/add [/restore] y| y| y| y| y| y| y|

/remove y| y| y| y| y| y| y|

/view [/partial | /full] y| y| y| y| y| y| y|

| | | | | | |

| | | | | | | dfsutil CLI (old format): | | | | | | |

| | | | | | |

/addstdroot [/comment] y| y| y| n| n| y| y|

/remstdroot y| y| y| n| n| y| y|

/root:<DfsName> /view n| n| n| y| y| y| y|

/addlink [/comment] NA| NA| NA| y| y| y| y|

/removelink NA| NA| NA| y| y| y| y|

/state /display NA| NA| NA| y| y| y| y|

/state /enable NA| NA| NA| y| y| y| y|

/state /disable NA| NA| NA| y| y| y| y|

/ttl /display NA| NA| NA| y| y| y| y|

/ttl /set NA| NA| NA| y| y| y| y|

/server:<MachineName> /view y| y| y| y| y| y| y|

| | | | | | |

| | | | | | | dfsutil CLI (new format): | | | | | | |

| | | | | | | root addstd [comment] NA| NA| NA| n| n| y| y| root remove NA| NA| NA| n| n| y| y| root (view namespace) NA| NA| NA| y| y| y| y| link add [comment] NA| NA| NA| y| y| y| y| link remove NA| NA| NA| y| y| y| y| link (view) NA| NA| NA| y| y| y| y| target add NA| NA| NA| y| y| y| y| target remove NA| NA| NA| y| y| y| y| target (view) NA| NA| NA| y| y| y| y| property comment (view) NA| NA| NA| y| y| y| y| property comment set NA| NA| NA| y| y| y| y| property ttl (view) NA| NA| NA| y| y| y| y| property ttl set NA| NA| NA| y| y| y| y|

Appliance Services 271

Adding DFS Namespaces to a Local SMB Group property state (view) NA| NA| NA| y| y| y| y| property state offline NA| NA| NA| y| y| y| y| property state online NA| NA| NA| y| y| y| y|

| | | | | | |

| | | | | | |

DFS GUI: | | | | | | |

| | | | | | | add standalone root y| y| y| n| n| n| n| remove standalone root y| y| y| n| n| n| n| change root comment y| y| y| n| n| n| n| change root timeout y| y| y| n| n| n| n| add link y| y| y| n| n| n| n| remove link y| y| y| n| n| n| n| change link comment y| y| y| n| n| n| n| change link timeout y| y| y| n| n| n| n| add link's target y| y| y| n| n| n| n| remove link's target y| y| y| n| n| n| n| enable link's referral (target) y| y| y| n| n| n| n| disable link's referral (target) y| y| y| n| n| n| n| hide root y| y| y| y| y| y| y| show root y| y| y| y| y| y| y| display links y| y| y| n| n| n| n| display targets y| y| y| n| n| n| n|

XP|2003|2003|Vista|2008|2008|Win7|

| | R2| | | R2| |

SP3| SP2| SP2| SP2| SP2| SP1| SP1|

Note that:

Oracle Solaris does not verify the DFS link target.

CLI commands for modifying and viewing comment and timeout (TTL) are applicable to both root and link.

CLI commands for viewing state are applicable to root, root's target, link, and link's target.

CLI commands for modifying state are only applicable for link and link's target.

1.

2.

3.

Adding DFS Namespaces to a Local SMB Group

Create a local user account on the server for user dfsadmin. Be sure to use the same password as when the local user was first created on the Windows machine.

Add dfsadmin to the local SMB group Administrators.

Log in as dfsadmin on the Windows machine from which the DFS namespace will be modified.

272 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding SMB Autohome Rules (CLI)

SMB Autohome

For Windows file sharing, Autohome provides access to filesystems using the SMB protocol.

Autohome defines and maintains home directory shares for users that access the system through

SMB. Autohome rules map SMB clients to home directories.

FIGURE 20

Setting Autohome Rules

Use Name Service Switch - Toggles Name Service Switch (NSS) on or off. You cannot create an NSS rule and an rule for all users at the same time.

AD Container - Sets the Active Directory container, for example: dc=com,dc=fishworks, ou=Engineering,CN=myhome.

User - Sets the Autohome rule for all All users or for the user you specify. When you specify a user, the wildcards "&" and "?" refer to a user's login and its corresponding first character.

Directory - Sets the directory for the rule, for example: /export/wdp.

1.

Adding SMB Autohome Rules (CLI)

Go to configuration services smb.

Appliance Services 273

Adding SMB Autohome Rules (CLI)

2.

3.

Use the create command to add autohome rules, and the list command to list existing rules.

This example adds a rule for the user "Bill" then lists the rules: hostname:> configuration services smb hostname:configuration services smb> create hostname:configuration services rule (uncommitted)> set use_nss=false hostname:configuration services rule (uncommitted)> set user=Bill hostname:configuration services rule (uncommitted)> set directory=/export/wdp hostname:configuration services rule (uncommitted)> set container="dc=com,dc=fishworks,

ou=Engineering,CN=myhome"

hostname:configuration services rule (uncommitted)> commit hostname:configuration services smb> list

RULE NSS USER DIRECTORY CONTAINER rule-000 false Bill /export/wdp dc=com,dc=fishworks,

ou=Engineering,CN=myhome

Create Autohome rules using wildcard characters.

The & character matches the users' username, and the ? character matches the first letter of the users' username. The following uses wildcards to match all users:

4.

hostname:configuration services smb> create hostname:configuration services rule (uncommitted)> set use_nss=false hostname:configuration services rule (uncommitted)> set user=* hostname:configuration services rule (uncommitted)> set directory=/export/?/& hostname:configuration services rule (uncommitted)> set container="dc=com,dc=fishworks,

ou=Engineering,CN=myhome"

hostname:configuration services rule (uncommitted)> commit hostname:configuration services smb> list

RULE NSS USER DIRECTORY CONTAINER rule-000 false Bill /export/wdp dc=com,dc=fishworks,

ou=Engineering,CN=myhome

The name service switch can also be used to create autohome rules:

hostname:configuration services smb> create hostname:configuration services rule (uncommitted)> set use_nss=true hostname:configuration services rule (uncommitted)> set container="dc=com,dc=fishworks,

ou=Engineering,CN=myhome"

hostname:configuration services rule (uncommitted)> commit hostname:configuration services smb> list

RULE NSS USER DIRECTORY CONTAINER rule-000 true dc=com,dc=fishworks,

ou=Engineering,CN=myhome

274 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a User to an SMB Local Group

1.

2.

3.

4.

5.

Adding a User to an SMB Local Group

Local groups are groups of domain and/or local users that grant additional privileges to those users.

SMB Local Groups:

Administrators - Administrators can bypass file permissions to change the ownership on files.

Backup Operators - Backup Operators can bypass file access controls to backup and restore files.

Go to configuration services smb groups.

hostname:configuration services smb> groups

Enter create.

hostname:configuration services smb groups> create

Specify the user you want to add to the group:

hostname:configuration services smb member (uncommitted)> set user=Bill

Enter the group name, and then commit the change:

hostname:configuration services smb member (uncommitted)> set group="Backup Operators" hostname:configuration services smb member (uncommitted)> commit

Enter list to confirm the user was added to the specified group:

hostname:configuration services smb groups> list

MEMBER USER GROUP member-000 WINDOMAIN\Bill Backup Operators

SMB MMC Integration

The Microsoft Management Console (MMC) is an extensible framework of registered components, known as snap-ins, that provide comprehensive management features for both the local system and remote systems on the network. Computer Management is a collection of

Microsoft Management Console tools, that may be used to configure, monitor and manage local and remote services and resources.

In order to use the MMC functionality on the Oracle ZFS Storage Appliance in workgroup mode, be sure to add the Windows administrator who will use the management console to the

Appliance Services 275

Adding a User to an SMB Local Group

Administrators local group on the appliance. Otherwise you may receive an Access is denied or similar error on the administration client when attempting to connect to the appliance using the MMC.

The Oracle ZFS Storage Appliance supports the following Computer Management facilities:

The Event Viewer MMC snap-in displays the Application log, Security log, and System log.

These logs show the contents of the alert, audit, and system logs of the Oracle ZFS Storage system.

The following screen shows an example of the Application log and the properties dialog for an error event.

276 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

FIGURE 21

SMB Event Viewer

Adding a User to an SMB Local Group

SMB Share Management

Support for share management includes the following:

Listing shares

Setting ACLs on shares

Changing share permissions

Setting the description of a share

Appliance Services 277

Adding a User to an SMB Local Group

Features not currently supported via MMC include the following:

Adding or Deleting a share

Setting client side caching property

Setting maximum allowed or number of users property

The following screen shows an example of permission properties for a share.

FIGURE 22

SMB Share Permission Properties

278 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding a User to an SMB Local Group

SMB Users, Groups, and Connections

The following features are supported:

Viewing local SMB users and groups

Listing user connections, including listing the number of open files per connection

Closing user connections

Listing open files, including listing the number of locks on the file and file open mode

Closing open files

The following screen shows an example of open files per connection.

FIGURE 23

Open Files per Connection

The following screen shows an example of open sessions.

Appliance Services 279

Adding a User to an SMB Local Group

FIGURE 24

Open Sessions

Listing SMB Services

Listing of appliance services is supported using the MMC application. However, you cannot enable or disable services using the MMC application. Support includes listing of appliance services. Services cannot be enabled or disabled using the Computer Management MMC application.

The following screen shows an example of General properties for the vscan Service.

280 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

FIGURE 25

vscan Properties

Adding a User to an SMB Local Group

To ensure that only the appropriate users have access to administrative operations, there are some access restrictions on the operations performed remotely using MMC.

Appliance Services 281

Configuring SMB (BUI)

TABLE 57

Users and Allowed Operations

User

Regular users

Members of the Administrators or Power Users groups

Members of the Administrators group

Allowed Operations

List shares.

Manage shares, list user connections.

List open files and close files, disconnect user connections, view services and event log.

Configuring SMB (BUI)

1.

2.

3.

Initial configuration of the appliance may be completed using the BUI or the CLI and should take less than 20 minutes. Initial Setup may also be performed again later using the

Maintenance > System contexts of the BUI or CLI. Initial configuration takes you through the following steps.

Configure Network Devices, Datalinks, and Interfaces.

a.

Create interfaces using the Datalink add or Interface icons or by using drag-and-drop of devices to the datalink or interface lists.

b. Set the desired properties and click the Apply button to add them to the list.

c. Set each interface to active or standby as appropriate.

d. Click APPLY at the top of the page to commit your changes.

Configure DNS.

a. Provide the base domain name.

b. Provide the IP address of at least one server that is able to resolve hostname and server records in the Active Directory portion of the domain namespace.

Configure NTP authentication keys to ensure clock synchronization.

a.

Click the icon to add a new key.

b. Specify the number, type, and private value for the new key and apply the changes.

282 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SMB (BUI)

4.

5.

6.

The key appears as an option next to each specified NTP server.

c.

Associate the key with the appropriate NTP server and apply the changes.

To ensure clock synchronization, configure the appliance and the SMB clients to use the same NTP server.

Specify Active Directory as the directory service for users and groups.

a. Set the directory domain.

b. Click APPLY to commit your changes.

Configure a storage pool.

a.

Click the icon to add a new pool.

b. Set the pool name.

c. On the Allocate and verify storage screen, configure the disk shelf allocation for the storage pool.

If no disk shelves are detected, check your disk shelf cabling and power.

d.

Click COMMIT to advance to the next screen.

e.

On the Configure Added Storage screen, select the desired data profile.

Each is rated in terms of availability, performance and capacity. Use these ratings to determine the best configuration for your business needs.

f. Click COMMIT to activate the configuration.

Configure Remote Support.

a. If the appliance is not directly connected to the Internet, configure an HTTP proxy through which the remote support service may communicate with

Oracle.

b. Enter your Online Account user name and password.

A privacy statement will be displayed for your review.

c. Choose which of your inventory teams to register with.

Appliance Services 283

Configuring SMB Active Directory (BUI)

The default team for each account is the same as the account user name, prefixed with a '$'.

d. Commit your initial configuration changes.

Configuring SMB Active Directory (BUI)

1.

2.

3.

4.

Create an account for the appliance in the Active Directory domain.

For detailed instructions, refer to

“Active Directory Configuration” on page 318

.

On the Configuration > Services > Active Directory screen, click the Join Domain button.

Specify the Active Directory domain, administrative user, administrative password.

Click APPLY to commit the changes.

Configuring SMB Project and Share (BUI)

1.

2.

Go to Shares > Shares.

Create a project.

a.

On the Shares screen, click the panel open icon to expand the Projects panel.

b.

Click the add icon to add a new project.

c. Specify the project name and click APPLY.

Select the new project from the Projects panel.

3.

4.

Click the add item icon to add a filesystem.

5.

6.

Click the edit icon for the filesystem.

Click the General tab and deselect the Inherit from project checkbox.

284 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SMB Data Service (BUI)

7.

8.

9.

10.

Choose a mountpoint under /export, even though SMB shares are accessed by resource name, and click APPLY.

Click the Protocols tab for the project and set the SMB resource name to on.

Enable sharesmb and share-level ACL for the Project.

Click APPLY to activate the configuration.

Configuring SMB Data Service (BUI)

1.

2.

3.

4.

Go to Configuration > Services > SMB and click the power icon to enable the service.

Set SMB properties and click APPLY to activate the configuration. See “SMB

Service Properties” on page 267 .

Click the Autohome tab on the Configuration > Services > SMB screen to set autohome rules to map SMB clients to home directories as described in

“SMB

Autohome” on page 273

. Click APPLY to activate the configuration.

Click the Local Groups tab on the Configuration > Services > SMB screen and use the add item icon to add administrators or backup operator users to local

groups as described in “Adding a User to an SMB Local Group” on page 275

. a

Click APPLY to activate the configuration.

FTP Configuration

The FTP (File Transfer Protocol) service allows filesystem access from FTP clients.

Anonymous logins are not allowed, users must authenticate with whichever name service is configured in Services.

FTP can be used in conjunction with Kerberos authentication. For information about the appliance Kerberos service, see

“Kerberos Configuration” on page 343 .

To configure FTP, use the following sections:

“Adding FTP Access to a Share (BUI)” on page 286

“FTP Properties” on page 286

Appliance Services 285

Adding FTP Access to a Share (BUI)

“FTP Logs” on page 287

Adding FTP Access to a Share (BUI)

1.

2.

3.

4.

5.

Go to Configuration > Services.

Ensure that the FTP service is enabled and online. If not, enable the service.

Select or add a share in the Shares screen.

Click the Protocols tab, and check that FTP access is enabled.

(Optional) Set the Share mode access to Read only or Read/write.

Related Topics

“FTP Properties” on page 286

“FTP Logs” on page 287

FTP Properties

TABLE 58

FTP General Properties

Property

Port for incoming connections

Maximum # of connections ("0" for unlimited)

Turn on delay engine to prevent timing attacks

Default login root

Logging level

Permissions to mask from newly created files and directories

Description

The port on which FTP listens. The default is 21.

This is the maximum number of concurrent FTP connections. Set this to cover the anticipated number of concurrent users. By default this is 30, since each connection creates a system process and allowing too many (thousands) could constitute a DoS attack.

This inserts small delays during authentication to fool attempts at user name guessing via timing measurements.

Turning this on will improve security.

The FTP login location. The default is "/" and points to the top of the shares hierarchy. All users will be logged into this location after successfully authenticating with the FTP service.

The verbosity of the proftpd log.

File permissions to remove when files are created. Group and world write are masked by default, to prevent recent uploads from being writeable by everyone.

286 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding FTP Access to a Share (BUI)

TABLE 59

Property

Enable SSL/TLS

FTP Security Properties

SSL/TLS versions and ciphers

Port for incoming SSL/TLS connections

Permit root login

Maximum # of allowable login attempts

Permit foreign data connection addresses

Description

Allow SSL/TLS encrypted FTP connections. This will ensure that the FTP transaction is encrypted. The default is disabled.

Select the TLS protocol version to use for connecting to the appliance. TLSv1.0 is not enabled by default due to security concerns, but it can be enabled for backward compatibility if needed. Some selected SSL/

TLS protocol versions and/or ciphers will be removed after software upgrades if they are no longer supported in the new software.

The port that the SSL/TLS encrypted FTP service listens on. The default is 21.

Allow FTP logins for the root user. This is off by default, since FTP authentication is plain text which poses a security risk from network sniffing attack.

The number of failed login attempts before an FTP connection is disconnected, and the user must reconnect to try again. The default is 3.

Permits foreign FTP connections to enable direct transfer of files between FTP servers. This property is off by default.

Related Topics

“Adding FTP Access to a Share (BUI)” on page 286

“FTP Logs” on page 287

FTP Logs

TABLE 60

Log

proftpd proftpd_xfer proftpd_tls

FTP Logs

Description

Logs FTP events, including successful logins and unsuccessful login attempts.

File transfer log.

Logs FTP events related to SSL/TLS encryption.

Related Topics

“Adding FTP Access to a Share (BUI)” on page 286

“FTP Properties” on page 286

Appliance Services 287

Adding HTTP Access to a Share (BUI)

HTTP Configuration

The HTTP service provides access to filesystems using the HTTP and HTTPS protocols and

HTTP WebDAV (Web based Distributed Authoring and Versioning). This service allows clients to access shared filesystems through a web browser, or as a local filesystem if supported by the client software. The URL to access these HTTP and HTTPS shares have the following formats respectively: http://hostname/shares/mountpoint/share_name https://hostname/shares/mountpoint/share_name

The HTTPS server uses a self-signed security certificate.

HTTP/HTTPS can be used in conjunction with Kerberos authentication. For information about the appliance Kerberos service, see

“Kerberos Configuration” on page 343 .

For added security when configuring HTTP, you can specify the SSL/TLS versions and ciphers,

as described in “HTTP Properties and Logs” on page 289

.

To configure HTTP, see the following sections:

“Adding HTTP Access to a Share (BUI)” on page 288

“HTTP Properties and Logs” on page 289

“HTTP Authentication and Access Control” on page 290

“HTTP Object Store Configuration” on page 291

Adding HTTP Access to a Share (BUI)

3.

4.

1.

2.

5.

Go to Configuration > Services.

Check that the HTTP service is enabled and online. If not, enable the service.

Select or add a share in the Shares screen.

Click the Protocols tab, and check that HTTP access is enabled.

(Optional) Set the Share mode access to Read only or Read/write.

For HTTP Object Store, set the access to Read/write.

Related Topics

“HTTP Properties and Logs” on page 289

“HTTP Authentication and Access Control” on page 290

288 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding HTTP Access to a Share (BUI)

“HTTP Object Store Configuration” on page 291

HTTP Properties and Logs

TABLE 61

Property

Protocols

HTTP General Properties

HTTP port (for incoming connections)

HTTPS port (for incoming secure connections)

Description

Select which access methods to support: HTTP, HTTPS, or both.

HTTP port. The default is 80.

Secure HTTP port. The default is 443.

TABLE 62

HTTP Security Properties

Property

SSL/TLS versions and ciphers

Description

Select the TLS versions and ciphers for connecting to the appliance. The default settings are TLSv1.1, TLSv1.2

and their associated ciphers. TLSv1.0 is available for backwards compatibility, but is not recommended due to security concerns.

TABLE 63

HTTP Object Store Properties

Property

Enable Object Store

Default Path

Use OpenStack Identity Service

Authentication URI

Role

Tenant

User

Password

Description

When selected, enables the HTTP Object Store feature.

Sets the location used when a user does not set one.

When selected, enables properties required for communication with a keystone server: Authentication URl, Role, Tenant, User, Password.

Identity Service URI, for example: http://keystone:5000/V2.0.

OpenStack Identity Service type.

OpenStack Identity Service tenant name.

OpenStack Identity Service user's name.

OpenStack Identity Service user's password.

TABLE 64

HTTP WebDAV Properties

Property

Enable WebDAV

Require client login

Description

When selected, enables the HTTP WebDAV feature.

Clients must authenticate before share access is allowed, and files they create will have their ownership. If this property is not set, files created will be owned

Appliance Services 289

Adding HTTP Access to a Share (BUI)

Property Description

by the HTTP service with user nobody. See “HTTP

Authentication and Access Control” on page 290 .

TABLE 65

HTTP Logs

Log

network-http:apache22

Description

HTTP service log

Related Topics

“Adding HTTP Access to a Share (BUI)” on page 288

“HTTP Authentication and Access Control” on page 290

“HTTP Object Store Configuration” on page 291

HTTP Authentication and Access Control

If the "Require client login" option is enabled, the appliance will deny access to clients that do not supply valid authentication credentials for a local user, a NIS user, or an LDAP user. Active

Directory authentication is not supported.

Only basic HTTP authentication is supported. Note that unless HTTPS is being used, this transmits the username and password unencrypted, which may not be appropriate for all environments.

Normally, authenticated users have the same permissions with HTTP that they would have with

NFS or FTP. Files and directories created by an authenticated user will be owned by that user, as viewed by other protocols. Privileged users (those having a UID less than 100) will be treated as nobody for the purposes of access control. Files created by privileged users will be owned by nobody

.

If the "Require client login" option is disabled, the appliance will not try to authenticate clients

(even if they do supply credentials). Newly created files are owned by nobody, and all users are treated as nobody for the purposes of access control.

Regardless of authentication, no permissions are masked from created files and directories.

Created files have UNIX permissions 666 (readable and writable by everyone), and created directories have UNIX permissions 777 (readable, writable, and executable by everyone).

Related Topics

“Adding HTTP Access to a Share (BUI)” on page 288

“HTTP Properties and Logs” on page 289

“HTTP Object Store Configuration” on page 291

290 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding HTTP Access to a Share (BUI)

HTTP Object Store Configuration

The HTTP Object Store feature enables Oracle ZFS Storage Appliance to save data as storage objects into the Oracle ZFS filesystem through the Swift Object Store protocol.

Enabling HTTP Object Store

To enable HTTP Object Store, go to Configuration > Services > HTTP and select the check box for Enable Object Store. Before applying the change, configure the properties.

After enabling and configuring HTTP Object Store, enable the feature on individual filesystems by going to Shares > Filesystems. Double-click on a filesystem to view its details, and then select tab Protocols. In the HTTP section and for the Object store mode option, select Read/ write to enable HTTP Object Store for the filesystem.

HTTP Object Store Properties

When the HTTP Object Store feature is enabled, you can configure it with the HTTP Object

Store properties, as shown in Table 63, “HTTP Object Store Properties,” on page 289 .

If the OpenStack Identity Service option was selected when you applied your changes for the

HTTP service, a test connection is made to the specified server with the provided properties information. If the connection fails, a dialog box opens, and you can either apply or cancel all changes to the HTTP service.

Related Topics

“Adding HTTP Access to a Share (BUI)” on page 288

“HTTP Properties and Logs” on page 289

“HTTP Authentication and Access Control” on page 290

NDMP Configuration

The Network Data Management Protocol (NDMP) service enables the system to participate in

NDMP-based backup and restore operations controlled by a remote NDMP client called a Data

Management Application (DMA). Using NDMP, data stored in administrator-created shares on the appliance can be backed up and restored to both locally attached tape devices and remote systems. Locally-attached tape devices can also be exposed to the DMA for backing up and restoring remote systems.

NDMP cannot be used to back up and restore system configuration data. Instead, use the

Configuration Backup and Restore feature (see “Backing Up the Configuration” in Oracle ZFS

Storage Appliance Customer Service Manual

).

To configure NDMP, see the following sections:

Appliance Services 291

Adding HTTP Access to a Share (BUI)

“NDMP Local vs. Remote Configurations” on page 292

“NDMP Backup Formats and Types” on page 292

“NDMP Backup with Types dump and tar” on page 293

“NDMP Backup with Type zfs” on page 294

“NDMP Incremental Backups” on page 296

“Replica Backups” on page 297

“NDMP Properties and Logs” on page 299

NDMP Local vs. Remote Configurations

The appliance supports backup and restore using both a local configuration, in which tape drives are physically attached to the appliance, and a remote configuration, in which data is streamed to another system on the same network. In both cases, the backup must be managed by a supported DMA.

In local configurations, supported tape devices, including both drives and changers (robots), are physically connected to the system using a supported SCSI or Fibre Channel (FC) card configured in Initiator mode. These devices can be viewed on the NDMP Status screen. The

NDMP service presents these devices to a DMA when the DMA scans for devices. Once configured in the DMA, these devices are available for backup and restore of the appliance or other systems on the same network. After adding tape drives or changers to the system or removing such devices from the system, a reboot may be required before the changes will be recognized by the NDMP service. After that, the DMA may need to be reconfigured because tape device names may have changed.

In remote configurations, the tape devices are not physically connected to the system being backed up and restored (the data server) but rather to the system running the DMA or a separate system (the tape server). These are commonly called "3-way configurations" because the DMA controls two other systems. In these configurations, the data stream is transmitted between the data server and the tape server over an IP network.

NDMP Backup Formats and Types

The NDMP protocol does not specify a backup data format. The appliance supports three backup types corresponding to different implementations and on-tape formats. DMAs can select a backup type using the following values for the NDMP environment variable TYPE:

TABLE 66

Backup type

dump

NDMP Backup Formats and Types

Details

File-based for filesystems only. Supports file history and direct access recovery (DAR).

292 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding HTTP Access to a Share (BUI)

Backup type

tar zfs

Details

File-based for filesystems only. Supports file history and direct access recovery (DAR).

Share-based for both filesystems and volumes. Does not support file history or direct access recovery (DAR), but may be faster for some datasets. Only supported with

NDMPv4.

There is no standard NDMP data stream format, so backup streams generated on the appliance can only be restored on ZFS storage appliances running compatible software. Future versions of appliance software can generally restore streams backed up from older versions of the software, but the reverse is not necessarily true. For example, the "zfs" backup type is new in 2010.Q3

and systems running 2010.Q1 (or earlier) cannot restore backup streams created using type

"zfs" under 2010.Q3.

NDMP Backup with Types dump and tar

When backing up with "dump" and "tar" backup types, administrators specify the data to backup by a filesystem path, called the backup path. For example, if the administrator configures a backup of /export/home, then the share mounted at that path will be backed up.

Similarly, if a backup stream is restored to /export/code, then that's the path where files will be restored, even if they were backed up from another path.

Only paths that are mountpoints of existing shares, or contained within existing shares, may be specified for backup. If the backup path matches a share's mountpoint, only that share is backed up. Otherwise the path must be contained within a share, in which case only the portion of that share under that path is backed up. In both cases, other shares mounted inside the specified share under the backup path will not be backed up; these shares must be specified separately for backup.

Snapshots - If the backup path specifies a live filesystem (such as /export/code) or a path contained within a live filesystem (such as /export/code/src), the appliance immediately takes a new snapshot and backs up the given path from that snapshot. When the backup completes, the snapshot is destroyed. If the backup path specifies a snapshot (e.g., /export/code/.zfs/snapshot/

mysnap), no new snapshot is created and the system backs up from the specified snapshot.

Share metadata - To simplify backup and restore of complex share configurations, "dump" and

"tar" backups include share metadata for projects and shares associated with the backup path.

This metadata describes the share configuration on the appliance, including protocol sharing properties, quota properties, and other properties configured on the Shares screen. This is not to be confused with filesystem metadata like directory structure and file permissions, which is also backed up and restored with NDMP.

Appliance Services 293

Adding HTTP Access to a Share (BUI)

For example, if you back up /export/proj, the share metadata for all shares whose mountpoints start with /export/proj will be backed up, as well as the share metadata for their parent projects. Similarly, if you back up /export/someshare/somedir, and a share is mounted at /export/someshare, that share and its project's share metadata will be backed up.

When restoring, if the destination of the restore path is not contained inside an existing share, projects and shares in the backup stream will be recreated as needed with their original properties as stored in the backup. For example, if you back up /export/foo, which contains project proj1 and shares share1 and share2, and then destroy the project and restore from the backup, then these two shares and the project will be recreated with their backed-up properties as part of the restore operation.

During a restore, if a project exists that would have been automatically recreated, the existing project is used and no new project is automatically created. If a share exists that would have been automatically recreated, and if its mountpoint matches what the appliance expects based on the original backup path and the destination of the restore, then the existing share is used and no new share is automatically created. Otherwise, a new share is automatically created from the metadata in the backup. If a share with the same name already exists (but has a different mountpoint), then the newly created share will be given a unique name starting with ndmp- and with the correct mountpoint.

It is recommended that you either restore a stream whose datasets no longer exist on the appliance, allowing the appliance to recreate datasets as specified in the backup stream, or precreate a destination share for restores. Either of these practices avoids surprising results related to the automatic share creation described earlier.

NDMP Backup with Type zfs

When backing up with type "zfs", administrators specify the data to backup by its canonical name on the appliance. This can be found underneath the name of the share in the BUI:

294 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

FIGURE 26

NDMP Share Name

Adding HTTP Access to a Share (BUI) or in the CLI as the value of the canonical_name property. Canonical names do not begin with a leading '/', but when configuring the backup path the canonical name must be prefixed with '/'.

Both projects and shares can be specified for backup using type "zfs". If the canonical name is specified as-is, then a new snapshot is created and used for the backup. A specific snapshot can be specified for backup using the @snapshot suffix, in which case no new snapshot is created and the specified snapshot is backed up. For example:

TABLE 67

Canonical Names and Shares Backed Up

Canonical name

pool-0/local/default pool-0/local/[email protected] pool-0/local/default/code pool-0/local/default/[email protected]

Shares backed up

New snapshot of the local project called default and all of its shares.

Named snapshot yesterday of local project default, and all of its shares having snapshot yesterday.

New snapshot of share code in local project default.

code

could be a filesystem or volume.

Named snapshot yesterday of share code in local project default

. code could be a filesystem or volume.

Because level-based incremental backups using the "zfs" backup type require a base snapshot from the previous incremental, the default behavior for level backups for which a new snapshot is created is to keep the new snapshot so that it can be used for subsequent incremental backups.

If the DMA indicates that the backup will not be used for subsequent incremental backups by setting UPDATE=n, the newly created snapshot is destroyed after the backup. Existing

user snapshots are never destroyed after a backup. For details, see “NDMP Incremental

Backups” on page 296

.

Appliance Services 295

Adding HTTP Access to a Share (BUI)

Share metadata - Share metadata (i.e., share configuration) is always included in "zfs" backups. When restoring a full backup with type "zfs", the destination project or share must not already exist. It will be recreated from the metadata in the backup stream. When restoring an incremental backup with type "zfs", the destination project or share must already exist. Its properties will be updated from the metadata in the backup stream. For details, see

“NDMP

Incremental Backups” on page 296 .

NDMP Incremental Backups

The appliance supports level-based incremental backups for all of the above backup types. To specify a level backup, DMAs typically specify the following three environment variables:

Variable

LEVEL

DMP_NAME

UPDATE

Details

Integer from 0 to 9 identifying the backup level.

Specifies a particular incremental backup set.

Multiple sets of level incremental backups can be used concurrently by specifying different values for

DMP_NAME.

Indicates whether this backup can be used as the base for subsequent incremental backups

By definition, a level-N backup includes all files changed since the previous backup of the same backup set (specified by "DMP_NAME") of the same share using LEVEL less than

N. Level-0 backups always include all files. If UPDATE has value "y" (the default), then the current backup is recorded so that future backups of level greater than N will use this backup as a base. These variables are typically managed by the DMA and need not be configured directly by administrators.

Below is a sample incremental backup schedule:

TABLE 68

Sample Incremental Backup Schedule

Day

First of month

Every 7th, 14th, 21st of month

Every day

Details

Level-0 backup. Backup contains all files in the share.

Level-1 backup. Backup contains all files changed since the last full (monthly) backup

Level-2 backup. Backup contains all files changed since the last level-1 backup

To recover the filesystem's state as it was on the 24th of the month, an administrator typically restores the Level-0 backup from the 1st of the month to a new share, then restores the Level-1

296 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding HTTP Access to a Share (BUI) backup from the 21st of the month, and then restores the Level-2 backup from the 24th of the month.

To implement level-based incremental backups the appliance must keep track of the level backup history for each share. For "tar" and "dump" backups, the level backup history is maintained in the share metadata. Incremental backups traverse the filesystem and include files modified since the time of the previous level backup. At restore time, the system simply restores all the files in the backup stream. In the above example, it would therefore be possible to restore the Level-2 backup from the 24th onto any filesystem and the files contained in that backup stream will be restored even though the target filesystem may not match the filesystem where the files were backed up. However, best practice suggests using a procedure like the above which starts from an empty tree restores the previous level backups in order to recover the original filesystem state.

To implement efficient level-based incremental backups for type "zfs", the system uses a different approach. Backups that are part of an incremental set do not destroy the snapshot used for the backup but rather leave it on the system. Subsequent incremental backups use this snapshot as a base to quickly identify the changed filesystem blocks and generate the backup stream. As a consequence, the snapshots left by the NDMP service after a backup must not be destroyed if you want to create subsequent incremental backups.

Another important consequence of this behavior is that in order to restore an incremental stream, the filesystem state must exactly match its state at the base snapshot of the incremental stream. In other words, in order to restore a level-2 backup, the filesystem must look exactly as it did when the previous level-1 backup completed. Note that the above commonly-used procedure guarantees this because when restoring the Level-2 backup stream from the 24th, the system is exactly as it was when the Level-1 backup from the 21st completed because that backup has just been restored.

The NDMP service will report an error if you attempt to restore an incremental "zfs" backup stream to a filesystem whose most recent snapshot doesn't match the base snapshot for the incremental stream, or if the filesystem has been changed since that snapshot. You can configure the NDMP service to rollback to the base snapshot just before the restore begins by specifying the NDMP environment variable "ZFS_FORCE" with value "y" or by configuring the "Rollback datasets" property of the NDMP service (see

“NDMP Properties and

Logs” on page 299 ).

Replica Backups

The Oracle ZFS Storage Appliance supports direct backup of replicas and replica snapshots with the "zfs" backup type. It is not necessary to first clone a replica dataset (project or share) in order to back it up.

Appliance Services 297

Adding HTTP Access to a Share (BUI)

Note -

Because the backup is of a replica, the source dataset properties are backed up rather than those of the target.

Enabling Replica Backups

To enable replica backups, apply the corresponding deferred update. For more information, see “Deferred Updates” in Oracle ZFS Storage Appliance Customer Service Manual .

Replica backups require software version 2011.1.0 (or later on the source.

If the replica backup will be restored to the source with the original replicated dataset, the source must run software version 2013.1.4 (or later).

Replica Backup Syntax

To back up a replicated project or share, input the ZFS dataset name without a snapshot extension into the DMA. ndmpd uses the appliance software to determine the latest complete replica snapshot to back up. To specify a replica dataset for backup, use copy and paste to avoid mistyping long replica dataset names which may include a UUID.

If a user-generated snapshot extension is included, ndmpd backs up the indicated user snapshot.

If a system-generated extension is included (begins with .rr) the backup fails and generates a message that is logged to the DMA console.

Replica Backup Persistent Holds

Persistent holds are taken on backed-up snapshots when the backups complete. This is necessary for future incremental backups, which use current snapshots as a base, otherwise the replication subsystem may delete replica snapshots it no longer needs. Holds are released by ndmpd

when the snapshots are no longer needed.

Persistent holds can be cleared manually. When deleting a replica snapshot with a hold on it, a confirmation is displayed warning of the potential impact to ongoing or future NDMP backups.

Snapshots required by the replication subsystem cannot be deleted.

If incremental backups are not needed, prevent persistent holds by setting the DMA UPDATE parameter to no (UPDATE=n). UPDATE=y is the default mode. For more information about the

UPDATE

NDMP environment variable, see the whitepaper NDMP Implementation Guide for the

Sun ZFS Storage Appliance (http://www.oracle.com/technetwork/server-storage/sununified-storage/documentation/index.html

) .

298 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding HTTP Access to a Share (BUI)

Incremental Replica Backups

Continuing (incrementing) a backup series across a replication reversal or sever is not supported; instead, start a new backup series. Use a full (Level-0) backup for the first backup after a replication state change has occurred, such as on a new source after a reversal or sever has taken place.

Static snapshot extensions that do not change per level are NOT supported for user-generated replica snapshots (snapshots not starting with .rr). This prevents name collisions, which generate an error and can cause replication to fail.

Some DMAs do not support zfs-type replica incremental backup and restore operations for snapshot extension name changes per level. To conserve appliance space and ensure that such snapshots are not preserved for future incremental backups, set UPDATE=n at the time of backup of replica. User-generated snapshots can be removed manually.

Even if no user data has changed in a restored dataset, changed metadata can cause incremental replica restores to fail. To avoid this, always roll back to the base snapshot before incremental replica restores by setting the ZFS rollback before restore parameter to Always.

For non-incremental replica backups, such as for one-off backups, set UPDATE=n so future snapshots are not saved and consume space. Some older replica snapshots preserved for future incremental backups, such as those created by setting UPDATE=y, may no longer be needed and waste space. These snapshots are safe to manually destroy. Snapshots needed by the replication subsystem cannot be deleted. Unneeded snapshots can be deleted after confirming the warning message about possible impacts to ongoing or future NDMP backups if the snapshot is deleted.

NDMP Properties and Logs

The NDMP service configuration consists of the following properties and logs:

TABLE 69

NDMP Properties

Property

Version

TCP port (v4 only)

Ignore metadata-only changes

Target restore pool(s)

Description

The version of NDMP that your DMA supports.

The NDMP default connection port is 10000. NDMPv3 always uses this port. NDMPv4 allows a different port if needed.

Directs the system to backup only files in which content has changed, ignoring files for which only metadata, such as permissions or ownership, has changed. This option only applies to incremental "tar" and "dump" backups and is disabled by default.

When you perform a full restore using "tar" or "dump", the system re-creates datasets if there is no share

Appliance Services 299

Adding HTTP Access to a Share (BUI)

Property

Allow token-based backup

ZFS rollback before restore (v4 only)

Allow direct access recovery

Restore absolute paths (v3 only)

Share creation on restore

DMA tape mode (for locally attached drives)

Description

mounted at the target. Because the NDMP protocol specifies only the mount point, the system chooses a pool in which to recreate projects and shares. On a system with multiple pools, this property lets you specify one or more pools. Multiple pools only need to be specified in a cluster with active pools on each head. You must ensure that this list is kept in sync with any storage configuration changes. If none of the pools exist or are online, the system will select a default pool at random.

Enables or disables token-based method for ZFS backup.

This property is off by default.

Only applies to backups with type "zfs". Determines whether when restoring an incremental backup the system rolls back the target project and share to the snapshot used as the base for the incremental restore. If the project and shares are rolled back, then any changes made since that snapshot will be lost. This setting is normally controlled by the DMA via the "ZFS_FORCE" environment variable, but this property can be used to override the DMA setting to always rollback these data sets or never roll them back. For details, see

“NDMP Incremental Backups” on page 296 . Not

rolling them back will cause the restore to fail unless they have already been manually rolled back. This property is intended for use with DMAs that do not allow administrators to configure custom environment variables like ZFS_FORCE.

Enables the system to locate files by position rather than by sequential search during restore operations. Enabling this option reduces the time it takes to recover a small number of files from many tapes. You must specify this option at backup time in order to be able to recover individual files later.

Specifies that when a file is restored, the complete absolute path to that file is also restored (instead of just the file itself). This option is disabled by default.

Configures the restore operation to create a new share based on the backup type:

All - Allows all backup types to create a new share on restore

Tar_Dump - Allows backup types "tar" and "dump" to create a new share on restore

ZFS - Allows backup type "zfs" to create a new share on restore

None - No backup type can create a new share on restore

Specifies whether the DMA expects System V or

BSD semantics. The default is System V, which is recommended for most DMAs. This option is only

300 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding HTTP Access to a Share (BUI)

Property

DMA username and password

Description

applicable for locally attached tape drives exported via

NDMP. Consult your DMA documentation for which mode your DMA expects. Changing this option only changes which devices are exported when the DMA scans for devices, so you will need to reconfigure the tape devices in your DMA after changing this setting.

Used to authenticate the DMA. The system uses MD5 for user authentication

TABLE 70

NDMP Logs

Log

system-ndmpd:default

Description

NDMP service log

Shadow Migration Configuration

The shadow migration service allows for automatic migration of data from external or internal sources. This functionality is described in detail in

“Shadow Migration” on page 465

. The service itself only controls automatic background migration. Regardless of whether the service is enabled or not, data will be migrated synchronously for in-band requests.

The service should only be disabled for testing purposes, or if the load on the system due to shadow migration is too great. When disabled, no filesystems will ever finish migrating.

The primary purpose of the service is to allow tuning of the number of threads dedicated to background migration.

Number of Threads Property - Number of threads to devote to background migration of data. These threads are global to the entire machine, and increasing the number can increase concurrency and the overall speed of migration at the expense of increased resource consumption (network, I/O, and CPU).

SFTP Configuration

The SFTP (SSH File Transfer Protocol) service allows filesystem access from SFTP clients.

Anonymous logins are not allowed, users must authenticate with whichever name service is configured in Services.

SFTP can be used in conjunction with Kerberos authentication. For information about the appliance Kerberos service, see

“Kerberos Configuration” on page 343 .

To configure SFTP, see the following sections:

Appliance Services 301

Adding SFTP Access to a Share (BUI)

“Adding SFTP Access to a Share (BUI)” on page 302

“Configuring SFTP for Remote Access (CLI)” on page 302

“SFTP Properties, Ports, and Logs” on page 304

Adding SFTP Access to a Share (BUI)

3.

4.

1.

2.

5.

Go to Configuration > Services.

Check that the SFTP service is enabled and online. If not, enable the service.

Go to Shares > Shares and select or add a share.

Go to the Protocols tab, and check that SFTP access is enabled.

(Optional) Set the Share mode access to Read only or Read/Write.

Related Topics

“Configuring SFTP for Remote Access (CLI)” on page 302

“SFTP Properties, Ports, and Logs” on page 304

Configuring SFTP for Remote Access (CLI)

3.

4.

1.

2.

Create a local user or network user (LDAP or NIS) with an appropriate administrator role. (See

“Configuring Users” on page 202

).

Generate an SSH authentication key by entering the command ssh-keygen -t dsa on the Oracle Solaris host/client.

Enter a file name in which to store the key.

Enter a passphase if required, or leave this field blank to log on directly to the

SFTP share.

The location is displayed for the key. The key looks similar to the following: ssh-dss AAAAB3NzaC1kc3MAAACBAPMMs5h8UWk1NPf/

VJDDEo0OAwT+s6iZxkCmmrgAmLfTX9izWk+ bsvNldOlXN/6EgkusLjo/

+UaEt5+704vMHClRaq3AlVHLS5tVjeX3iCs+fDo0qwXZg3Brh8QBAaWk3 ywr2osuII1tHh4v/HwEAHZq5mVWXav0pO3bgmxl0/

302 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SFTP for Remote Access (CLI)

5.

6.

7.

+VAAAAFQDIJxnm52DfyEdQQMTY+jRVvzGwMQA AAIAhTP6Ey

+2gGFiCKkvUofsco4d8pbqH8duE9P6Y88s0+opuj52GkAdRUt2fRrdM9Cf3h4lIOc8Bw9 bZIBzrCKBNWBUdZG56tsfLdilW6vS6gxKrmL2v7fSp9WYPsxZGhOLfU29zW4n2WVcVHbGyFEoVe

+taq aq+AYJaWoHnjZL1/

LpQAAAIAOLc8+uc3hDOcK3pAkYdg8b2rYIGOAZU4py0rq24DGPeVHd5h5jbe4p

WDM70uYqGCOPYiOKeEoMNJpczRX5qjI+BfoUY4sH24WWwsKkT8XX9PUAa0WT

+7axEqg2N6YelaTJ95J vMaj6E7HkAIra2Sj2H/LSDktL42UL+j1Wx5A== username sunray

Go to Configuration > Services > SFTP. Under Keys, click the plus (+) sign.

In the New Key window, select DSA.

Copy only the key portion (beginning with AAAA and ending with Wx5A== in the example above) and paste into the Key field.

Note -

The key should not contain any white spaces.

8.

9.

Enter the user name and add a comment as a reminder.

10.

Go to Shares > Shares and click the add item icon to create a filesystem.

In the Create Filesystem window, enter the filesystem name (for example, sftp), change the permissions to Read/ Write for the share, and click APPLY.

11.

12.

Click the edit icon to set up the share properties. (See “Filesystem

Properties” on page 420

.)

To access the share, use the sftp command as shown in these examples: sftp -o "port=218" <username> 10.x.x.151:/export/sftp

Connecting to 10.x.xx.151...

Changing to: /export/sftp sftp>

Example with -v option:

sftp -v -o "IdentityFile=/home/<username>/.ssh/id_dsa" -o "port=218" root 10.x.xx.151:/export/sftp

Related Topics

“Adding SFTP Access to a Share (BUI)” on page 302

“SFTP Properties, Ports, and Logs” on page 304

Appliance Services 303

Configuring SFTP for Remote Access (CLI)

SFTP Properties, Ports, and Logs

SFTP Properties

TABLE 71

SFTP Properties

Property

Port (for incoming connections)

Permit root login

Logging level

SFTP Keys

Description

The port SFTP listens on. The default is 218.

Allows SFTP logins for the root user. This property is off by default.

The verbosity of SFTP log messages

RSA/DSA public keys for SFTP authentication. Text comments can be associated with the keys to help administrators track why they were added. As of the

2011.1 software release, key management for SFTP has changed to increase security. When creating an SFTP key, it is required to include the user property with a valid user assignment. SFTP keys are grouped by user and are authenticated via SFTP with the user's name. It is recommended to recreate any existing SFTP keys that do not include the user property, even though they will still authenticate.

TABLE 72

Property

Ciphers

MACs

SFTP Security Properties

Description

Allow an administrator to choose which ciphers to use for connecting to the appliance.

Allow an administrator to choose which message authentication codes (MACs) to use for connecting to the appliance.

SFTP Ports

The SFTP service uses a non-standard port number for connections to the appliance. This is to avoid conflicts with administrative SSH connections to port 22. By default, the SFTP port is 218 and must be specified on the SFTP client prior to connecting. For example, an Oracle

Solaris client using SFTP, would connect with the following command: manta# sftp -o "Port 218" [email protected]

SFTP Logs

network-sftp:default - Logs SFTP service events

304 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding TFTP Access to a Share (BUI)

Related Topics

“Adding SFTP Access to a Share (BUI)” on page 302

“Configuring SFTP for Remote Access (CLI)” on page 302

SRP Configuration

When you configure a LUN on the appliance you can export that volume over a SCSI Remote

Protocol (SRP) target. The SRP service allows initiators to access targets using the SRP protocol.

For information on SRP targets and initiators, see

“Configuring Storage Area Network

(SAN)” on page 170 .

TFTP Configuration

Trivial File Transfer Protocol (TFTP) is a simple protocol to transfer files. TFTP is designed to be small and easy to implement, therefore, lacks most of the features of a regular FTP. TFTP only reads and writes files (or mail) from/to a remote server. It cannot list directories, and currently has no provisions for user authentication..

TABLE 73

TFTP Properties

Property

Default Root Directory

Description

The TFTP login location. The default is /export and points to the top of the shares hierarchy. All users will be logged into this location after successfully authenticating with the TFTP service

To use TFTP with a share, see

“Adding TFTP Access to a Share (BUI)” on page 305

.

Adding TFTP Access to a Share (BUI)

1.

2.

3.

4.

Go to Configuration > Services.

Check that the TFTP service is enabled and online. If not, enable the service.

Go to Shares > Shares and select or add a share.

Go to the Protocols tab, and check that TFTP access is enabled.

Appliance Services 305

Configuring Virus Scanning for a Share (BUI)

5.

(Optional) Set the Share mode access to Read only or Read/Write.

Virus Scan Configuration

The Virus Scan service will scan for viruses at the filesystem level. When a file is accessed from any protocol, the Virus Scan service will first scan the file, and both deny access and quarantine the file if a virus is found. Once a file has been scanned with the latest virus definitions, it is not rescanned until it is next modified. Files accessed by NFS clients that have cached file data, or been delegated read privileges by the NFSv4.0 or NFSv4.1 servers, may not be immediately quarantined.

To configure Virus Scan, see the following sections:

“Configuring Virus Scanning for a Share (BUI)” on page 306

“Virus Scan Properties and Logs” on page 307

“Virus Scan File Extensions” on page 307

“Scanning Engines” on page 308

Configuring Virus Scanning for a Share (BUI)

3.

4.

5.

1.

2.

6.

7.

8.

Go to Configuration > Services > Virus Scan.

Enable the service.

Set the appropriate properties.

Click APPLY to commit the configuration.

Go to Shares.

Edit a filesystem or a project.

Select the General tab.

Enable the Virus scan option.

Related Topics

“Virus Scan Properties and Logs” on page 307

“Virus Scan File Extensions” on page 307

“Scanning Engines” on page 308

306 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Virus Scanning for a Share (BUI)

Virus Scan Properties and Logs

TABLE 74

Virus Scan Properties

Property

Maximum file size to scan

Allow access to files that exceed maximum file size

Description

Files larger than this size will not be scanned, to avoid significant performance penalties. These large files are unlikely to be executable themselves (such as database files), and so are less likely to pose a risk to vulnerable clients. The default value is 1GB.

Enabled by default, this allows access to files larger than the maximum scan size (which are therefore unscanned prior to being returned to clients). Administrators at a site with more stringent security requirements may elect to disable this option and increase the maximum file size, so that all accessible files are known to be scanned for viruses.

TABLE 75

Log

vscan

Virus Scan Logs

Description

Log of the Virus Scan service.

Related Topics

“Configuring Virus Scanning for a Share (BUI)” on page 306

“Virus Scan File Extensions” on page 307

“Scanning Engines” on page 308

Virus Scan File Extensions

This section describes how to control which files are scanned. The default value, " * ", causes all files to be scanned. Scanning all files may impact performance so you can designate a subset of files to scan.

For example, to scan only high-risk files, including zip files, but not files with names that match the pattern "data-archive*.zip", you could configure the following settings:

TABLE 76

Action

Scan

Virus Scan File Extensions

Pattern

exe

Appliance Services 307

Configuring Virus Scanning for a Share (BUI)

Action

Scan

Scan

Scan

Scan

Don't Scan

Don't Scan

Pattern

com bat doc zip data-archive*.zip

*

Note -

You must use "Don't Scan *" to exclude all other file types not explicitly included in the scan list. A file named file.name.exe.bat.jpg123 would not be scanned, as only the "jpg123" portion of the name, the extension, would be compared against the rules.

Do not use exclude settings before include settings. For example, do not use a "Don't Scan *" setting before include settings since that would exclude all file types that come after it.

TABLE 77

Action

Don't Scan

Scan

Scan

Scan

Scan

Scan

Don't Scan

Virus Scan Actions

Pattern

* exe com bat doc zip data-archive*.zip

Related Topics

“Configuring Virus Scanning for a Share (BUI)” on page 306

“Virus Scan Properties and Logs” on page 307

“Scanning Engines” on page 308

Scanning Engines

In this section, specify which scanning engines to use. A scanning engine is an external third-party virus scanning server which the appliance contacts using ICAP (Internet Content

Adaptation Protocol, RFC 3507) to have files scanned.

308 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Appliance Administrator from NIS (BUI)

TABLE 78

Scanning Engines Properties

Property

Enable

Host

Maximum Connections

Port

Description

Use this scan engine.

Hostname or IP address of the scan engine server.

Maximum number of concurrent connections. Some scan engines operate better with connections limited to 8.

Port for the scan engine.

Related Topics

“Configuring Virus Scanning for a Share (BUI)” on page 306

“Virus Scan Properties and Logs” on page 307

“Virus Scan File Extensions” on page 307

NIS Configuration

Network Information Service (NIS) is a name service for centralized management. The appliance can act as an NIS client for users and groups, so that:

NIS users can log in to the FTP and HTTP services.

NIS users can be granted privileges for appliance administration. The appliance supplements NIS information with its own privilege settings.

Note -

UIDs and GIDs from 0-99 inclusive are reserved by the operating system vendor for use in future applications. Their use by end system users or vendors of layered products is not supported and may cause security related issues with future applications.

To configure NIS, see the following sections:

“Adding an Appliance Administrator from NIS (BUI)” on page 309

“NIS Properties and Logs” on page 310

Adding an Appliance Administrator from NIS (BUI)

If you have an existing user in NIS who would like to log in using their NIS credentials and administer the appliance:

Note -

If both NIS and LDAP are configured on the appliance and the services return different information for a particular item, the appliance will use the data provided by NIS.

Appliance Services 309

Adding an Appliance Administrator from NIS (BUI)

5.

6.

7.

3.

4.

1.

2.

Go to Configuration > Services > NIS.

Set the NIS domain and server properties.

Click APPLY to commit the configuration.

Go to Configuration > Users.

Add a user with type "directory".

Set the username to their NIS username.

Continue with the instructions in “Configuring Users” on page 202 for adding

authorizations to this user.

Related Topics

“NIS Properties and Logs” on page 310

NIS Properties and Logs

TABLE 79

NIS Properties

Property

Domain

Server(s): Search using broadcast

Server(s): Use listed servers

The appliance will connect to the first NIS server listed, or a server found using broadcast, and switch to the next if it stops responding.

TABLE 80

NIS Logs

Log

network-nis-client:default appliance-kit-nsswitch:default system-identity:domain

Description

NIS client service log.

Log of the appliance name service, through which NIS queries are made.

Log of the appliance domain name configurator.

Related Topics

Description

The NIS domain to use.

The appliance sends a NIS broadcast to locate NIS servers for that domain.

NIS server hostnames or IP addresses.

310 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Adding an Appliance Administrator (BUI)

“Adding an Appliance Administrator from NIS (BUI)” on page 309

LDAP Configuration

Lightweight Directory Access Protocol (LDAP) is a directory service for centralizing management of users, groups, hostnames, and other resources (called objects). This service on the appliance acts as an LDAP client so that:

LDAP users can log in to the FTP and HTTP services.

LDAP user names (instead of numerical ids) can be used to configure root directory ACLs on a share.

LDAP users can be granted privileges for appliance administration. The appliance supplements LDAP information with its own privilege settings.

The LDAP server's certificate can be self-signed.

You cannot supply a list of trusted CA certificates; each certificate must be individually accepted by the appliance administrator.

When an LDAP server's certificate expires, you must delete the server from the list and then add it again to accept its new certificate.

Note -

UIDs from 0-99 inclusive are reserved by the operating system vendor for use in future applications. Their use by end system users or vendors of layered products is not supported and can cause security issues with other applications.

To configure LDAP, see the following sections:

“Adding an Appliance Administrator (BUI)” on page 311

“Setting Properties with Multiple Attribute Value Pairs (CLI)” on page 312

Configuring LDAP Security Settings -

BUI , CLI

“LDAP Properties” on page 315

“LDAP Custom Mappings” on page 316

Adding an Appliance Administrator (BUI)

To let an existing LDAP user log in using LDAP credentials and administer the appliance, use the following procedure.

Note -

If both NIS and LDAP are configured on the appliance and the services return different information for a particular item, the appliance will use the data provided by NIS.

Appliance Services 311

Setting Properties with Multiple Attribute Value Pairs (CLI)

2.

3.

1.

Go to Configuration > Services > LDAP, and enter the properties that you want to use.

For information about the available properties, see “LDAP Properties” on page 315

.

To apply properties you selected, click Apply or click Revert to start over.

4.

5.

To add LDAP servers, in the Servers section click the add item icon .

For information about servers, see the Servers section in

“LDAP Properties” on page 315 .

To configure the LDAP server, in the New LDAP Server box, enter the LDAP server Address and select the LDAP Certificate source that you want to use.

For the Certificate source, select Server to search the current server and retrieve the certificate

(in an insecure manner), and use it to validate the certificate presented later.

Go to Configuration > Users, and add users as needed using LDAP usernames.

For information about adding users, see “Configuring Users” on page 202 .

Related Topics

“Setting Properties with Multiple Attribute Value Pairs (CLI)” on page 312

“LDAP Properties” on page 315

“LDAP Custom Mappings” on page 316

1.

2.

Setting Properties with Multiple Attribute Value Pairs (CLI)

To set LDAP property values that have multiple attribute value pairs with equal signs (=), surround each attribute value pair with double quotation marks.

Go to configuration services ldap.

To set multiple attribute value pairs, use the following commands:

hostname:configuration services ldap> set user_mapattr="uid=uid",

"uidnumber=uidNumber","gidnumber=gidNumber",

"gecos=displayName","description=distinguishedName",

"homedirectory=unixHomeDirectory"

Related Topics

“Adding an Appliance Administrator (BUI)” on page 311

“LDAP Properties” on page 315

312 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring LDAP Security Settings (BUI)

“LDAP Custom Mappings” on page 316

1.

2.

3.

4.

Configuring LDAP Security Settings (BUI)

To configure security settings for the LDAP service, use the following procedure.

Go to Configuration > Services.

Under Directory Services, select LDAP.

For Security Settings, select one of the following authentication options:

Anonymous - Gives the appliance access only to data that is available to everyone. To optionally enable the SSL and TLS protocols, select the check box for Enable SSL/TLS.

Self - Authenticates the appliance using the user's identity and credentials. Self authentication uses Kerberos encryption and the SASL/GSSAPI authentication method.

Proxy - Specifies authentication through a proxy for a specific user account. Set the following options:

(Optional) Enable SSL/TLS - Select this check box to enable the SSL and TLS protocols, which is highly recommended when using the simple authentication method so the user's distinguished name and password are not sent as plain text.

Authentication Method - Select either Simple (RFC 4513) or SASL/DIGEST-MD5.

Proxy DN - Distinguished name of account used for proxy authentication.

Proxy Password - Password for account used for proxy authentication.

Click APPLY.

Related Topics

“LDAP Properties” on page 315

1.

Configuring LDAP Security Settings (CLI)

To configure security settings for the LDAP service, use the following procedure. For valid property setting combinations, see the table at the end of this task.

Go to configuration services ldap and enter show to view the properties.

hostname:configuration services ldap> show

Properties:

<status> = enabled

Appliance Services 313

Configuring LDAP Security Settings (CLI)

2.

3.

4.

default_servers =

proxy_dn =

proxy_password =

base_dn =

search_scope = one

cred_level = anonymous

auth_method = none

use_tls = false

user_search =

user_mapattr =

user_mapobjclass =

group_search =

group_mapattr =

group_mapobjclass =

netgroup_search =

netgroup_mapattr =

netgroup_mapobjclass =

To set the credential level, enter set cred_level= and one of the following options:

■ anonymous

- Allows anonymous authentication for access to data available to everyone.

self

- Provides self-authentication for users based on their identity and credentials. Selfauthentication uses Kerberos encryption and the SASL/GSSAPI authentication method.

proxy

- Specifies authentication through a proxy for a specific user account.

hostname:configuration services ldap> set cred_level=proxy

cred_level = proxy (uncommitted)

To set the authorization method, enter set auth_method= and one of the following options: none

- None (use with anonymous)

sasl/GSSAPI

- SASL/GSSAPI (use with self)

simple

- Simple, RFC 4513 (use with proxy)

sasl/DIGEST-MD5

- SASL/DIGEST-MD5 (use with proxy) hostname:configuration services ldap> set auth_method=simple

auth_method = simple (uncommitted)

To enable or disable SSL/TLS, enter set use_tls= and either true or false.

Enabling SSL/TLS is highly recommended when using the simple authentication method so the user's distinguished name and password are not sent in plain text.

hostname:configuration services ldap> set use_tls=true

use_tls = true (uncommitted)

314 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring LDAP Security Settings (CLI)

5.

6.

7.

If the credential level is set to proxy, enter set proxy_dn= and the distinguished name of the account used for proxy authentication. Then enter set proxy_password=

and the password for the account.

hostname:configuration services ldap> set proxy_dn=ProxyName

proxy_dn = ProxyName (uncommitted) hostname:configuration services ldap> set proxy_password=MyPassword5

proxy_password = *********** (uncommitted)

Enter commit.

hostname:configuration services ldap> commit

Refer to the following table for valid security property setting combinations.

cred_level

anonymous self proxy

auth_method

none none sasl/GSSAPI simple simple

use_tls

true false false true false

Permitted, but not recommended because the user's distinguished name (DN) and password will be sent in plain text.

true false sasl/DIGEST-MD5 sasl/DIGEST-MD5

Related Topics

“LDAP Properties” on page 315

LDAP Properties

For the appropriate settings for your environment, consult your LDAP server administrator.

Schema

Base search DN - Supplies the distinguished name of the base object which is the starting point for directory searches.

Search scope - Defines which objects in the LDAP directory are searched, relative to the base object. Search results can be limited only to objects directly beneath the base search

Appliance Services 315

Configuring LDAP Security Settings (CLI)

■ object (one-level) or they can include any object beneath the base search object (subtree).

The default is one-level.

Schema definition - Schema used by the appliance. This property lets administrators override the default search descriptor, attribute mappings, and object class mappings for users, groups, and netgroups. For more information, see

“LDAP Custom

Mappings” on page 316

.

Security Settings

Authenticate As - Credentials used to authenticate the appliance to the LDAP server.

Enable SSL/TLS - Toggles TLS (Transport Layer Security, the descendant of SSL) to establish secure connections to the LDAP server. If authenticating as Self, this option is unavailable because Self uses Kerberos encryption.

Authentication method - Method used to authenticate the appliance to the LDAP server.

You can only configure this setting if authenticating as Proxy.

LDAP Servers

Servers- List of LDAP servers to use. If only one server is specified, the appliance uses only that server and LDAP services are unavailable if that server fails. If multiple servers are specified, any functioning server can be used at any time without preference. If any server fails, another server in the list is used. LDAP services remain available unless all specified servers fail.

Related Topics

“Configuring LDAP Security Settings (BUI)” on page 313

“Configuring LDAP Security Settings (CLI)” on page 313

LDAP Custom Mappings

To look up users and groups in the LDAP directory, the appliance uses a search descriptor and must know which object classes correspond to users and groups and which attributes correspond to the properties needed. By default, the appliance uses object classes specified by RFC 2307 (posixAccount and posixGroup) and the default search descriptors shown in the following list, but this can be customized for different environments. The base search DN used in the examples below is dc=example,dc=com:

TABLE 81

Search descriptor

users groups netgroups

LDAP Custom Mappings

Default value

ou=people,base search DN ou=group,base search DN ou=netgroup,base search DN

Example

ou=people,dc=example,dc=com ou=group,dc=example,dc=com ou=netgroup,dc=example,dc=com

316 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring LDAP Security Settings (CLI)

The search descriptor, object classes, and attributes used can be customized using the Schema definition property. To override the default search descriptor, enter the entire DN you wish to use. The appliance will use this value unmodified, and will ignore the values of the Base search

DN and Search scope properties. To override user, group, and netgroup attributes and objects, choose the appropriate tab ("Users", "Groups", or "Netgroups") and specify mappings using the

default = new syntax, where default is the default value and new is the value you want to use.

For examples:

To use unixaccount instead of posixAccount as the user object class, enter posixAccount = unixaccount in Object class mappings on the Users tab.

To use employeenumber instead of uid as the attribute for user objects, enter uid = employeenumber in Attribute mappings on the Users tab.

To use unixgroup instead of posixGroup as the group object class, type posixGroup = unixgroup in Object class mappings on the Groups tab.

To use groupaccount instead of cn as the attribute for group objects, enter cn = groupaccount in Attribute mappings on the Groups tab.

The following is a list of object classes and attributes that you might want to map:

Classes

posixAccount posixGroup shadowAccount

Attributes - Users

uid uidNumber gidNumber gecos homeDirectory loginShell userPassword

Attributes - Groups

uid memberUid cn userPassword gidNumber member

Appliance Services 317

Joining an AD Domain (BUI)

■ uniqueMember memberOf isMemberOf

Related Topics

“Adding an Appliance Administrator (BUI)” on page 311

“Setting Properties with Multiple Attribute Value Pairs (CLI)” on page 312

“LDAP Properties” on page 315

Active Directory Configuration

The Active Directory service provides access to a Microsoft Active Directory database, which stores information about users, groups, shares, and other shared objects. This service has two modes: domain and workgroup mode, which dictate how SMB users are authenticated. When operating in domain mode, SMB clients are authenticated through the AD domain controller.

In workgroup mode, SMB clients are authenticated locally as local users. See

“Configuring

Users” on page 202

for more information on local users.

To configure Active Directory, see the following sections:

“Joining an AD Domain (BUI)” on page 318

“Joining an AD Workgroup (BUI)” on page 319

“Configuring Active Directory (CLI)” on page 319

“Active Directory Join Domain” on page 321

“Active Directory Domains and Workgroups” on page 322

“Active Directory Windows Server Support” on page 322

1.

2.

3.

4.

5.

Joining an AD Domain (BUI)

(Optional) Configure an Active Directory site in the SMB context.

(Optional) Configure a preferred domain controller in the SMB context.

Enable NTP, or ensure that the clocks of the appliance and domain controller are synchronized to within five minutes.

Ensure that your DNS infrastructure correctly delegates to the Active Directory domain, or add your domain controller’s IP address as an additional name server in the DNS context.

Go to Configuration > Services > Active Directory and click Join Domain.

318 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Joining an AD Workgroup (BUI)

6.

7.

Configure the Active Directory domain, administrative user name, and administrative password.

Click APPLY to commit the configuration.

Related Topics

“Joining an AD Workgroup (BUI)” on page 319

“Configuring Active Directory (CLI)” on page 319

“Active Directory Join Domain” on page 321

“Active Directory Domains and Workgroups” on page 322

“Active Directory Windows Server Support” on page 322

1.

2.

3.

Joining an AD Workgroup (BUI)

Go to Configuration > Services > Active Directory and click Join Workgroup.

Enter the Windows workgroup name.

Click APPLY to commit the configuration.

Related Topics

“Joining an AD Domain (BUI)” on page 318

“Configuring Active Directory (CLI)” on page 319

“Active Directory Join Domain” on page 321

“Active Directory Domains and Workgroups” on page 322

“Active Directory Windows Server Support” on page 322

1.

2.

Configuring Active Directory (CLI)

Go to configuration services ad.

hostname:> configuration services ad

To view an existing configuration, enter show.

hostname:configuration services ad> show

Properties:

<status> = online

mode = domain

domain = eng.fishworks.com

Appliance Services 319

Configuring Active Directory (CLI)

3.

4.

5.

Children:

domain => Join an Active Directory domain

workgroup => Join a Windows workgroup

Observe that the appliance is currently operating in the domain eng.fishworks.

com

.

Following is an example of leaving that domain and joining a workgroup.

hostname:configuration services ad> workgroup hostname:configuration services ad workgroup> set workgroup=WORKGROUP hostname:configuration services ad workgroup> commit hostname:configuration services ad workgroup> done hostname:configuration services ad> show

Properties:

<status> = disabled

mode = workgroup

workgroup = WORKGROUP

To configure the site and preferred domain controller in preparation for joining another domain, enter the following commands:

hostname:configuration services ad> done hostname:> configuration services smb hostname:configuration services smb> set ads_site=sf hostname:configuration services smb> set pdc=192.168.3.21 hostname:configuration services smb> commit hostname:configuration services smb> show

Properties:

<status> = online

lmauth_level = 4

pdc = 192.168.3.21

ads_site = sf hostname:configuration services smb> done

To join the new domain after the properties are configured, enter the following commands.

When joining an AD domain, you must set the user and password each time you commit the node.

hostname:> configuration services ad hostname:configuration services ad> domain hostname:configuration services ad domain> set domain=fishworks.com hostname:configuration services ad domain> set user=Administrator hostname:configuration services ad domain> set password=******* hostname:configuration services ad domain> commit hostname:configuration services ad domain> done

320 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Active Directory (CLI) hostname:configuration services ad> show

Properties:

<status> = online

mode = domain

domain = fishworks.com

Related Topics

“Joining an AD Domain (BUI)” on page 318

“Joining an AD Workgroup (BUI)” on page 319

“Active Directory Join Domain” on page 321

“Active Directory Domains and Workgroups” on page 322

“Active Directory Windows Server Support” on page 322

Active Directory Join Domain

If an account does not already exist in Active Directory by default, a machine trust account for the system is automatically created in the default container for computer accounts

(cn=Computers) as part of the domain join operation. The following users are allowed to perform domain join:

Domain administrator - Can join any number of systems to the domain with machine trust accounts placed in any containers.

Delegated administrator with authority over one or more Organizational Units - Can join any number of systems to a domain with machine account location designated in the

Organizational Units they are responsible for.

Normal user with machine accounts pre-staged by administrator - Can join a system to the domain as pre-authorized by an administrator.

Normal user - Normally authorized to join a limited number of systems.

The following properties for joining an Active Directory domain are available:

Active Directory Domain - The fully-qualified name or NetBIOS name of an Active

Directory domain

User - An AD user who has credentials to create a computer account in Active Directory

Password - The administrative user's password

Organizational Unit - Specifies an alternative organizational unit in which the system's machine trust account will be created. The organizational unit is specified as a commaseparated list of one or more name-value pairs using the domain-relative distinguished name

(DN) format, for example, ou=innerOU,ou=outerOU.

Use Pre-created Account - If the system's account exists and the specified Organizational

Unit is not the one that the account is in, use the pre-created account.

Appliance Services 321

Configuring Active Directory (CLI)

Related Topics

“Joining an AD Domain (BUI)” on page 318

“Joining an AD Workgroup (BUI)” on page 319

“Configuring Active Directory (CLI)” on page 319

“Active Directory Domains and Workgroups” on page 322

“Active Directory Windows Server Support” on page 322

Active Directory Domains and Workgroups

The configurable property for joining a workgroup is Windows Workgroup.

Instead of enabling and disabling the service directly, the service is modified by joining a domain or a workgroup. Joining a domain involves creating an account for the appliance in the given Active Directory domain. The account name can be a maximum of 15 characters, and must be unique to other names registered within the Active Directory domain. Otherwise, conflicts may occur with similarly named appliances and cause issues with functionality. After the computer account has been established, the appliance can securely query the database for information about users, groups, and shares.

Joining a workgroup implicitly leaves an Active Directory domain, and SMB clients who are stored in the Active Directory database will be unable to connect to shares.

Active Directory LDAP Signing

There is no configuration option for LDAP signing, as that option is negotiated automatically when communicating with a domain controller. LDAP signing operates on communication between the storage appliance and the domain controller, whereas SMB signing operations on communication between SMB clients and the storage appliance.

Related Topics

“Joining an AD Domain (BUI)” on page 318

“Joining an AD Workgroup (BUI)” on page 319

“Configuring Active Directory (CLI)” on page 319

“Active Directory Join Domain” on page 321

“Active Directory Windows Server Support” on page 322

Active Directory Windows Server Support

Windows Server 2012 is fully supported in software version 2011.1.5 (and later).

322 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Active Directory (CLI)

TABLE 82

Active Directory Windows Server 2008 Support

Windows Version

Windows Server 2003

Windows Server 2008 SP1

Supported Software Versions

All

2009.Q2 3.1 and earlier

2009.Q2 4.0 - 2011.1.1

Windows Server 2008 SP2

Windows Server 2008 R2

2011.1.2 and later

2009.Q2 4.0 - 2011.1.1

2011.1.2 and later

2009.Q2 4.0 - 2011.1.1

2011.1.2 and later

Workarounds

None

Apply hotfix for KB957441 as needed, see Section B.

Must apply hotfix for KB951191 and apply hotfix for KB957441 as needed, see Sections A and B.

Must apply hotfix for KB951191, see

Section A.

See Section C.

None

See Section C.

None

Active Directory Windows Server 2008 Support Section A: Kerberos issue (KB951191)

If you upgrade to 2009.Q2.4.0 or later and your Windows 2008 domain controller is running

Windows Server 2008 SP2 or R2, no action is required.

If you upgrade to 2009.Q2.4.0 or later and your Windows 2008 domain controller is running

Windows Server 2008 SP1, you must apply the hotfix described in KB951191 or install

Windows 2008 SP2.

Active Directory Windows Server 2008 Support Section B: NTLMv2 issue (KB957441)

The following applies only if your appliance is running a software version prior to 2011.1.2:

If your Domain Controller is running Windows Server 2008 SP1 you should also apply the hotfix for http://support.microsoft.com/kb/957441/ (http://support.microsoft.com/ kb/957441/

) which resolves an NTLMv2 issue that prevents the appliance from joining the domain with its default LMCompatibilityLevel setting.

If the LMCompatibilityLevel on the Windows 2008 SP1 domain controller is set to 5, this hot fix must be installed. After applying the hotfix you must create and set a new registry key as described in KB957441.

If you upgrade to 2011.1.2 or later, you do not need the hotfix mentioned above.

Active Directory Windows Server 2008 Support Section C: Note on NTLMv2

The following applies only if your appliance is running a software version prior to 2011.1.2:

If your Domain Controller is running Windows Server 2008 SP2 or R2 you do not need to apply the hotfix but you must apply the registry setting as described in KB957441.

If you upgrade to 2011.1.2 or later, no action is required.

Related Topics

Appliance Services 323

Configuring Identity Mapping (BUI)

“Joining an AD Domain (BUI)” on page 318

“Joining an AD Workgroup (BUI)” on page 319

“Configuring Active Directory (CLI)” on page 319

“Active Directory Join Domain” on page 321

“Active Directory Domains and Workgroups” on page 322

Identity Mapping Configuration

Identity mapping allows you to associate Windows and UNIX identities, thereby allowing an

SMB client and an NFS client access to the same set of files. The identity mapping service manages Windows and UNIX user identities simultaneously by creating and maintaining a database of mappings between UNIX user identifiers (UIDs) and group identifiers (GIDs), and

Windows security identifiers (SIDs).

To manage identity mapping, use these tasks:

Configuring Identity Mapping -

BUI ,

CLI

Creating a Mapping Rule - BUI ,

CLI

“Viewing a Mapping (BUI)” on page 331

Flushing Mappings from the Cache -

BUI

,

CLI

To understand identity mapping, use these topics:

“Identity Mapping Best Practices” on page 333

“Identity Mapping Concepts” on page 333

“Cached and Ephemeral Mappings” on page 334

“Identity Mapping Case Sensitivity” on page 334

“Mapping Rule Directional Symbols” on page 335

Configuring Identity Mapping (BUI)

Before You Begin

1.

2.

Use the following procedure to configure identity mapping.

Ensure that you are joined to at least one Active Directory domain. For information about active directories, see

“Active Directory Configuration” on page 318

.

Go to Configuration > Services > Identity Mapping > Properties.

Select one of the following mapping modes.

Rule-based

Directory-based - Set all of the following attributes.

324 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring Identity Mapping (CLI)

3.

AD Attribute - UNIX User Name - Name in the Active Directory database of the equivalent UNIX user name

AD Attribute - UNIX Group Name - Name in the Active Directory database of the equivalent UNIX group name

Native LDAP Attribute - Windows User Name - Name in the LDAP database of the equivalent Windows identity

IDMU

To save your settings, click APPLY. To clear your settings, click REVERT.

Related Topics

For information on the different mapping modes, see “Identity Mapping

Concepts” on page 333 .

To create an "allow" or "deny" mapping rule, see

“Creating a Mapping Rule

(BUI)” on page 326 .

Configuring Identity Mapping (CLI)

Before You Begin

1.

2.

3.

Use the following procedure to configure identity mapping.

Ensure that you are joined to at least one Active Directory domain.

Go to configuration services idmap.

Enter get to view the identity mapping properties.

hostname:configuration services idmap> get

<status> = online ad_unixuser_attr = ad_unixgroup_attr = nldap_winname_attr = directory_based_mapping = none

The three *_attr properties correspond to the three fields on C>S>Identity

Mapping>Properties.

Set directory_based_mapping to one of the following mapping modes.

To use rule-based mapping, set directory_based_mapping to none.

hostname:configuration services idmap> set directory_based_mapping=none

Appliance Services 325

Creating a Mapping Rule (BUI) hostname:configuration services idmap>

To use directory-based mapping, set directory_based_mapping to name and assign each of the following attributes.

ad_unixuser_attr - Name in the Active Directory database of the equivalent UNIX user name

ad_unixgroup_attr - Name in the Active Directory database of the equivalent UNIX group name

nldap_winname_attr - Name in the LDAP database of the equivalent Windows identity hostname:configuration services idmap> set directory_based_mapping=name hostname:configuration services idmap> set ad_unixuser_attr=demo_unixuser hostname:configuration services idmap> set ad_unixgroup_attr=demo_group hostname:configuration services idmap> set nldap_winname_attr=demo_winuser

To use Identity Management for UNIX (IDMU), set directory_based_mapping to idmu

.

hostname:configuration services idmap> set directory_based_mapping=idmu hostname:configuration services idmap>

Related Topics

For information on the different mapping modes, see “Identity Mapping

Concepts” on page 333

.

To create an "allow" or "deny" mapping rule, see

“Creating a Mapping Rule

(CLI)” on page 328 .

Creating a Mapping Rule (BUI)

Use the following procedure to grant or deny credentials for specific users through the identity mapping service. An "allow" mapping rule grants Windows identity credentials from a UNIX identity or vice versa. A "deny" mapping rule blocks a Windows identity from receiving the credentials of a UNIX identity or vice versa.

Note -

If you create a mapping rule that blocks a particular user, and the user's name then changes, the mapping no longer blocks that user.

Before You Begin

Configure rule-based mapping as described in

“Configuring Identity Mapping

(BUI)” on page 324 .

326 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Mapping Rule (BUI)

1.

2.

Go to Configuration > Services > Identity Mapping > Rules.

3.

4.

5.

Click the add item icon next to Rules.

In the Add Mapping Rule dialog box, choose either Allow or Deny for the mapping type.

Complete the remaining fields according to the selected mapping type.

Allow mapping:

Mapping Direction - Choose a direction.

Windows Domain - Type the Active Directory domain of the Windows identity, or select All.

Windows Identity - Type the name of the Windows identity.

Unix Identity - Type the name of the UNIX identity.

Unix Identity Type - Select either User or Group.

Deny mapping: a. For Mapping Direction, choose one of the two options.

Block Windows identity mapping - Prevents a Windows identity from gaining the credentials of a UNIX identity

Block Windows identity mapping - Prevents a UNIX identity from gaining the credentials of a Windows identity

b.

Enter the Windows or UNIX identity information.

If you selected Block Windows identity mapping, type the Windows domain and identity you want to block.

If you selected Block UNIX identity mapping, type the UNIX identity and identity type you want to block.

Click ADD.

The new mapping appears in the Rules list.

Related Topics

“Mapping Rule Directional Symbols” on page 335

Appliance Services 327

Creating a Mapping Rule (CLI)

Creating a Mapping Rule (CLI)

Use the following procedure to grant or deny credentials for specific users through the identity mapping service. An "allow" mapping rule grants Windows identity credentials from a UNIX identity or vice versa. A "deny" mapping rule blocks a Windows identity from receiving the credentials of a UNIX identity or vice versa.

Note -

if you create a mapping rule that blocks a particular user and the user's name then changes, the mapping no longer blocks that user.

Before You Begin

Configure rule-based mapping as described in

“Configuring Identity Mapping

(CLI)” on page 325

.

1.

Go to configuration services idmap.

2.

Enter create.

hostname:configuration services idmap> create hostname:configuration services idmap (uncommitted)>

3.

Set the properties appropriately.

You can use the list command to view the available properties.

hostname:configuration services idmap (uncommitted)> list

Properties:

windomain = (unset)

winname = (unset)

direction = (unset)

unixname = (unset)

unixtype = (unset)

a. windomain

- Active Directory domain of the Windows identity.

b. winname

- Set to one of the following options.

To create an "allow" mapping, set winname to the name of the Windows identity.

Enter

*

to indicate all users within the specified domain.

To create a "deny" mapping that blocks a UNIX identity from receiving the credentials of a Windows identity, set to the name of the Windows identity.

328 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Mapping Rule (CLI)

To create a "deny" mapping that blocks a Windows identity from receiving the credentials of a UNIX identity, do not set winname.

c. direction

- Set to the direction of the mapping:

win2unix

- Mapping from Windows to UNIX

unix2win

- Mapping from UNIX to Windows

bi

- Bidirectional mapping

4.

d. unixname

- Set to one of the following options:

To create an "allow" mapping, set to the name of the UNIX identity, or enter

*

to indicate all users of the specified type.

To create a "deny" mapping that blocks a Windows identity from receiving the credentials of a UNIX identity, set to the name of the UNIX identity.

To create a "deny" mapping that blocks a UNIX identity from receiving the credentials of a Windows identity, do not set unixname.

e. unixtype

- Set to either user

or group

for the UNIX identity type.

hostname:configuration services idmap (uncommitted)> set windomain=demo.domain.com hostname:configuration services idmap (uncommitted)> set winname=* hostname:configuration services idmap (uncommitted)> set direction=win2unix hostname:configuration services idmap (uncommitted)> set unixname= hostname:configuration services idmap (uncommitted)> set unixtype=user

Enter commit

to commit the changes and create the mapping rule.

hostname:configuration services idmap (uncommitted)> commit hostname:configuration services idmap>

You can use the list command to view the new rule in the Rules list.

hostname:configuration services idmap> list

MAPPING WINDOWS ENTITY DIRECTION UNIX ENTITY idmap-000 [email protected] (U) == wdp (U) idmap-001 *@demo.domain.com (U) => "" (U)

Appliance Services 329

Creating a Mapping Rule (CLI)

Example 13

Creating a Bi-Directional Mapping (CLI)

This example creates a bi-directional name-based mapping between a Windows user and UNIX user.

hostname:> configuration services idmap hostname:configuration services idmap> create hostname:configuration services idmap (uncommitted)> set

windomain=eng.fishworks.com

hostname:configuration services idmap (uncommitted)> set winname=Bill hostname:configuration services idmap (uncommitted)> set direction=bi hostname:configuration services idmap (uncommitted)> set unixname=wdp hostname:configuration services idmap (uncommitted)> set unixtype=user hostname:configuration services idmap (uncommitted)> commit hostname:configuration services idmap> list

MAPPING WINDOWS ENTITY DIRECTION UNIX ENTITY idmap-000 [email protected] (U) == wdp (U)

Example 14

Creating a Deny Mapping (CLI)

This example creates a deny mapping to prevent all Windows users in a domain from obtaining credentials.

hostname:configuration services idmap> create hostname:configuration services idmap (uncommitted)> list

Properties:

windomain = (unset)

winname = (unset)

direction = (unset)

unixname = (unset)

unixtype = (unset) hostname:configuration services idmap (uncommitted)> set

windomain=guest.fishworks.com

hostname:configuration services idmap (uncommitted)> set winname=* hostname:configuration services idmap (uncommitted)> set direction=win2unix hostname:configuration services idmap (uncommitted)> set unixname= hostname:configuration services idmap (uncommitted)> set unixtype=user hostname:configuration services idmap (uncommitted)> commit hostname:configuration services idmap> list

MAPPING WINDOWS ENTITY DIRECTION UNIX ENTITY idmap-000 [email protected] (U) == wdp (U) idmap-001 *@guest.fishworks.com (U) => "" (U)

330 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing a Mapping (BUI)

Viewing a Mapping (BUI)

1.

2.

3.

Use the following procedure to view an existing mapping.

Go to Configuration > Services > Identity Mapping > Show Mappings.

Choose either Windows or UNIX for the platform from which the identity is mapped.

Enter the Windows or UNIX identity information.

If you selected Windows, type the Windows domain and name of the user.

4.

If you selected UNIX, choose either User or Group for the type, and type the entity name.

Click SHOW MAPPING.

The identity user or group properties are displayed. The mapping source and backend origin are also displayed:

Source

New mapping - The mapping was newly created and was neither retrieved from the cache nor predefined.

Cached mapping - The mapping was retrieved from the cache, where mappings are stored for 10 minutes after they are requested.

Hard coded mapping - The mapping is predefined and fixed on the appliance. These mappings were created for default UNIX and Windows identities.

Algorithmic mapping - A non-ephemeral UNIX UID or GID could not be mapped by name, so it was mapped to an algorithmically generated SID.

Backend

AD Directory - This is a directory-based mapping that was created using annotations in the

Active Directory.

Native LDAP Directory - This is a directory-based mapping that was created using annotations in the LDAP directory.

IDMU - The mapping was created using the Windows feature Identity Management for

UNIX.

Name rule - The mapping was created using a name rule.

Ephemeral - Since there was no equivalent identity at the time the mapping was created, the system created a temporary one using an ephemeral UID or GID.

Appliance Services 331

Flushing Mappings from the Cache (BUI)

Local SID - A non-ephemeral UNIX UID or GID could not be mapped by name, so it was mapped to an algorithmically generated local SID.

Well-known mapping - The mapping uses a "well-known SID." These Windows SIDs identify generic users or generic groups. Their values remain constant across all operating systems.

Flushing Mappings from the Cache (BUI)

1.

2.

Use the following procedure to flush, or expire, all mappings from the cache.

After a requested mapping has been provided, it is stored in the cache for 10 minutes and then expires. You can immediately expire a mapping by using the flush function, which expires all cached mappings.

Go to Configuration > Services > Identity Mapping > Show Mappings.

Click FLUSH MAP CACHE.

All cached mappings are expired.

Flushing Mappings from the Cache (CLI)

1.

2.

Use the following procedure to flush, or expire, all mappings from the cache.

After a requested mapping has been provided, it is stored in the cache for 10 minutes and then expires. You can immediately expire a mapping by using the flush function, which expires all cached mappings.

Go to configuration services idmap.

Enter flush.

hostname:configuration services idmap> flush hostname:configuration services idmap>

All cached mappings are expired.

332 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Flushing Mappings from the Cache (CLI)

Identity Mapping Best Practices

Configure user-specific identity mapping rules when you want a user to have access to a common set of files through both NFS and SMB clients. If NFS and SMB clients are accessing disjointed filesystems, there is no need to configure any identity mapping rules.

Reconfiguring the identity mapping service does not affect active SMB sessions. Connected users remain connected, and their previous name mapping is available for authorizing access to additional shares for up to 10 minutes. To prevent unauthorized access, configure the mappings before exporting shares.

The security that your identity mappings provide is only as good as their synchronization with your directory services. For example, if you create a name-based mapping that denies access to a particular user, and the user's name changes, the mapping no longer denies access to that user.

You can only have one bidirectional mapping for each Windows domain that maps all users in the Windows domain to all UNIX identities. If you want to create multiple domain-wide rules, be sure to specify that those rules map only from Windows to UNIX.

Use the IDMU mapping mode instead of directory-based mapping whenever possible.

Identity Mapping Concepts

The SMB service uses the identity mapping service to associate Windows and UNIX identities.

When the SMB service authenticates a user, it uses the identity mapping service to map the user's Windows identity to the appropriate UNIX identity. If no UNIX identity exists for a

Windows user, the service generates a temporary identity using an ephemeral UID and GID.

These mappings allow a share to be exported and accessed concurrently by SMB and NFS clients. By associating Windows and UNIX identities, NFS and SMB clients can share the same identity, thereby allowing access to the same set of files.

In the Windows operating system, an access token contains the security information for a login session and identifies the user, the user's groups, and the user's privileges. Administrators define

Windows users and groups in a Workgroup, or in a SAM database, which is managed on an

Active Directory domain controller. Each user and group has a SID, which uniquely identifies the user or group, both within a host and a local domain, and across all possible Windows domains.

UNIX creates user credentials based on user authentication and file permissions. Administrators define UNIX users and groups in local password and group files or in a name or directory service, such as NIS or LDAP. Each UNIX user and group has a UID and GID. Typically, the

UID or GID uniquely identifies a user or group within a single UNIX domain. However, these values are not unique across domains.

The following options are available when selecting a mapping mode:

Appliance Services 333

Flushing Mappings from the Cache (CLI)

Rule-based Mapping - Use for creating various rules that map identities by name, thus establishing equivalences between Windows and UNIX identities. Mapping rules are useful when you want a user to access the same set of files through both SMB and NFS clients.

Directory-based Mapping - Use for annotating an LDAP or Active Directory object with information about how the identity maps to an equivalent identity on the opposite platform.

IDMU-based Mapping - Identity Management for UNIX (IDMU) is a feature that

Microsoft offers for Windows Server 2003, and is bundled with Windows Server

2003 R2 and later. IDMU supports Windows as a NIS/NFS server by adding a "UNIX

Attributes" panel to the Active Directory Users and Computers user interface. This allows administrators to specify a number of UNIX-related parameters, including UID, GID, login shell, and home directory. These parameters are made available through Active

Directory using a schema similar to, but not the same as, RFC 2307, and through the NIS service. When the IDMU mapping mode is selected, the identity mapping service consumes these UNIX attributes to establish mappings between Windows and UNIX identities. This approach is very similar to directory-based mapping, except that the identity mapping service queries the property schema established by the IDMU software instead of allowing a custom schema. When this approach is used, no other directory-based mapping may occur.

Cached and Ephemeral Mappings

When the identity mapping service provides a name mapping, it stores the mapping in the cache for 10 minutes, at which point the mapping expires. Within its 10-minute life, a mapping is persistent across restarts of the identity mapping service. Changes to the mappings or to the name service directories do not affect existing connections within the 10-minute life of a mapping. The service evaluates mappings only when the client tries to connect to a share and there is no unexpired mapping. For example, if the SMB server requests a mapping for the user after the mapping has expired, the service re-evaluates the mapping.

If no name-based mapping rule applies for a particular user, that user will be given temporary credentials through an ephemeral mapping unless the user is blocked by another mapping.

When a Windows user with an ephemeral UNIX name creates a file on the system, Windows clients accessing the file using SMB see that the file is owned by that Windows identity.

However, NFS clients see that the file is owned by "nobody".

Identity Mapping Case Sensitivity

Windows names are not case sensitive, but UNIX names are case sensitive. The user names

JSMITH, JSmith, and jsmith are equivalent names in Windows, but they are three distinct names in UNIX. Case sensitivity affects name mappings differently depending on the direction of the mapping.

334 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Flushing Mappings from the Cache (CLI)

For a Windows-to-UNIX mapping to produce a match, the case of the Windows user name must match the case of the UNIX user name. For example, only Windows user name

"jsmith" matches UNIX user name "jsmith". Windows user name "Jsmith" does not match.

An exception to the case matching requirement for Windows-to-UNIX mappings occurs when the mapping uses the wildcard character "*" to map multiple user names.

If the identity mapping service encounters a mapping that maps Windows user *@some.

domain to UNIX user "*", it first searches for a UNIX name that matches the Windows name exactly. If it does not find a match, the service converts the entire Windows name to lower case and searches again for a matching UNIX name. For example, the Windows user name "[email protected]" maps to UNIX user name "jsmith". If the service does not find a match after using lowercase for the Windows user name, the user does not obtain a mapping.

You can create a rule to match strings that differ only in case. For example, you can create a user-specific mapping to map the Windows user "[email protected]" to UNIX user

"jSmith". Otherwise, the service assigns an ephemeral ID to the Windows user.

For a UNIX-to-Windows mapping to produce a match, the case does not have to match.

For example, UNIX user name "jsmith" matches any Windows user name with the letters

"JSMITH" regardless of case.

Mapping Rule Directional Symbols

After creating a name-based mapping, the following symbols indicate the semantics of each rule.

- Maps Windows identity to UNIX identity and UNIX identity to Windows identity

- Maps Windows identity to UNIX identity

- Maps UNIX identity to Windows identity

- Prevents Windows identity from obtaining credentials

- Prevents UNIX identity from obtaining credentials

If an icon is gray instead of black, the rule matches a UNIX identity that cannot be resolved.

DNS Configuration

The DNS (Domain Name Service) client provides the ability to resolve IP addresses to hostnames and vice versa, and can be enabled or disabled. Optionally, secondary hostname resolution via NIS and/or LDAP, if configured and enabled, may be requested for hostnames and addresses that cannot be resolved using DNS. Hostname resolution is used throughout

Appliance Services 335

Configuring DNS (BUI) the appliance user interfaces, including in Logs to indicate the location from which a user performed an auditable action and in Analytics to provide statistics on a per-client basis.

To configure and manage DNS, use these tasks:

Configuring DNS - BUI

,

CLI

“Testing Hostname Resolution (CLI)” on page 337

Adding a DNS Server - BUI

,

CLI

Viewing DNS Server Status -

BUI , CLI

To understand DNS usage for the appliance, use these topics:

“DNS Properties and Logs” on page 340

“Active Directory and DNS” on page 341

“Non-DNS Resolution” on page 341

“DNS-Less Operation” on page 342

Configuring DNS (BUI)

1.

2.

3.

DNS is usually configured during initial configuration, as described in “Performing Initial

Configuration (BUI)” in Oracle ZFS Storage Appliance Installation Guide . To change your

DNS settings after initial configuration, use the following procedure.

Go to Configuration > Services > DNS.

Under General Settings, set the following properties:

For more information about DNS properties, see

“DNS Properties and Logs” on page 340 .

DNS Domain - Enter a domain name.

DNS Search Domain(s) - Click the add icon to add search domain(s). To remove a domain, click the remove icon beside it.

Allow IPv4 non-DNS resolution - Check this box to enable IPv4 non-DNS resolution. See

“Non-DNS Resolution” on page 341 .

Allow IPv6 non-DNS resolution - Check this box to enable IPv6 non-DNS resolution. See

“Non-DNS Resolution” on page 341 .

Click APPLY.

Related Topics

“Adding a DNS Server (BUI)” on page 338

336 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring DNS (CLI)

1.

2.

3.

Configuring DNS (CLI)

DNS is usually configured during initial configuration, as described in “Performing Initial

Configuration (CLI)” in Oracle ZFS Storage Appliance Installation Guide . To change your

DNS settings after initial configuration, use the following procedure.

Go to configuration services dns and then enter show.

hostname:> configuration services dns hostname:configuration services dns> show

Properties:

<status> = online

domain = example.com

servers = 192.0.2.254

search =

allow_alternate_v4 = false

allow_alternate_v6 = false

Set the domain, servers, and search domain, and enable or disable non-DNS resolution.

For more information, see “DNS Properties and Logs” on page 340

and “Non-DNS

Resolution” on page 341 .

hostname:configuration services dns> set domain=example.com

domain = example.com (uncommitted) hostname:configuration services dns> set servers=192.0.2.253

servers = 192.0.2.253 (uncommitted) hostname:configuration services dns> set search=example.com

search = example.com (uncommitted) hostname:configuration services dns> set allow_alternate_v4=true

allow_alternate_v4 = true (uncommitted)

Enter commit.

hostname:configuration services dns> commit

Related Topics

“Adding a DNS Server (CLI)” on page 338

Testing Hostname Resolution (CLI)

The CLI includes built-ins for nslookup and getent hosts, which can be used to test that hostname resolution is working:

Appliance Services 337

Adding a DNS Server (BUI) hostname:> nslookup deimos

198.51.100.1 deimos.sf.fishworks.com

hostname:> getent hosts deimos

198.51.100.1 deimos.sf.fishworks.com

3.

4.

1.

2.

Adding a DNS Server (BUI)

Go to Configuration > Services > DNS.

Click the add icon beside DNS Servers.

In the New DNS Server dialog box, enter the server IP address.

Click ADD.

A query is sent to the affected DNS servers to validate the changes. If a valid response is not received, a message appears to confirm the settings. You may confirm your changes regardless of whether the server is valid.

Related Topics

“Viewing DNS Server Status (BUI)” on page 339

1.

2.

3.

Adding a DNS Server (CLI)

Go to configuration services dns and then enter create.

hostname:> configuration services dns hostname:configuration services dns> create

Enter show.

hostname:configuration services server (uncommitted)> show

Properties:

address = (unset)

status = unavailable

rtt = unavailable

err_msg =

Enter set address= and the server address.

hostname:configuration services server (uncommitted)> set address=192.0.2.254

338 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing DNS Server Status (BUI)

4.

5.

address = 192.0.2.254 (uncommitted)

Enter show.

hostname:configuration services server (uncommitted)> show

Properties:

address = 192.0.2.254

status = online

rtt = 1.812ms

err_msg =

Enter commit.

A query is sent to the affected DNS servers to validate the changes. If a valid response is not received, a message appears to confirm the settings. You may confirm your changes regardless of whether the server is valid.

hostname:configuration services server (uncommitted)> commit

Related Topics

“Viewing DNS Server Status (CLI)” on page 339

Viewing DNS Server Status (BUI)

1.

2.

Details about the DNS servers are displayed beside each entry in the BUI. A status indicator shows if the server status is online, offline, or unknown. The RTT column indicates the roundtrip time, in milliseconds, to receive a valid response.

Go to Configuration > Services > DNS.

Under DNS Servers, check the status indicator beside each server entry:

Green icon - Online

Amber icon - Offline

Gray icon - Unknown

Viewing DNS Server Status (CLI)

Select a DNS server to view its properties. The status property indicates if the server status is online, offline, or unknown. The rtt property indicates the round-trip time, in milliseconds, to

Appliance Services 339

Viewing DNS Server Status (CLI)

1.

2.

3.

receive a valid response. If the server status is offline, the err_msg property displays the reason, for example, Connection timed out.

Go to configuration services dns and then enter show.

hostname:> configuration services dns hostname:configuration services dns> show

SERVER STATUS ADDRESS server-000 online 198.51.100.1

server-001 offline 198.51.100.2

Select the server for which you want to view its status.

hostname:configuration services dns> select server-000

Enter show.

hostname:configuration services server-000> show

Properties:

address = 198.51.100.1

status = online

rtt = 1.768ms

err_msg =

DNS Properties and Logs

The configurable properties for the DNS client include a base domain name and a list of servers, specified by IP address. You must supply a domain name and at least one server address; the server must be capable of returning an NS (NameServer) record for the domain you specify, although it need not itself be authoritative for that domain.

TABLE 83

Property

DNS Domain

DNS Properties

DNS Server(s)

DNS Search Domain(s)

Allow IPv4 non-DNS resolution

Allow IPv6 non-DNS resolution

Description

Domain name to search first when performing partial hostname lookups.

One or more DNS servers. IP addresses must be used.

List of up to four domains to be searched for after the Active Directory domain, the deprecated Active

Directory search domain, and the specified DNS domain.

IPv4 addresses may be resolved to hostnames, and hostnames to IPv4 addresses, using NIS and/or LDAP if configured and enabled.

IPv4 and IPv6 addresses may be resolved to hostnames, and hostnames to IPv4 and IPv6 addresses, using NIS and/or LDAP if configured and enabled.

340 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing DNS Server Status (CLI)

Changing services properties is documented in

“Setting Service Properties

(BUI)” on page 252

and

“Setting Service Properties (CLI)” on page 253

. The CLI property names are shorter versions of those listed above.

TABLE 84

DNS Logs

Log

network-dns-client:default

Description

Logs the DNS service events

Related Topics

“Active Directory and DNS” on page 341

Active Directory and DNS

If you plan to use Active Directory, the servers must be able to resolve hostname and server records in the Active Directory portion of the domain namespace. For example, if your appliance resides in the domain example.com and the Active Directory portion of the namespace is redmond.example.com, your nameservers must be able to reach an authoritative server for example.com, and they must provide delegation for the domain redmond.example.

com to one or more Active Directory servers serving that domain. These are requirements imposed by Active Directory, not the appliance itself. If they are not satisfied, you will be unable to join an Active Directory domain.

Related Topics

“DNS Configuration” on page 335

“Active Directory Configuration” on page 318

Non-DNS Resolution

DNS is a standard, enterprise-grade, highly-scalable and reliable mechanism for mapping between hostnames and IP addresses. Use of working DNS servers is a best practice and will generally yield the best results. In some environments, there may be a subset of hosts that can be resolved only in NIS or LDAP maps. If this is the case in your environment, enable non-

DNS host resolution and configure the appropriate directory service(s). If LDAP is used for host resolution, the hosts map must be located at the standard DN in your database: ou=Hosts,

(Base DN), and must use the standard schema. When this mode is used with NFS sharing by netgroups, it may be necessary for client systems to use the same hostname resolution mechanism configured on the appliance, or NFS sharing exceptions may not work correctly.

When non-DNS host resolution is enabled, DNS will still be used. Only if an address or hostname cannot be resolved using DNS will NIS (if enabled) and then LDAP (if enabled)

Appliance Services 341

Viewing DNS Server Status (CLI) be used to resolve the name or address. This can have confusing and seemingly inconsistent results. You can validate host resolution results using the getent CLI command described above.

Use of these options is strongly discouraged.

DNS-Less Operation

If the appliance is unable to access any DNS servers from its installed location in the network, you may elect to operate without DNS by supplying the server address 127.0.0.1. To operate without DNS:

BUI: Go to Configuration > Services > DNS. In the field for DNS Server(s), enter

127.0.0.1

.

CLI: Go to configuration services dns and enter show. Enter set servers=127.0.0.1, and then enter commit.

Use of this mode is strongly discouraged, because several features will not work correctly, including:

Analytics will be unable to resolve client addresses to host names.

The Active Directory feature will not function (you will be unable to join a domain).

Use of SSL-protected LDAP will not work properly with certificates containing host names.

Alert and threshold actions that involve sending e-mail can only be sent to mail servers on an attached subnet, and all addresses must be specified using the mail server's IP address.

Some operations may take longer than normal due to hostname resolution timeouts.

These limitations may be partially mitigated by using an alternate host resolution service; see

“Non-DNS Resolution” on page 341

.

Related Topics

Enabling a Service

BUI

,

CLI

Disabling a Service

BUI , CLI

IPMP Configuration

IPMP (Internet Protocol Network Multipathing) allows multiple network interfaces to be grouped as one, for both improved network bandwidth and reliability (interface redundancy).

Some properties can be configured in this section. For the configuration of network interfaces in

IPMP groups, see “Network Configuration” on page 89

.

342 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Viewing DNS Server Status (CLI)

TABLE 85

IPMP Properties

Property

Failure detection latency

Enable fail-back

Description

Time for IPMP to declare a network interface has failed, and to fail over its IP addresses

Allow the service to resume connections to a repaired interface

Changing services properties is documented in

“Setting Service Properties

(BUI)” on page 252

and

“Setting Service Properties (CLI)” on page 253

. The CLI property names are shorter versions of those listed above.

TABLE 86

IPMP Logs

Log

network-initial:default

Description

Logs the network configuration process

Kerberos Configuration

Kerberos is a network protocol that uses secret-key cryptography to authenticate communication between a client and a host machine or service. It uses a Key Distribution

Center (KDC) server to issue time-stamped tickets. You can use the appliance to import

Kerberos principals and keys created on the KDC, or you can configure principals for the

KDC using the appliance, and their keys are automatically created. Although you can use both methods, importing is the best practice and most commonly used. All keys are encrypted using the Kerberos password and stored within the appliance keytab file.

Both Kerberos and Active Directory can be enabled at the same time because they have distinct realms and keys. When both are active, the Kerberos realm is the default.

The appliance can use Kerberos to authenticate users for administrative login and for access to services, including NFS, HTTP, FTP, SFTP, and SSH. An appliance user must have a Kerberos principal by the same name to use Kerberos authentication for these services. Kerberos can also be used to set security for individual shares that use the NFS protocol, as described in

“Configuring Kerberos Realms for NFS” on page 261

. Since the Kerberos service uses time stamps, configure the appliance NTP service first.

To configure Kerberos, see the following sections:

Creating a Kerberos Realm -

BUI

,

CLI

Importing Kerberos Keys - BUI

,

CLI

Creating Kerberos Principals and Keys -

BUI ,

CLI

Deleting Kerberos Principals and Keys -

BUI ,

CLI

Appliance Services 343

Creating a Kerberos Realm (BUI)

Destroying a Kerberos Realm -

BUI , CLI

“Kerberos Service Properties” on page 358

“Kerberos Properties and Logs” on page 358

“Configuring Kerberos Realms for NFS” on page 261

Creating a Kerberos Realm (BUI)

Before You Begin

1.

2.

3.

4.

Use the following procedure to create a Kerberos realm, set the KDC(s), and select strong or weak encryption types. Descriptions of each property are located in

“Kerberos Service

Properties” on page 358 .

Ensure that you have configured the

NTP service

.

Go to Configuration > Services.

To enable the Kerberos service, click the enable icon for Kerberos.

Click Kerberos.

In the Realm field, type the Kerberos realm.

For familiarity, the realm name can be the same as your DNS domain name, except that the realm name is in uppercase.

5.

In the KDC(s) field, type the host name of the KDC administrative server.

If your Kerberos configuration includes DNS support for KDC lookup, leave this field blank.

6.

If you have another KDC, click the add icon next to KDC(s) and type its host name. Repeat for each additional KDC.

344 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Kerberos Realm (CLI)

7.

8.

If your configuration includes DNS support, do not complete this step.

To allow support for weak encryption types, such as DES and Exportable

ArcFour with HMAC/md5, select Allow weak encryption types.

The default does not support weak encryption types.

Click APPLY.

To reset the properties to their original values, click REVERT instead.

Next Steps

Choose one of the following options:

“Importing Kerberos Keys (BUI)” on page 346

“Creating Kerberos Principals and Keys (BUI)” on page 350

Creating a Kerberos Realm (CLI)

Before You Begin

1.

2.

3.

4.

Use the following procedure to create a Kerberos realm, set the KDC(s), and select strong or weak encryption types. Descriptions of each property are located in

“Kerberos Service

Properties” on page 358

and

“Kerberos Properties and Logs” on page 358 .

Ensure that you have configured the

NTP service

.

Go to configuration services kerberos and enter show.

hostname:configuration services kerberos> show

Properties:

<status> = disabled

allow_weak_crypto = false

To enable the Kerberos service, enter enable and then enter commit.

To allow support for weak encryption types, such as DES and Exportable

ArcFour with HMAC/md5, enter set allow_weak_crypto=true and then enter commit.

The default does not support weak encryption types.

To create a realm, enter create and the realm name, and then enter commit.

For familiarity, the realm name can be the same as your DNS domain name, except that the realm name is in uppercase.

hostname:configuration services kerberos> create TEST.NET hostname:configuration services kerberos TEST.NET (uncommitted)> commit

Appliance Services 345

Importing Kerberos Keys (BUI)

5.

6.

7.

8.

Enter done.

To view all realms, enter list.

hostname:configuration services kerberos> list

REALM KDC

TEST.NET

Select the realm.

hostname:configuration services kerberos> select TEST.NET hostname:configuration services kerberos TEST.NET>

To configure the KDC server(s), enter set kdcs= and the KDC administrative server host name. If you have additional KDCs, add them to the same line and separate them by commas. Then enter commit.

If your Kerberos configuration includes DNS support for KDC lookup, do not perform this step.

hostname:configuration services kerberos TEST.NET> set kdcs=kdc1.us.oracle.com,kdc2.us.

oracle.com

kdcs = kdc1.us.oracle.com,kdc2.us.oracle.com (uncommitted) hostname:configuration services kerberos TEST.NET> commit

Next Steps

Choose one of the following options:

“Importing Kerberos Keys (CLI)” on page 348

“Creating Kerberos Principals and Keys (CLI)” on page 352

Importing Kerberos Keys (BUI)

Before You Begin

Use the following procedure to import Kerberos keys that were created on the KDC. The keys are then stored in the appliance keytab. This task does not require login credentials on the KDC.

Descriptions of each property are located in “Kerberos Service Properties” on page 358 .

Ensure that you have enabled the Kerberos service, set the realm, and identified the KDC(s) as described in

“Creating a Kerberos Realm (BUI)” on page 344

.

1.

2.

3.

Go to Configuration > Services.

Click Kerberos.

Click Keys and click IMPORT KEYS.

346 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Importing Kerberos Keys (BUI)

4.

5.

In the Import Keys dialog box, click Browse and select the Kerberos keytab file.

Click UPLOAD.

Appliance Services 347

Importing Kerberos Keys (CLI)

The list of keys is displayed.

Importing Kerberos Keys (CLI)

Before You Begin

Use the following procedure to import Kerberos keys that were created on the KDC. The keys are then stored in the appliance keytab. This task does not require login credentials on the KDC.

Descriptions of each property are located in “Kerberos Service Properties” on page 358 and

“Kerberos Properties and Logs” on page 358

.

Ensure that you have enabled the Kerberos service, set the realm, and identified the KDC(s) as described in

“Creating a Kerberos Realm (CLI)” on page 345

.

1.

Go to configuration services kerberos importkeytab and enter show to view the properties.

hostname:configuration services kerberos importkeytab (uncommitted)> show

Properties:

url = (unset)

user = (unset)

348 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Importing Kerberos Keys (CLI)

2.

3.

4.

5.

6.

7.

password = (unset)

Enter set url= and the URL of the Kerberos keytab file.

hostname:configuration services kerberos importkeytab (uncommitted)> set url=http://

akbuild1/shares/export/123456/demo.keytab

url = http://akbuild1/shares/export/123456/demo.keytab

Enter set user= and the user name for URL access.

hostname:configuration services kerberos importkeytab (uncommitted)> set user=myusername

user = myusername

Enter set password= and the password for URL access, and then enter commit.

hostname:configuration services kerberos importkeytab (uncommitted)> set

password=letmein

password = ******* hostname:configuration services kerberos importkeytab (uncommitted)> commit

Transferred 718 of 718 (100%) . . . done

Imported 8 keys.

Enter show to view the realms and KDCs.

hostname:configuration services kerberos> show

Properties:

<status> = online

allow_weak_crypto = true

Realms:

REALM KDC

TEST.NET kdc1.us.oracle.com

To view the principals for a realm, select a realm and enter show.

hostname:configuration services kerberos> select TEST.NET hostname:configuration services kerberos TEST.NET> show

Properties:

kdcs = kdc1.us.oracle.com

Keytab entries:

NAME KEYS PRINCIPAL principal-000 4 host/[email protected]

principal-001 4 nfs/[email protected]

To view the keys for a principal, select a principal and enter show.

hostname:configuration services kerberos TEST.NET> select principal-001 hostname:configuration services kerberos principal-001> show

Properties:

Appliance Services 349

Creating Kerberos Principals and Keys (BUI)

8.

name = nfs/[email protected]

Keys:

KEY KVNO ENCTYPENO ENCTYPE key-000 28 18 AES-256 CTS mode with 96-bit SHA-1 HMAC key-001 28 17 AES-128 CTS mode with 96-bit SHA-1 HMAC key-002 28 16 Triple DES cbc mode with HMAC/sha1 key-003 28 23 ArcFour with HMAC/md5 key-004 28 24 Exportable ArcFour with HMAC/md5 key-005 28 3 DES cbc mode with RSA-MD5 key-006 28 1 DES cbc mode with CRC-32

Legend for column headings:

KEY = Key name

KVNO = Key version number

ENCTYPENO = Encryption type number

ENCTYPE = Encryption type

To view the properties of a key, select a key and enter show.

hostname:configuration services kerberos principal-001> select key-003 hostname:configuration services kerberos principal-001 key-003> show

Properties:

principal = nfs/[email protected]

kvno = 28

enctype = ArcFour with HMAC/md5

enctypeno = 23

Creating Kerberos Principals and Keys (BUI)

Before You Begin

1.

Use the following procedure to create Kerberos principals on the KDC administrative server using the appliance. Keys are generated for each principal and stored in the appliance keytab.

Descriptions of each property are located in “Kerberos Service Properties” on page 358 .

Ensure that you have enabled the Kerberos service, set the realm, and identified the KDC(s) as described in

“Creating a Kerberos Realm (BUI)” on page 344 .

Ensure that you have login credentials on the KDC.

Go to Configuration > Services.

2.

3.

Click Kerberos.

Click Keys and click CREATE PRINCIPALS AND KEYS.

350 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating Kerberos Principals and Keys (BUI)

4.

In the KDC Admin Login dialog box, complete the following fields:

Realm - This field is auto-populated and cannot be modified.

Admin server - KDC administrative server host name. This field is auto-populated, but can be modified.

Admin principal - KDC administrator name for the realm.

Password - Password for the KDC administrator.

5.

6.

Click OK.

In the confirmation box, click OK.

Appliance Services 351

Creating Kerberos Principals and Keys (CLI)

The list of principals and keys is displayed.

Creating Kerberos Principals and Keys (CLI)

Before You Begin

1.

2.

Use the following procedure to create Kerberos principals on the KDC administrative server using the appliance. Keys are generated for each principal and stored in the appliance keytab.

Descriptions of each property are located in “Kerberos Service Properties” on page 358 and

“Kerberos Properties and Logs” on page 358

.

Ensure that you have enabled the Kerberos service, set the realm, and identified the KDC(s) as described in

“Creating a Kerberos Realm (CLI)” on page 345

.

Ensure that you have login credentials on the KDC.

Go to configuration services kerberos and enter list.

hostname:configuration services kerberos> list

REALM KDC

TEST.NET

Select the realm.

352 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating Kerberos Principals and Keys (CLI)

3.

4.

5.

6.

7.

hostname:configuration services kerberos> select TEST.NET hostname:configuration services kerberos TEST.NET>

To create the principals, enter principals and then enter show to view the properties.

hostname:configuration services kerberos TEST.NET> principals hostname:configuration services kerberos TEST.NET principals (uncommitted)> show

Properties:

realm = TEST.NET

server = kdc1.us.oracle.com

admin = (unset)

password = (unset)

(Optional) To change the KDC server, enter set kdcs= and the KDC server host name. Then enter commit.

hostname:configuration services kerberos TEST.NET> set kdcs=kdc2.us.oracle.com

kdcs = kdc2.us.oracle.com (uncommitted) hostname:configuration services kerberos TEST.NET> commit

Enter set admin= and the KDC administrator name for the realm.

hostname:configuration services kerberos TEST.NET principals (uncommitted)> set

admin=kdc/admin

Enter set password= and the KDC administrator password, and then enter commit.

hostname:configuration services kerberos TEST.NET principals (uncommitted)> set

password=test123

password = ******* hostname:configuration services kerberos TEST.NET principals (uncommitted)> commit

Enter show to view the principals for the KDC.

8.

hostname:configuration services kerberos TEST.NET> show

Properties:

kdcs = kdc1.us.oracle.com

Keytab entries:

NAME KEYS PRINCIPAL principal-000 4 host/[email protected]

principal-001 4 nfs/[email protected]

To view the keys for a principal, select a principal and enter show.

hostname:configuration services kerberos TEST.NET> select principal-001

Appliance Services 353

Deleting Kerberos Principals and Keys (BUI) hostname:configuration services kerberos principal-001> show

Properties:

name = nfs/[email protected]

Keys:

KEY KVNO ENCTYPENO ENCTYPE key-000 28 18 AES-256 CTS mode with 96-bit SHA-1 HMAC key-001 28 17 AES-128 CTS mode with 96-bit SHA-1 HMAC key-002 28 16 Triple DES cbc mode with HMAC/sha1 key-003 28 23 ArcFour with HMAC/md5 key-004 28 24 Exportable ArcFour with HMAC/md5 key-005 28 3 DES cbc mode with RSA-MD5 key-006 28 1 DES cbc mode with CRC-32

Legend for column headings:

KEY = Key name

KVNO = Key version number

ENCTYPENO = Encryption type number

ENCTYPE = Encryption type

9.

To view the properties of a key, select a key and enter show.

hostname:configuration services kerberos principal-001> select key-003 hostname:configuration services kerberos principal-001 key-003> show

Properties:

principal = nfs/[email protected]

kvno = 28

enctype = ArcFour with HMAC/md5

enctypeno = 23

Deleting Kerberos Principals and Keys (BUI)

1.

2.

3.

Use the following procedure to delete individual keys.

Go to Configuration > Services.

Click Kerberos.

Click Keys.

354 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

The list of principals and keys is displayed.

Deleting Kerberos Principals and Keys (CLI)

4.

5.

(Optional) To sort by a column, such as PRINCIPAL, click the column heading.

To delete an individual key, hover over the appropriate row, click its trash icon

, and confirm your action.

If you delete all keys for a principal, you effectively delete the principal from the appliance.

Deleting Kerberos Principals and Keys (CLI)

1.

Use the following procedure to delete individual keys, or to delete all keys for a principal.

Go to configuration services kerberos and enter list.

hostname:configuration services kerberos> list

REALM KDC

TEST.NET

Appliance Services 355

Deleting Kerberos Principals and Keys (CLI)

2.

3.

Select the realm.

hostname:configuration services kerberos> select TEST.NET hostname:configuration services kerberos TEST.NET>

Enter show to view the principals for the KDC.

hostname:configuration services kerberos TEST.NET> show

Properties:

kdcs = kdc1.us.oracle.com

Keytab entries:

NAME KEYS PRINCIPAL principal-000 4 host/[email protected]

principal-001 4 nfs/[email protected]

4.

To delete all of the keys for a principal, enter destroy and the principal name, and confirm your action.

To delete an individual key, see the next step.

hostname:configuration services kerberos TEST.NET> destroy principal-000

This will delete all keys for "principal-000". Are you sure? (Y/N) Y

5.

To delete an individual key for a principal, first select a principal and enter show to view the list of keys.

hostname:configuration services kerberos TEST.NET> select principal-001 hostname:configuration services kerberos principal-001> show

Properties:

name = nfs/[email protected]

Keys:

KEY KVNO ENCTYPENO ENCTYPE key-000 28 18 AES-256 CTS mode with 96-bit SHA-1 HMAC key-001 28 17 AES-128 CTS mode with 96-bit SHA-1 HMAC key-002 28 16 Triple DES cbc mode with HMAC/sha1 key-003 28 23 ArcFour with HMAC/md5 key-004 28 24 Exportable ArcFour with HMAC/md5 key-005 28 3 DES cbc mode with RSA-MD5 key-006 28 1 DES cbc mode with CRC-32

Legend for column headings:

KEY = Key name

KVNO = Key version number

ENCTYPENO = Encryption type number

ENCTYPE = Encryption type

356 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Destroying a Kerberos Realm (BUI)

6.

To view the properties of a key, select a key and enter show.

7.

8.

hostname:configuration services kerberos principal-001> select key-003 hostname:configuration services kerberos principal-001 key-003> show

Properties:

principal = nfs/[email protected]

kvno = 28

enctype = ArcFour with HMAC/md5

enctypeno = 23

To delete a key or view a different key, enter done to return to the principal context.

hostname:configuration services kerberos principal-001 key-003> done hostname:configuration services kerberos principal-001>

To delete the key, enter destroy and the key name, and confirm your action.

hostname:configuration services kerberos principal-001> destroy key-003

This will delete key "key-003". Are you sure? (Y/N) Y

Destroying a Kerberos Realm (BUI)

1.

2.

3.

Destroying a realm also destroys its corresponding keys.

Go to Configuration > Services.

Click Kerberos.

Clear the Realm field, click APPLY, and confirm your action.

Destroying a Kerberos Realm (CLI)

1.

2.

Destroying a realm also destroys its corresponding keys.

Go to configuration services kerberos.

Enter destroy and the realm name, and then confirm your action.

hostname:configuration services kerberos> destroy TEST.NET

This will destroy "TEST.NET". Are you sure? (Y/N) Y

Appliance Services 357

Destroying a Kerberos Realm (CLI)

Kerberos Service Properties

The following properties are available for the Kerberos service:

Realm - A string, the name of the realm.

KDC(s) - A list of zero or more host names, the Key Distribution Center(s) for the realm.

The first Key Distribution Center (KDC) listed is assumed to be the Admin Server, which is relevant if creating principals on the KDC from the appliance, but not when importing keys.

The list may be empty if at least one KDC is published for the realm in DNS.

Allow weak encryption types - A Boolean value. This enables/disables support for deprecated weak encryption types (des-cbc-crc, des-cbc-md5, and arcfour-hmac-exp). This property is disabled by default.

Admin - A string, the name of the Kerberos admin principal (administrator). By convention, a principal name is divided into three components: the primary, the instance, and the realm.

You can specify a principal as joe, joe/admin, or joe/[email protected] This property is used only if creating service principals, and is not retained.

Password - Kerberos admin password - A string, the password for the administrator. This property is used only if creating service principals, and is not retained.

Changing services properties is documented in “Setting Service Properties

(BUI)” on page 252 and

“Setting Service Properties (CLI)” on page 253 .

Kerberos Properties and Logs

The following table describes the mapping between Kerberos CLI properties and their BUI property descriptions.

Note -

Older Kerberos properties associated with the NFS service have been deprecated and will continue to function in scripts and workflows.

TABLE 87

Kerberos Properties

CLI Property

realm kdcs allow_weak_crypto principals principals - server principals - admin

BUI Property

Realm

KDC(s)

Allow weak encryption types. Permits weak encryption types in Kerberos (arcfour-hmac-md5-exp, des-cbc-md5, and des-cbc-crc).

Kerberos administrator principal

Admin server - KDC host name

Admin principal - Administrator login name on KDC

358 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Destroying a Kerberos Realm (CLI)

CLI Property

principals - password importkeytab importkeytab - url importkeytab - user importkeytab - password

BUI Property

Password - Administrator login password on KDC

Import Keys - Imports keys in a keytab file from the

KDC

URL of keytab file

User name for URL access

Password for URL access

The following log is available for the Kerberos service.

TABLE 88

Logs Available for Kerberos Service

Log

appliance-kit-kerberos:default

Description

Log of appliance Kerberos service events

NTP Configuration

The Network Time Protocol (NTP) service can be used to keep the appliance clock accurate.

This is important for recording accurate timestamps in the filesystem, and for protocol authentication. The appliance records times using the UTC timezone. The times that are displayed in the BUI use the timezone offset of your browser.

To the right of the BUI screen are times from both the appliance (Server Time) and your browser (Client Time). If the NTP service is not online, the SYNC button can be clicked to set the appliance time to match your client browser time.

If you are sharing filesystems using SMB, the client clocks must be synchronized to within five minutes of the appliance clock to avoid user authentication errors. One way to ensure clock synchronization is to configure the appliance and the SMB clients to use the same NTP server.

TABLE 89

NTP Clock Synchronization

Log

network-ntp:default

Description

Log for the NTP service

To configure NTP, see the following sections:

“Setting Clock Synchronization (BUI)” on page 360

“Configuring NTP (CLI)” on page 360

“NTP Properties” on page 361

Appliance Services 359

Setting Clock Synchronization (BUI)

Setting Clock Synchronization (BUI)

1.

2.

3.

This will set the appliance time to match the time of your browser.

Go to Configuration > Services > NTP.

Disable the NTP service.

Click SYNC.

1.

2.

3.

Configuring NTP (CLI)

Under configuration services ntp, edit authorizations with the authkey command:

hostname:configuration services ntp> authkey hostname:configuration services ntp authkey>

From this context, new keys can be added with the create command:

hostname:configuration services ntp authkey> create hostname:configuration services ntp authkey-000 (uncommitted)> get

keyno = (unset)

type = (unset)

key = (unset) hostname:configuration services ntp authkey-000 (uncommitted)> set keyno=1

keyno = 1 (uncommitted) hostname:configuration services ntp authkey-000 (uncommitted)> set type=A

type = A (uncommitted) hostname:configuration services ntp authkey-000 (uncommitted)> set key=coconuts

key = ******** (uncommitted) hostname:configuration services ntp authkey-000 (uncommitted)> commit hostname:configuration services ntp authkey>

To associate authentication keys with servers via the CLI, the serverkeys property should be set to a list of values in which each value is a key to be associated with the corresponding server in the servers property.

If a server does not use authentication, the corresponding server key should be set to 0. For example, to use the key created above to authenticate the servers "gefilte" and "carp": hostname:configuration services ntp> set servers=gefilte,carp

servers = gefilte,carp (uncommitted) hostname:configuration services ntp> set serverkeys=1,1

serverkeys = 1,1 (uncommitted) hostname:configuration services ntp> commit hostname:configuration services ntp>

360 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring NTP (CLI)

4.

5.

6.

To associate authentication keys with servers, set the serverkeys property to a list of values in which each value is a key to be associated with the corresponding server in the servers property.

If a server does not use authentication, the corresponding server key should be set to 0. For example, to use the key created above to authenticate the servers "gefilte" and "carp": hostname:configuration services ntp> set servers=gefilte,carp

servers = gefilte,carp (uncommitted) hostname:configuration services ntp> set serverkeys=1,1

serverkeys = 1,1 (uncommitted) hostname:configuration services ntp> commit hostname:configuration services ntp>

To authenticate the server "gefilte" with key 1, "carp" with key 2 and "dory" with key 3:

hostname:configuration services ntp> set servers=gefilte,carp,dory

servers = gefilte,carp,dory (uncommitted) hostname:configuration services ntp> set serverkeys=1,2,3

serverkeys = 1,2,3 (uncommitted) hostname:configuration services ntp> commit hostname:configuration services ntp>

To authenticate the servers "gefilte" and "carp" with key 1, and to additionally have an unauthenticated NTP server "dory":

hostname:configuration services ntp> set servers=gefilte,carp,dory

servers = gefilte,carp,dory (uncommitted) hostname:configuration services ntp> set serverkeys=1,1,0

serverkeys = 1,1,0 (uncommitted) hostname:configuration services ntp> commit hostname:configuration services ntp>

NTP Properties

The following NTP properties are available at Configuration > Services > NTP:

TABLE 90

NTP Properties

Property

Discover NTP server via multicast address

Manually specify NTP server(s)

Description

Enter a multicast address here for an NTP server to be located automatically

Enter one or more NTP servers (and their corresponding authentication

Examples

224.0.1.1

0.pool.ntp.org

Appliance Services 361

Configuring NTP (CLI)

Property

NTP Authentication Keys

Description

keys, if any) for the appliance to contact directly

Enter one or more NTP authentication keys for the appliance to use when authenticating the validity of NTP servers. See

Table 91, “NTP Private Keys and

Integers,” on page 362

.

Examples

Auth key: 10, Type: ASCII, Private

Key: SUN7000

Validation - If an invalid configuration is entered, a warning message is displayed and the configuration is not committed. This will happen if:

A multicast address is used but no NTP response is found.

An NTP server address is used, but that server does not respond properly to NTP.

Authentication - To prevent against NTP spoofing attacks from rogue servers, NTP has a private key encryption scheme whereby NTP servers are associated with a private key that is used by the client to verify their identity. These keys are not used to encrypt traffic, and they are not used to authenticate the client -- they are only used by the NTP client (that is, the appliance) to authenticate the NTP server. To associate a private key with an NTP server, the private key must first be specified. Each private key has a unique integer associated with it, along with a type and key. The type must be one of the following:

TABLE 91

Type

DES

NTP

ASCII

MD5

NTP Private Keys and Integers

Description

A 64-bit hexadecimal number in

DES format

A 64-bit hexadecimal number in

NTP format

A 1-to-8 character ASCII string

A 1-to-8 character ASCII string, using the MD5 authentication scheme.

Example

0101010101010101

8080808080808080 topsecret md5secret

After the keys have been specified, an NTP server can be associated with a particular private key. For a given key, all of the key number, key type, and private key values must match between client and server for an NTP server to be authenticated.

362 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring NTP (CLI)

Phone Home Configuration

The Phone Home service screen is used to manage the appliance registration as well as the

Phone Home remote support service.

Registration connects your appliance with Oracle Auto Service Request (http://www.oracle.

com/us/support/auto-service-request/index.html

) . Oracle ASR automatically opens

Service Requests (SR) for specific problems reported by your appliance. Registration also connects your appliance with My Oracle Support (MOS) to detect update notifications.

The Phone Home service communicates with Oracle support to provide:

Fault reporting - The system reports active problems to Oracle for automated service response. Depending on the nature of the fault, a support case may be opened. Details of these events can be viewed in the Active Problem Display. For more information, see

“Working with Problems” in Oracle ZFS Storage Appliance Customer Service Manual .

Heartbeats - Daily heartbeat messages are sent to Oracle to indicate that the system is up and running. Oracle support may notify the technical contact for an account when one of the activated systems fails to send a heartbeat for too long.

System configuration - Periodic messages are sent to Oracle describing current software and hardware versions and configuration as well as storage configuration. No user data or metadata is transmitted in these messages.

Support bundles - The Phone Home service must be enabled before support bundles can be uploaded to Oracle Support. See “Working with Support Bundles” in Oracle ZFS Storage

Appliance Customer Service Manual

for more information.

Update Notifications - Creates an Alert when new software updates are available on My

Oracle Support (MOS). See “Working with Software Notifications and Updates” in Oracle

ZFS Storage Appliance Customer Service Manual

for more information.

You must register to use the Phone Home service.

You need a valid Oracle Single Sign-On account user name and password to use the fault reporting and heartbeat features of the Phone Home service. Go to My Oracle Support (http:// support.oracle.com

) and click Register to create your account.

To configure Phone Home, see the following sections:

Registering the Appliance

BUI , CLI

“Changing Account Information (BUI)” on page 365

“Phone Home Properties” on page 365

Appliance Services 363

Registering the Appliance (BUI)

1.

2.

3.

4.

Registering the Appliance (BUI)

Go to Configuration > Services > Phone Home.

Enter your Oracle Single Sign-On Account user name and password.

Click Privacy Statement for information about privacy policy. It can be viewed at any time in both the BUI and CLI.

Click APPLY to commit your changes.

Use My Oracle Support (http://support.oracle.com/) to complete Auto Service

Request (ASR) (http://www.oracle.com/us/support/auto-service-request/index.

html

) activation.

Refer to "How To Manage and Approve Pending ASR Assets In My Oracle Support" (Doc ID

1329200.1).

3.

4.

1.

2.

Registering the Appliance (CLI)

Go to configuration services scrk.

Set soa_id and soa_password to the user name and password for your Oracle

Single Sign-On Account, respectively.

Commit your changes.

Use My Oracle Support (http://support.oracle.com/) to complete Auto Service

Request (ASR) (http://www.oracle.com/us/support/auto-service-request/index.

html

) activation.

Refer to "How To Manage and Approve Pending ASR Assets In My Oracle Support" (Doc ID

1329200.1).

Example 15

CLI Registration

hostname:> configuration services scrk

hostname:configuration services scrk>set soa_id=myuser

soa_id = myuser(uncommitted)

hostname:configuration services scrk> set soa_password=mypass

soa_password = ****** (uncommitted)

hostname:configuration services scrk> commit

364 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing Account Information (BUI)

3.

4.

1.

2.

Changing Account Information (BUI)

Go to Configuration > Services > Phone Home.

Click 'Change account...' to change the Oracle Single Sign-On Account used by the appliance.

Commit your changes.

Use My Oracle Support to complete Auto Service Request (ASR) activation.

Refer to "How To Manage and Approve Pending ASR Assets In My Oracle Support" (Doc ID

1329200.1).

Phone Home Properties

If the appliance is not directly connected to the Internet, you may need to configure an HTTP proxy through which the Phone Home service can communicate with Oracle. These proxy settings will also be used to upload support bundles. See “Working with Support Bundles” in

Oracle ZFS Storage Appliance Customer Service Manual

for more details on support bundles.

TABLE 92

Property

Use web proxy

Host : port

Username

Password

Phone Home Web Proxy Settings

Description

Connect via a web proxy

Web proxy hostname or IP address, and port

Web proxy username

Web proxy password

TABLE 93

Phone Home Status

Property

Last heartbeat sent at

Description

Time last heartbeat was sent to Oracle support

If the Phone Home service is enabled before a valid Oracle Single Sign-On account has been entered, it will appear in the maintenance state. You must enter a valid Oracle Single Sign-On account to use the Phone Home service.

There is a log of Phone Home events in Maintenance > Logs > Phone Home.

Appliance Services 365

Changing Account Information (BUI)

Dynamic Routing Configuration

The Routing Information Protocol (RIP) is a distance-vector dynamic routing protocol that is used by the appliance to automatically configure optimal routes based on messages received from other RIP-enabled on-link hosts (typically routers). The appliance supports both RIPv1 and RIPv2 for IPv4, and RIPng for IPv6.

Routes that are configured via these protocols are marked as type "dynamic" in the routing table. RIP and RIPng listen on UDP ports 520 and 521 respectively.

TABLE 94

Dynamic Routing

Log

network-routing-route:default network-routing-ripng:quagga

Description

Logs RIP service events

Logs RIPng service events

Service Tags Configuration

Service Tags are used to facilitate product inventory and support, by allowing the appliance to be queried for data such as:

System serial number

System type

Software version numbers

You can register the service tags with Oracle support, allowing you to easily keep track of your

Oracle equipment and also expedite service calls. The service tags are enabled by default.

TABLE 95

Property

Discovery Port

Listener Port

UDP/TCP Port Properties

Description

UDP port used for service tag discovery. Default is 6481

TCP port used to query service tag data. Default is 6481

SMTP Configuration

The SMTP service sends all mail generated by the appliance, typically in response to alerts as configured on the Alerts screen. The SMTP service does not accept external mail; it only sends mail generated automatically by the appliance itself.

366 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Changing Account Information (BUI)

By default, the SMTP service uses DNS (MX records) to determine where to send mail. If DNS is not configured for the appliance's domain, or the destination domain for outgoing mail does not have DNS MX records setup properly, the appliance can be configured to forward all mail through an outgoing mail server, commonly called a smarthost.

TABLE 96

SMTP Properties

Property

Send mail through smarthost

Smarthost hostname

Allow customized from address

Custom from address

Description

If enabled, all mail is sent through the specified outgoing mail server. Otherwise, DNS is used to determine where to send mail for a particular domain.

Outgoing mail server hostname.

If enabled, the From address for email is set to the

Custom from address property. It may be desirable to customize this if the default From address is being identified as spam, for example.

The From address to use for outbound email.

When changing properties, you can use Alerts to send a test email to verify that the properties are correct. A common reason for undelivered email is misconfigured DNS, which prevents the appliance from determining which mail server to deliver the mail to; as described earlier, a smarthost could be used if DNS cannot be configured.

TABLE 97

SMTP Logs

Log

network-smtp:sendmail mail

Description

Logs the SMTP service events

Log of SMTP activity (including mails sent)

SNMP Configuration

The Simple Network Management Protocol (SNMP) service provides two different functions on the appliance:

Appliance status information can be served by SNMP.

Alerts can be configured to send SNMP traps. See “Configuring Alerts” on page 228

.

SNMP versions v1, v2c, and v3 are available when this service is enabled. The appliance supports a maximum of 128 physical and logical network interfaces. More than 128 network interfaces could cause time outs for such commands as snmpwalk and snmpget. If you need more than 128 network interfaces, contact Oracle Support.

Appliance Services 367

Configuring SNMP to Serve Appliance Status (BUI)

To configure SNMP, see the following sections:

“Configuring SNMP to Serve Appliance Status (BUI)” on page 368

“Configuring SNMP to Send Traps (BUI)” on page 368

“SNMP Properties” on page 369

“SNMP MIBs” on page 369

“Sun FM MIB” on page 370

“Sun AK MIB” on page 370

Configuring SNMP to Serve Appliance Status (BUI)

1.

2.

3.

4.

Go to Configuration > Services > SNMP.

Set the community name, authorized network and contact string.

(Optional) Set the trap destination to a remote SNMP host, else set this to

127.0.0.1.

Click APPLY to commit the configuration.

Configuring SNMP to Send Traps (BUI)

1.

2.

3.

4.

5.

Go to Configuration > Services > SNMP.

Set the community name, contact string, and trap destination(s).

(Optional) Set the authorized network to allow SNMP clients, else set this to

127.0.0.1/8.

Click APPLY to commit the configuration.

You must configure alerts to send the traps you want to receive.

For more information about alerts, see

“Configuring Alerts” on page 228 .

Related Topics

“SNMP Properties” on page 369

368 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SNMP to Send Traps (BUI)

SNMP Properties

TABLE 98

SNMP Properties

Property

Version

Description

Toggles between v1/2c and v3.

Community name

Authorized network/subnet Enter an appropriate IPv4 address and subnet (integers from 0-32). If you select v3, this property is not available.

Appliance contact

Username/password

Toggles between public and user-input. If you select user-input, you must also enter a community name. If you select v3, this property is not available.

Enter an appropriate appliance contact.

Enter a valid username (max 501 characters) and password (8-501 characters). If you select v1/2c, this property is not available.

Authentication Toggles between MD5 and SHA authentication algorithms. If you select v1/2c, this property is not available.

Privacy

Engine ID

Trap destinations

Toggles between None and DES encryption algorithm. If you select v1/2c, this property is not available.

The EngineID value hashed by snmpd. If SNMP was not previously enabled, the label shows “0x000”.

Lets you add IPv4 addresses. Use the “+” and “-” buttons to add or remove addresses.

The SNMP service also provides the MIB-II location string. This property is sourced from the

System Identity

configuration.

SNMP MIBs

If the SNMP services is online, authorized networks will have access to the following MIBs

(Management Information Bases):

TABLE 99

MIB

.1.3.6.1.2.1.1

SNMP MIBs

.1.3.6.1.2.1.2

.1.3.6.1.2.1.4

.1.3.6.1.4.1.42

.1.3.6.1.4.1.42.2.195

.1.3.6.1.4.1.42.2.225

Purpose

MIB-II system - generic system information, including hostname, contact and location

MIB-II interfaces - network interface statistics

MIB-II IP - Internet Protocol information, including IP addresses and route table

Sun Enterprise MIB (SUN-MIB.mib.txt)

Sun FM - fault management statistics (MIB file linked below)

Sun AK - appliance information and statistics (MIB file linked below)

Appliance Services 369

Configuring SNMP to Send Traps (BUI)

Note -

Sun MIB files are available at https://your IP address or host name:215/help/docs/snmp/.

Sun FM MIB

The Sun FM MIB (SUN-FM-MIB.mib) provides access to SUN Fault Manager information such as:

Active problems on the system

Fault Manager events

Fault Manager configuration information

There are four main tables to read:

TABLE 100

Sun FM MIBs

OID

.1.3.6.1.4.1.42.2.195.1.1

.1.3.6.1.4.1.42.2.195.1.2

.1.3.6.1.4.1.42.2.195.1.3

.1.3.6.1.4.1.42.2.195.1.5

Contents

Fault Management problems

Fault Management fault events

Fault Management module configuration

Fault Management faulty resources

See the MIB file for the full descriptions.

Note -

Sun MIB files are available at https://your IP address or host name:215/help/docs/snmp/.

Sun AK MIB

The Sun AK MIB (SUN-AK-MIB.mib) provides the following information:

Product description string and part number

Appliance software version

Appliance and chassis serial numbers

Install, update and boot times

Cluster state

Share status (share name, size, used and available bytes)

There are three main tables to read:

370 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SNMP to Send Traps (BUI)

TABLE 101

Sun AK MIBs

OID

.1.3.6.1.4.1.42.2.225.1.4

.1.3.6.1.4.1.42.2.225.1.5

.1.3.6.1.4.1.42.2.225.1.6

Contents

General appliance info

Cluster status

Share status

See the MIB file for the full descriptions.

Note -

Sun MIB files are available at https://your IP address or host name:215/help/docs/snmp/.

Syslog Configuration

The Syslog Relay service provides two different functions on the appliance:

Alerts can be configured to send Syslog messages to one or more remote systems. See

“Configuring Alerts” on page 228

.

Services on the appliance that are syslog capable will have their syslog messages forwarded to remote systems.

A syslog message is a small event message transmitted from the appliance to one or more remote systems (or as we like to call it: intercontinental printf). The message contains the following elements:

A facility describing the type of system component that emitted the message.

A severity describing the severity of the condition associated with the message.

A timestamp describing the time of the associated event in UTC.

A hostname describing the canonical name of the appliance

A tag describing the name of the system component that emitted the message. See

“SYSLOG Alert Message Format” on page 373 for details of the message format.

A message describing the event itself. See

“SYSLOG Alert Message

Format” on page 373

for details of the message format.

Syslog receivers are provided with most operating systems, including Oracle Solaris and Linux.

A number of third-party and open-source management software packages also support Syslog.

Syslog receivers allow administrators to aggregate messages from a number of systems on to a single management system and incorporated into a single set of log files.

The Syslog Relay can be configured to use the "classic" output format described by RFC 3164, or the newer, versioned output format described by RFC 5424. Syslog messages are transmitted as UDP datagrams. Therefore they are subject to being dropped by the network, or may not

Appliance Services 371

Configuring SNMP to Send Traps (BUI) be sent at all if the sending system is low on memory or the network is sufficiently congested.

Administrators should therefore assume that in complex failure scenarios in a network some messages may be missing and were dropped.

Syslog Properties

Protocol Version - The version of the Syslog protocol to use, either Classic Syslog (RFC

3164) or Updated Syslog (RFC 5424).

Destinations - The list of destination IPv4, IPv6, and FQDN addresses to which messages are relayed.

To configure syslog, see the following sections:

“Classic Syslog: RFC 3164” on page 372

“Updated Syslog: RFC 5424” on page 372

“SYSLOG Message Format” on page 373

“SYSLOG Alert Message Format” on page 373

“Example Configuring an Oracle Solaris Receiver (CLI)” on page 375

“Example Configuring a Linux Receiver (CLI)” on page 376

Classic Syslog: RFC 3164

The Classic Syslog protocol includes the facility and level values encoded as a single integer priority, the timestamp, a hostname, a tag, and the message body.

The tag will be one of the tags described in “SYSLOG Message Format” on page 373

.

The hostname will be the canonical name of the appliance as defined by the System Identity configuration. For more information, see

“System Identity Configuration” on page 376

.

Updated Syslog: RFC 5424

The Classic Syslog protocol includes the facility and level values encoded as a single integer priority, a version field (1), the timestamp, a hostname, a app-name, and the message body.

Syslog messages relayed by the Sun Storage systems will set the RFC 5424 procid, msgid, and structured-data fields to the nil value (-) to indicate that these fields do not contain any data.

The app-name will be one of the tags described in “SYSLOG Message Format” on page 373

.

The hostname will be the canonical name of the appliance as defined by the System Identity configuration. For more information, see

“System Identity Configuration” on page 376

.

372 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SNMP to Send Traps (BUI)

SYSLOG Message Format

The Syslog protocol itself does not define the format of the message payload, leaving it up to the sender to include any kind of structured data or unstructured human-readable string that is appropriate. Sun Storage appliances use the syslog subsystem tag ak to indicate a structured, parseable message payload, described next. Other subsystem tags indicate arbitrary humanreadable text, but administrators should consider these string forms unstable and subject to change without notice or removal in future releases of the Sun Storage software.

TABLE 102

Facility

daemon

SYSLOG Message Formats

Tag Name

ak daemon daemon idmap smbd

Description

Generic tag for appliance subsystems. All alerts will be tagged ak, indicating a SUNW-MSG-ID follows.

Identity Mapping service for

POSIX and Windows identity

conversion. See “Identity Mapping

Configuration” on page 324

.

SMA Data Protocol for

accessing shares. See “SMB

Configuration” on page 266

.

SYSLOG Alert Message Format

If an alert is configured with the Send Syslog Message action, it will produce a syslog message payload containing localized text consisting of the following standard fields. Each field will be prefixed with the field name in CAPITAL letters followed by a colon and whitespace character.

TABLE 103

Field Name

SUNW-MSG-ID

SYSLOG Alert Message Formats

TYPE

Description

The stable Sun Fault Message Identifier associated with the alert. Each system condition and fault diagnosis that produces an administrator alert is assigned a persistent, unique identifier in Sun's Fault Message catalog. These identifiers can be easily read over the phone or scribbled down in your notebook, and link to a corresponding knowledge article found at My Oracle

Support (https://support.oracle.com/) "Predictive

Self-Healing" (Doc ID 1154428.1).

The type of condition. This will be one of the labels:

Fault, indicating a hardware component or connector failure; Defect indicating a software defect or misconfiguration; Alert, indicating a condition not

Appliance Services 373

Configuring SNMP to Send Traps (BUI)

SEVERITY

EVENT-TIME

PLATFORM

CSN

HOSTNAME

SOURCE

REV

EVENT-ID

Field Name

VER

DESC

AUTO-RESPONSE

REC-ACTION

Description

associated with a fault or defect, such as the completion of a backup activity or remote replication.

The version of this encoding format itself. This description corresponds to version "1" of the SUNW-

MSG-ID format. If a "1" is present in the VER field, parsing code may assume that all of the subsequent fields will be present. Parsing code should be written to handle or ignore additional fields if a decimal integer greater than one is specified.

The severity of the condition associated with the problem that triggered the alert. The list of severities is shown below.

The time corresponding to this event. The time will be in the form "Day Mon DD HH:MM:SS YYYY" in UTC.

For example: Fri Aug 14 21:34:22 2009.

The platform identifier for the appliance. This field is for

Oracle Service use only.

The chassis serial number of the appliance.

The canonical name of the appliance as defined by the

System Identity configuration. See

System Identity

.

The subsystem within the appliance software that emitted the event. This field is for Oracle Service use only.

The internal revision of the subsystem. This field is for

Oracle Service use only.

The Universally Unique Identifier (UUID) associated with this event. Oracle's Fault Management system associates a UUID with each alert and fault diagnosis such that administrators can gather and correlated multiple messages associated with a single condition, and detect duplicate messages. Oracle Service personnel can use the EVENT-ID to retrieve additional postmortem information associated with the problem that may help

Oracle respond to the issue.

Description of the condition associated with the event.

The automated response to the problem, if any, by the

Fault Management software included in the system.

Automated responses include capabilities such as proactively offlining faulty disks, DRAM memory chips, and processor cores.

The recommended service action. This will include a brief summary of the recommended action, but administrators should consult the knowledge article and this documentation for information on the complete repair procedure.

The SEVERITY field will be set to one of the following values:

374 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SNMP to Send Traps (BUI)

TABLE 104

Severity

Minor

SYSLOG Severity Fields

Syslog Level

LOG_WARNING

Major

Critical

LOG_ERR

LOG_CRIT

Description

A condition occurred that does not currently impair service, but the condition needs to be corrected before it becomes more severe.

A condition occurred that does impair service but not seriously.

A condition occurred that seriously impairs service and requires immediate correction.

Example Configuring an Oracle Solaris Receiver (CLI)

Most operating systems include a syslog receiver, but some configuration steps may be required to turn it on. Consult the documentation for your operating system or management software for specific details of syslog receiver configuration.

Oracle Solaris includes a bundled syslogd that can act as a syslog receiver, but the remote receive capability is disabled by default. To enable Oracle Solaris to receive syslog traffic, use svccfg and svcadm to modify the syslog settings as follows:

# svccfg -s system/system-log setprop config/log_from_remote = true

# svcadm restart system/system-log

Oracle Solaris syslogd only understands the classic Syslog protocol. Refer to the Oracle Solaris syslog.conf(4) man page for information on how to configure filtering and logging of the received messages.

By default, Oracle Solaris syslogd records messages to /var/adm/messages and a test alert would be recorded as follows:

Aug 14 21:34:22 poptart.example.us.com poptart ak: SUNW-MSG-ID: AK-8000-LM, \

TYPE: alert, VER: 1, SEVERITY: Minor\nEVENT-TIME: Fri Aug 14 21:34:22 2009\n\

PLATFORM: i86pc, CSN: 12345678, HOSTNAME: poptart\n\

SOURCE: jsui.359, REV: 1.0\n\

EVENT-ID: 92dfeb39-6e15-e2d5-a7d9-dc3e221becea\n\

DESC: A test alert has been posted.\n\

AUTO-RESPONSE: None.\nIMPACT: None.\nREC-ACTION: None.

Appliance Services 375

Configuring SNMP to Send Traps (BUI)

Example Configuring a Linux Receiver (CLI)

Most operating systems include a syslog receiver, but some configuration steps may be required to turn it on. Consult the documentation for your operating system or management software for specific details of syslog receiver configuration.

Most Linux distributions include a bundled sysklogd(8) daemon that can act as a syslog receiver, but the remote receive capability is disabled by default. To enable Linux to receive syslog traffic, edit the /etc/sysconfig/syslog configuration file such that the -r option is included (enables remote logging):

SYSLOGD_OPTIONS="-r -m 0" and then restart the logging service:

# /etc/init.d/syslog stop

# /etc/init.d/syslog start

Some Linux distributions have an ipfilter packet filter that will reject syslog UDP packets by default, and the filter must be modified to permit them. On these distributions, use a command similar to the following to add an INPUT rule to accept syslog UDP packets:

# iptables -I INPUT 1 -p udp --sport 514 --dport 514 -j ACCEPT

By default, Linux syslogd records messages to /var/log/messages and a test alert would be recorded as follows:

Aug 12 22:03:15 192.168.1.105 poptart ak: SUNW-MSG-ID: AK-8000-LM, \

TYPE: alert, VER: 1, SEVERITY: Minor EVENT-TIME: Wed Aug 12 22:03:14 2009 \

PLATFORM: i86pc, CSN: 12345678, HOSTNAME: poptart SOURCE: jsui.3775, REV: 1.0 \

EVENT-ID: 9d40db07-8078-4b21-e64e-86e5cac90912 \

DESC: A test alert has been posted. AUTO-RESPONSE: None. IMPACT: None. \

REC-ACTION: None.

System Identity Configuration

This service provides configuration for the system name and location. You might need to change these if the appliance is moved to a different network location, or repurposed. You can change this data in the BUI by going to Configuration > Service > System Identity. To access the same data in the CLI, go to the configuration service identity context.

System Identity Properties and Logs

The System Identity properties are described in the following table.

376 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Configuring SNMP to Send Traps (BUI)

TABLE 105

BUI Text

System Name

System Location

System Identity Properties

CLI Property

nodename syslocation

Description

A single canonical identifying name for the appliance that is shown in the user interface. This name is separate from any DNS names that are used to connect to the system (which would be configured on remote DNS servers). This name can be changed at any time.

A text string to describe where the appliance is physically located. If

SNMP is enabled, this will be exported as the syslocation string in

MIB-II.

Changing services properties is documented in

“Setting Service Properties

(BUI)” on page 252

and

“Setting Service Properties (CLI)” on page 253

. The CLI property names are shorter versions of those listed above.

TABLE 106

System Identity Logs

Log

system-identity:node

Description

Logs the System Identity service events and errors

To view service logs, refer to “Using Logs” in Oracle ZFS Storage Appliance Customer Service

Manual

.

SSH Configuration

The SSH (Secure Shell) service allows users to log in to the appliance CLI and perform most of the same administrative actions that can be performed in the BUI. The SSH service can also be used as a way to execute automated scripts from a remote host, such as for retrieving daily logs or Analytics statistics.

SSH keys can be configured for individual accounts using the preferences function described in

“Setting Appliance Preferences” on page 224 .

SSH can also be used in conjunction with Kerberos authentication. For information about the appliance Kerberos service, see

“Kerberos Configuration” on page 343 .

To configure SSH, see the following sections:

“Disabling root SSH Access (CLI)” on page 378

“SSH Properties and Logs” on page 378

Appliance Services 377

Disabling root SSH Access (CLI)

Disabling root SSH Access (CLI)

1.

2.

3.

Go to configuration services ssh.

Set permit root login to false.

Commit the configuration.

SSH Properties and Logs

TABLE 107

Property

Server key length

SSH Properties

Key regeneration interval

Login grace period

Permit root login

Port (for incoming connections)

Description

The number of bits in the ephemeral key.

Ephemeral key regeneration interval, in seconds.

The SSH connection will be disconnected after this many seconds if the client has failed to authenticate.

Allows the root user to log in using

SSH.

The designated port for incoming connections.

Examples

768

3600

120 yes

22

TABLE 108

Property

Ciphers

MACs

SSH Security Properties

Description

Allow an administrator to choose which ciphers to use for connecting to the appliance.

Allow an administrator to choose which message authentication codes (MACs) to use for connecting to the appliance.

TABLE 109

SSH Logs

Log

network-ssh:default

Description

Log of the SSH service events and errors

378 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Disabling root SSH Access (CLI)

RESTful API Configuration

The Oracle ZFS Storage Appliance RESTful API lets you manage the appliance using simple requests such as GET, PUT, POST, and DELETE HTTP against managed resource URL paths.

The appliance RESTful based architecture is defined as a layered client-server model.

Advantages of this model mean that services can be transparently redirected through standard hubs, routers, and other network systems without client configuration. This architecture supports caching of information and is useful when many clients request the same static resources.

For complete Oracle ZFS Storage Appliance RESTful API documentation, see

Oracle ZFS

Storage Appliance RESTful API Guide

.

Appliance Services 379

380 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shares and Projects

The Oracle ZFS Storage Appliance uses storage pools, projects, and shares to organize data.

Shares are filesystems and LUNs that are exported over supported data protocols to clients of the appliance. All shares within a project can share common settings, and quotas can be enforced at the project level in addition to the share level. For more information about how the

appliance organizes data, see “About Storage Pools, Projects, and Shares” on page 399

.

To create and modify projects, use these tasks:

Creating a Project - BUI , CLI

Editing a Project -

BUI , CLI

Renaming a Project - BUI , CLI

Deleting a Project - BUI , CLI

To create and modify filesystems and LUNs, use these tasks:

Creating a Filesystem or LUN in a Project - BUI

,

CLI

Editing a Filesystem or LUN -

BUI ,

CLI

Renaming a Filesystem or LUN - BUI

,

CLI

Moving a Filesystem or LUN to a Different Project -

BUI , CLI

Deleting a Filesystem or LUN - BUI

,

CLI

Setting User or Group Quotas - BUI ,

CLI

To understand more about how the appliance organizes storage, see these topics:

“About Storage Pools, Projects, and Shares” on page 399

“Space Management for Shares” on page 432

“Project and Share Properties” on page 401

“Working with Filesystem Namespace” on page 436

“Share Usage Statistics” on page 438

“Share and Project Protocols” on page 439

“Access Control Lists for Filesystems” on page 453

“Working with Schemas” on page 461

Shares and Projects 381

Creating a Project (BUI)

Creating a Project (BUI)

1.

2.

Use this task to create an unencrypted project. To create an encrypted project, see

“Creating an

Encrypted Project (BUI)” on page 626

.

Go to Shares > Projects.

3.

4.

Click the add icon next to Projects or in the expanded Projects panel. To expand the Projects panel, click the arrow icon.

In the Create Project window, enter a name for the new project.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . :

Click APPLY.

The new project is added to the Projects list.

Related Topics

“Project Properties” on page 414

“Creating an Encrypted Project (BUI)” on page 626

Creating a Project (CLI)

1.

Use this task to create an unencrypted project. To create an encrypted project, see

“Creating an

Encrypted Project (CLI)” on page 627 .

Go to shares.

hostname:> shares

2.

Enter project and a project name.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . :

3.

hostname:shares> project home

To list the project properties, use the get command.

hostname:shares home(uncommitted)> get

382 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Project (CLI)

4.

5.

mountpoint = /export (default)

quota = 0 (default)

reservation = 0 (default)

sharesmb = off (default)

sharenfs = on (default)

encryption = off (default)

sharedav = off (default)

shareftp = off (default)

sharesftp = off (default)

sharetftp = off (default)

default_group = other (default)

default_permissions = 700 (default)

default_sparse = true (default)

default_user = nobody (default)

default_volblocksize = 8K (default)

default_volsize = 0 (default)

aclinherit = (default)

aclmode = (default)

atime = (default)

checksum = (default)

compression = (default)

dedup = (default)

copies = (default)

logbias = (default)

readonly = (default)

recordsize = (default)

rstchown = (default)

secondarycache = (default)

nbmand = (default)

snapdir = (default)

vscan = (default)

defaultuserquota = (default)

defaultgroupquota = (default)

snaplabel = (default)

canonical_name = (default)

keyname = (default)

keystore = (default)

exported = (default)

nodestroy = (default)

hostename:shares home (uncommitted)>

To modify the project properties, use the set command. Project properties are

described in “Project Properties” on page 414

.

Enter commit.

hostname:shares home> commit

Shares and Projects 383

Editing a Project (BUI)

Related Topics

“Project Properties” on page 414

“Creating an Encrypted Project (CLI)” on page 627

Editing a Project (BUI)

3.

4.

1.

2.

To modify project properties, use these steps.

Go to Shares > Projects.

Select a project in one of the following ways:

Hover over the project and click the edit icon .

Double-click the project name

Click the arrow icon next to Projects to expand the panel, then click on the project name.

The project is selected, and tabs are displayed for editing the properties.

Click one of the tabs to edit the project properties.

Modify the project properties for the project as needed. See “Project

Properties” on page 414 .

Related Topics

“Snapshots and Clones” on page 477

“Remote Replication” on page 507

Editing a Project (CLI)

1.

2.

3.

To modify project properties, use these steps.

Go to shares.

hostname:> shares

Enter select and a project name.

hostname:shares> select home

To list the project properties, use the get command.

384 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Editing a Project (CLI) hostname:shares home> get

aclinherit = restricted

aclmode = discard

atime = true

checksum = fletcher4

compression = off

compressratio = 100

copies = 1

creation = Thu Oct 23 2009 17:30:55 GMT+0000 (UTC)

mountpoint = /export

quota = 0

readonly = false

recordsize = 128K

reservation = 0

rstchown = true

secondarycache = all

nbmand = false

sharesmb = off

sharenfs = on

snapdir = hidden

snaplabel = project1:share1

vscan = false

defaultuserquota = 0

defaultgroupquota = 0

encryption = off

snaplabel =

sharedav = off

shareftp = off

sharesftp = off

sharetftp = off

pool = Pool1

canonical_name = Pool1/local/default

default_group = other

default_permissions = 700

default_sparse = false

default_user = nobody

default_volblocksize = 8K

default_volsize = 0

space_data = 43.9K

space_unused_res = 0

space_unused_res_shares = 0

space_snapshots = 0

space_available = 12.0T

space_total = 43.9K

origin = hostname:shares home>

Shares and Projects 385

Renaming a Project (BUI)

4.

5.

To modify the project properties, use the set command. Project properties and

values are described in “Project Properties” on page 414 .

For example, to enable vscan for this project, enter the following command: hostname:shares home >set vscan=true

Enter commit.

hostname:shares home> commit

Renaming a Project (BUI)

Caution -

Changing a project name will disrupt active client I/O operations.

3.

4.

1.

2.

5.

6.

Disconnect any active clients connected to the project.

Go to Shares > Projects.

Click on the project name in the Projects list.

Enter the new name for the project.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . :

Press Return.

Click OK to confirm.

Renaming a Project (CLI)

Caution -

Changing a project name will disrupt active client I/O operations.

1.

2.

3.

Disconnect any active clients connected to the project.

Go to shares.

hostname:> shares

To view the projects, use the list command.

386 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Deleting a Project (BUI)

4.

5.

hostname:shares> list default home

Enter rename, the existing project name, and the new project name.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . : hostname:shares> rename home project1

To confirm the project was renamed, use the list command.

hostname:shares> list default project1

Related Topics

“Project Properties” on page 414

Deleting a Project (BUI)

1.

2.

3.

Caution -

Deleting a project destroys all data in the project by deleting its filesystems and

LUNs.

Go to Shares > Projects.

Hover over the project you want to delete and click the destroy icon .

Click OK.

Deleting a Project (CLI)

Caution -

Deleting a project destroys all data in the project by deleting its filesystems and

LUNs.

1.

Go to shares.

hostname:> shares

Shares and Projects 387

Creating a Filesystem or LUN in a Project (BUI)

2.

Enter destroy and a project name.

3.

hostname:shares> destroy home

Enter Y.

This will destroy all data in "home"! Are you sure? (Y/N) hostname:shares> Y

Creating a Filesystem or LUN in a Project (BUI)

1.

2.

3.

A filesystem or LUN created within a project inherits the properties of the project. For a list of standard properties that can be inherited, see

“Inherited Properties” on page 402 . If the

project is encrypted, a filesystem or LUN created within it is also encrypted.

If you are adding a filesystem or LUN to a non-default project, the project must already exist.

To create a new project, see “Creating a Project (BUI)” on page 382

.

Go to Shares > Shares.

Select Filesystems or LUNs.

4.

5.

Click the add icon .

Complete the fields in the Create Filesystem or Create LUN dialog box.

For a filesystem, select a project and enter a name.

For a LUN, select a project, enter a name and specify the volume size.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . :

Click Apply.

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

“Inherited Properties” on page 402

“Creating an Encrypted Filesystem or LUN (BUI)” on page 630

388 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Filesystem or LUN in a Project (CLI)

Creating a Filesystem or LUN in a Project (CLI)

1.

2.

3.

4.

A filesystem or LUN created within a project inherits the properties of the project. For a list of standard properties that can be inherited, see

“Inherited Properties” on page 402 . If the

project is encrypted, a filesystem or LUN created within it is also encrypted.

If you are adding a filesystem or LUN to a non-default project, the project must already exist.

To create a new project, see

“Creating a Project (CLI)” on page 382

.

Go to shares.

hostname:> shares

Enter select and the project name. In this example, the default project is selected.

hostname:shares > select default

Enter filesystem and a filesystem name, or lun and a LUN name.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . :

The following example creates a filesystem named fs-1 in the default project.

hostname:shares default> filesystem fs-1 hostname:shares default/fs-1 (uncommitted)>

If creating a LUN, enter set volsize= and the volume size.

hostname:shares default/lun1 (uncommitted)> set volsize=2G

volsize = 2G (uncommitted)

5.

6.

7.

Enter commit.

hostname:shares default/fs-1 (uncommitted)> commit

Enter select and a filesystem or LUN name.

hostname:shares default> select fs-1

List the properties of the share using the get command:

hostname:shares default/fs-1> get

aclinherit = restricted (inherited)

aclmode = discard (inherited)

atime = true (inherited)

Shares and Projects 389

Creating a Filesystem or LUN in a Project (CLI)

casesensitivity = mixed

checksum = fletcher4 (inherited)

compression = off (inherited)

dedup = false (inherited)

compressratio = 100

copies = 1 (inherited)

creation = Wed Apr 29 2015 17:57:18 GMT+0000(UTC)

logbias = latency (inherited)

mountpoint = /export/fs-1 (inherited)

normalization = none

quota = 0

quota_snap = true

readonly = false (inherited)

recordsize = 128K (inherited)

reservation = 0

reservation_snap = true

rstchown = true(inherited)

secondarycache = all (inherited)

shadow = none

nbmand = false (inherited)

sharesmb = off (inherited)

sharenfs = on (inherited)

snapdir = hidden (inherited)

utf8only = false

vscan = false (inherited)

encryption = off (inherited)

snaplabel =

sharedav = off (inherited)

shareftp = off (inherited)

sharesftp = off (inherited)

sharetftp = off (inherited)

pool = pool_demo

canonical_name = pool_demo/local/default/fs-1

exported = true (inherited)

nodestroy = false

maxblocksize = 1M (inherited)

lz4supported = (inherited)

space_data = 31K

space_unused_res = 0

space_snapshots = 0

space_available = 29.4T

space_total = 31K

root_acl =

[email protected]:rwxpDaARWcCo:allow,[email protected]:aRc:allow,[email protected]:aRc:allow

root_group = other

root_permissions = 700

root_user = nobody

origin =

390 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Editing a Filesystem or LUN (BUI)

8.

9.

smbshareacl =

To modify the filesystem or LUN properties, use the set command. Properties are

described in “Project and Share Properties” on page 401 .

For example, to disable the NFS protocol for the filesystem named fs-1, enter: hostname:shares default/fs-1> set sharenfs=off

sharenfs = off (uncommitted)

Enter commit.

hostname:shares default/fs-1> commit hostname:shares default/fs-1>

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

“Inherited Properties” on page 402

“Creating an Encrypted Filesystem or LUN (CLI)” on page 631

Editing a Filesystem or LUN (BUI)

1.

2.

3.

To modify properties for an individual filesystem or LUN, use these steps.

Go to Shares > Shares.

Select Filesystems or LUNs.

4.

5.

Hover over the filesystem or LUN and click the edit icon , or double-click the filesystem or LUN you want to edit.

The general properties are displayed for the filesystem or LUN.

Click the Protocols, Access, Snapshots, or Replication tab.

Modify the filesystem or LUN properties described in

“Filesystem

Properties” on page 420

and “LUN Properties” on page 428

.

Related Topics

“Project and Share Properties” on page 401

Shares and Projects 391

Editing a Filesystem or LUN (CLI)

Editing a Filesystem or LUN (CLI)

1.

2.

3.

4.

To modify properties for an individual filesystem or LUN, use these steps.

Go to shares.

hostname:> shares

Enter select and the project name that contains the filesystem or LUN you want to edit.

hostname:shares> select default

Enter select and a filesystem name or LUN name.

hostname:shares default> select fs-1

List the properties of the share using the get command:

hostname:shares default/fs-1> get

aclinherit = restricted (inherited)

aclmode = discard (inherited)

atime = true (inherited)

casesensitivity = mixed

checksum = fletcher4 (inherited)

compression = off (inherited)

dedup = false (inherited)

compressratio = 100

copies = 1 (inherited)

creation = Wed Apr 29 2015 17:57:18 GMT+0000(UTC)

logbias = latency (inherited)

mountpoint = /export/fs-1 (inherited)

normalization = none

quota = 0

quota_snap = true

readonly = false (inherited)

recordsize = 128K (inherited)

reservation = 0

reservation_snap = true

rstchown = true(inherited)

secondarycache = all (inherited)

shadow = none

nbmand = false (inherited)

sharesmb = off (inherited)

sharenfs = on (inherited)

snapdir = hidden (inherited)

utf8only = false

392 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Renaming a Filesystem or LUN (BUI)

5.

6.

vscan = false (inherited)

encryption = off (inherited)

snaplabel =

sharedav = off (inherited)

shareftp = off (inherited)

sharesftp = off (inherited)

sharetftp = off (inherited)

pool = pool_demo

canonical_name = pool_demo/local/default/fs-1

exported = true (inherited)

nodestroy = false

maxblocksize = 1M (inherited)

space_data = 31K

space_unused_res = 0

space_snapshots = 0

space_available = 29.4T

space_total = 31K

root_acl =

[email protected]:rwxpDaARWcCo:allow,[email protected]:aRc:allow,[email protected]:aRc:allow

root_group = other

root_permissions = 700

root_user = nobody

origin =

smbshareacl =

Use the set command to modify the filesystem or LUN properties described in

“Filesystem Properties” on page 420 and

“LUN Properties” on page 428

.

For example, to disable the NFS protocol for the filesystem named fs-1, enter: hostname:shares default/fs-1> set sharenfs=off

sharenfs = off (uncommitted)

Enter commit.

hostname:shares default/fs-1> commit

Related Topics

“Project and Share Properties” on page 401

Renaming a Filesystem or LUN (BUI)

Caution -

Changing a share name will disrupt active client I/O operations.

Shares and Projects 393

Renaming a Filesystem or LUN (CLI)

1.

6.

7.

4.

5.

2.

3.

Disconnect all active clients connected to the filesystem or LUN you want to rename.

Go to Shares > Shares.

Select Filesystems or LUNs.

Click on the filesystem or LUN name in the list.

Enter the new name for the filesystem or LUN.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . :

Press Return.

Click OK to confirm.

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Renaming a Filesystem or LUN (CLI)

Caution -

Changing a share name will disrupt active client I/O operations.

1.

2.

3.

4.

Disconnect all active clients connected to the filesystem or LUN.

Go to shares

.

hostname:> shares

To view the projects, use the list command.

hostname:shares>list default home

Enter select and the project name that contains the filesystem or LUN you want to rename.

hostname:shares>select default

394 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Moving a Filesystem or LUN to a Different Project (BUI)

5.

Enter rename, the existing filesystem or LUN name, and the new filesystem or

LUN name.

A name must consist of 1 to 64 characters, but not include spaces or begin with a period.

Allowable characters are: alphanumeric and special characters _ - . : hostname:shares default> rename fs-1 fs-2

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Moving a Filesystem or LUN to a Different Project (BUI)

1.

2.

3.

Filesystems and LUNs within a project inherit the properties of the project.

Go to Shares > Shares.

Select Filesystems or LUNs.

4.

Hover over the filesystem or LUN and click the move icon .

Drag the filesystem or LUN to the different project under Projects.

If the project panel is not expanded, the panel will automatically expand until the share is dropped onto a project.

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Moving a Filesystem or LUN to a Different Project (CLI)

1.

Filesystems and LUNs within a project inherit the properties of the project.

Go to shares and select the project that contains the filesytem or LUN to be moved.

In this example, the default project contains the filesystem or LUN to be moved.

Shares and Projects 395

Deleting a Filesystem or LUN (BUI)

2.

hostname> shares hostname:shares> select default

Enter move, the name of the filesystem or LUN to be moved, and the name of the project to move it to.

hostname:shares default> move foo home

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Deleting a Filesystem or LUN (BUI)

Caution -

Deleting a filesystem or LUN destroys all data in the share and cannot be undone.

1.

2.

3.

4.

Go to Shares > Shares.

Select Filesystems or LUNs.

Hover over the filesystem or LUN you want to delete and click the destroy icon

.

Click OK.

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Deleting a Filesystem or LUN (CLI)

Caution -

Deleting a filesystem or LUN destroys all data in the share and cannot be undone.

1.

Go to shares.

hostname> shares

396 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Setting User or Group Quotas (BUI)

2.

3.

4.

Enter select and the project name that contains the filesystem or LUN.

hostname:shares> select default

Enter select and the filesystem or LUN name.

hostname:shares default>select fs-1

Enter destroy.

5.

hostname:shares default/fs-1> destroy

This will destroy all data in "fs-1"! Are you sure? (Y/N)

Enter Y.

hostname:shares default> Y

Related Topics

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Setting User or Group Quotas (BUI)

1.

2.

3.

Quotas can be set for a user or group at the project or filesystem level.

Go to Shares > Shares and select a project or share.

Click the General tab.

In the Space Usage - Users & Groups section, select User, Group, or User or

Group from the drop down menu.

Note -

Any user that is not consuming any space on the filesystem, and does not have any quota set, does not appear in the list of active users.

4.

To set a quota at the project level, select one of three options:

None - No quota is set for this filesystem.

Default - Sets the quota to the default quota at the project level; if no default was set, no quota is set for this filesystem.

Click the radio button, enter a quota in the size field, and select a measurement.

Shares and Projects 397

Setting User or Group Quotas (CLI)

5.

Click APPLY.

The user and group quota properties are validated separately from the other properties.

However, you may only see one validation error if an invalid user/group as well as another invalid property is entered. Correcting one error and applying the changes will show any remaining error messages.

If you see an error message that an invalid property has been entered, it may be an invalid user/group, another invalid property on the page, or both. Fixing one invalid property and then applying the changes will reveal any remaining error messages.

Related Topics

“Setting User or Group Quotas” on page 435

Setting User or Group Quotas (CLI)

1.

2.

Quotas can be set for a user or group at the project or filesystem level.

Go to shares, select a project, then select a share, as shown in this example:

hostname:> shares select default select eschrock

Enter users, then list to see the current users.

hostname:shares default/eschrock> users hostname:shares default/eschrock users> list

USER NAME USAGE QUOTA SOURCE user-000 root 321K - user-001 ahl 9.94K - user-002 eschrock 20.0G - -

Note -

Any user that is not consuming any space on the filesystem, and does not have any quota set, does not appear in the list of active users.

3.

Enter select and the name= of the user.

hostname:shares default/eschrock users> select name=eschrock hostname:shares default/eschrock user-002> get

name = eschrock

unixname = eschrock

unixid = 132651

winname = (unset)

winid = (unset)

usage = 20.0G

398 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

About Storage Pools, Projects, and Shares

4.

quota = (unset)

source = (unset)

Enter quota= and a value. Enter commit and done.

Note -

To clear a quota, set the value to '0'.

5.

hostname:shares default/eschrock user-002> set quota=100G

quota = 100G (uncommitted) hostname:shares default/eschrock user-002> commit hostname:shares default/eschrock user-002> done

To set a quota for such a user or group, use the quota command, after which the name and quota can be set.

The Source column displays "local" if the quota was set at the filesystem level, "default" if set at the project level, or "-" if no quota was set. In the following example, the default user quota set at the project level is 50 GB.

If a default user or group quota was set at the project level, this procedure overrides that value.

hostname:shares default/eschrock users> quota hostname:shares default/eschrock users quota (uncomitted)> set name=bmc

name = bmc (uncommitted) hostname:shares default/eschrock users quota (uncomitted)> set quota=default

quota = default (uncommitted) hostname:shares default/eschrock users quota (uncomitted)> commit hostname:shares default/eschrock users> list

USER NAME USAGE QUOTA SOURCE user-000 root 321K - user-001 ahl 9.94K - user-002 eschrock 20.0G 100G local user-003 bmc - 50G default

Related Topics

“Setting User or Group Quotas” on page 435

About Storage Pools, Projects, and Shares

The Oracle ZFS Storage Appliance manages physical storage using a pooled storage model where all filesystems and LUNs share common space. This topic describes how storage is organized using storage pools, projects, and shares.

Storage Pools

Shares and Projects 399

About Storage Pools, Projects, and Shares

The appliance is based on the ZFS filesystem, which groups underlying storage devices into pools. Filesystems and LUNs, collectively referred to as shares, allocate from this storage pool as needed. Before creating filesystems or LUNs, you must first configure storage on the appliance. Once a storage pool is configured, there is no need to statically size filesystems, though this behavior can be achieved by using quotas and reservations.

While multiple storage pools are supported, this type of configuration is generally discouraged because it provides significant drawbacks as described in the

“Configuring

Storage” on page 122 section. Multiple pools should only be used where the performance or

reliability characteristics of two different profiles are drastically different, such as a mirrored pool for databases and a RAID-Z pool for streaming workloads.

When multiple pools are active on a single host, the BUI displays a drop-down list in the menu bar that can be used to switch between pools. In the CLI, the name of the current pool will be displayed in parenthesis, and can be changed by setting the 'pool' property. If there is only a single pool configured, then these controls will be hidden. When multiple pools are selected, the default pool chosen by the UI is arbitrary, so any scripted operation should be sure to set the pool name explicitly before manipulating any shares.

Projects

All filesystems and LUNs are grouped into projects. A project can be considered a consistency group, that defines a common administrative control point for managing shares. All shares within a project can share common settings, and quotas can be enforced at the project level, as well as the share level. Projects can also be used solely for grouping logically related shares together, so their common attributes (such as accumulated space) can be accessed from a single point.

By default, the appliance creates a single default project when a storage pool is first configured.

It is possible to create all shares within this default project, although for reasonably sized environments creating additional projects is strongly recommended, if only for organizational purposes.

Shares

Shares are filesystems and LUNs that are exported over supported data protocols to clients of the appliance. Exported filesystems can be accessed over SMB, NFS, HTTP/WebDav, and FTP.

LUNs export block-based volumes and can be accessed over iSCSI or Fibre Channel.

The project/share is a unique identifier for a share within a pool. Projects within a pool cannot contain shares with the same name. If you attempt to name or rename a share using a name that is already in use, a mount point error occurs.

In addition to the default properties, you can configure shares and projects with any number of additional properties. These properties are given basic types for validation purposes, and are

400 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties inherited like most other standard properties. The values are never consumed by the software in any way, and exist solely for end-user consumption. The property schema is global to the system, across all pools, and is synchronized between cluster peers.

Related Topics

“Space Management for Shares” on page 432

“Project and Share Properties” on page 401

“Snapshots and Clones” on page 477

Project and Share Properties

All projects and shares have a number of associated properties which can be set using the BUI or CLI. For a list of property names and descriptions, click on one of these links:

“Project Properties” on page 414

“Filesystem Properties” on page 420

“LUN Properties” on page 428

Project and share properties can be one of the following types:

TABLE 110

Property Type

Inherited

Project and Share Property Types

Read only

Space management

Description

Inherited properties, the most common property type, represent most of the configurable project and share properties. Shares that are part of a project can either have local settings for properties, or they can inherit their settings from the parent project. By default, shares inherit all properties from the project. If a property is changed on a project, all shares that inherit that property are updated to reflect the new value. When inherited, all properties have the same value as the parent project, with the exception of the mountpoint and SMB properties.

When inherited, these properties concatenate the project setting with their own share name.

Read-only properties represent statistics about the project and share and cannot be changed. The most common properties of this type are space usage statistics.

Space management properties (quota and reservation) apply to both shares and projects, but are not inherited.

A project with a quota of 100G will be enforced across all shares, but each individual share will have no quota unless explicitly set.

Shares and Projects 401

Project and Share Properties

Property Type

Static

(Create time)

Project default

Filesystem local

LUN local

Custom

Description

Static properties are specified at filesystem or LUN creation time, but cannot be changed once the share has been created. These properties control the on-disk data structures, and include internationalization settings, case sensitivity, and volume block size.

Project default properties are set on a project, but do not affect the project itself. They are used to populate the initial settings when creating a filesystem or LUN, and can be useful when shares have a common set of noninheritable properties. Changing these properties do not affect existing shares, and the properties can be changed before or after creating the share.

Filesystem local properties apply only to filesystems, and are convenience properties for managing the root directory of the filesystem. They cannot be set on projects. These access control properties can also be set by in-band protocol operations.

LUN local properties apply only to LUNs and are not inherited. They cannot be set on projects.

Custom properties are user-defined properties.

Inherited Properties

Inherited properties are standard properties that can either be inherited from the project or explicitly set on the share. The BUI only allows the properties to be inherited all at once, while the CLI allows for individual properties to be inherited.

Shares that are part of a project can either have local settings for properties, or they can inherit their settings from the parent project. By default, shares inherit all properties from the project.

If a property is changed on a project, all shares that inherit that property are updated to reflect the new value. When inherited, all properties have the same value as the parent project, with the exception of the mountpoint and SMB properties. When inherited, these properties concatenate the project setting with their own share name.

Mountpoint

The mountpoint property is the location where the filesystem is mounted. This property is only valid for filesystems.

The following restrictions apply to the mountpoint property:

Must be under /export

402 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties

Cannot conflict with another share

Cannot conflict with another share on cluster peer to allow for proper failover

When inheriting the mountpoint property, the current dataset name is appended to the project's mountpoint setting, joined with a slash ('/'). For example, if the "home" project has the mountpoint setting /export/home, then "home/bob" would inherit the mountpoint /export/ home/bob

.

SMB shares are exported via their resource name, and the mountpoint is not visible over the protocol. However, even SMB-only shares must have a valid unique mountpoint on the appliance.

Mountpoints can be nested underneath other shares, though this has some limitations. For more

information, see “Working with Filesystem Namespace” on page 436

.

Read only

The read-only property controls whether the filesystem contents are read only. This property is only valid for filesystems.

The contents of a read-only filesystem cannot be modified, regardless of any protocol settings.

This setting does not affect the ability to rename, destroy, or change properties of the filesystem.

In addition, when a filesystem is read only, access control properties cannot be altered, because they require modifying the attributes of the root directory of the filesystem.

Update access time on read

The update access time on read property controls whether the access time for files is updated on read. This property is only valid for filesystems.

POSIX standards require that the access time for a file properly reflect the last time it was read.

This requires issuing writes to the underlying filesystem even for a mostly read-only workload.

For working sets consisting primarily of reads over a large number of files, turning off this property may yield performance improvements at the expense of standards conformance. These updates happen asynchronously and are grouped together, so its effect should not be visible except under heavy load.

Non-blocking mandatory locking

The non-blocking mandatory locking property controls whether SMB locking semantics are enforced over POSIX semantics. This property is only valid for filesystems.

Shares and Projects 403

Project and Share Properties

By default, filesystems implement file behavior according to POSIX standards. These standards are fundamentally incompatible with the behavior required by the SMB protocol. For shares where the primary protocol is SMB, this option should always be enabled. Changing this property requires all clients to be disconnected and reconnect.

Data Deduplication

The data deduplication property controls whether duplicate copies of data are eliminated.

Deduplication is synchronous, pool-wide, block-based, and can be enabled on a per project or share basis.

Before deduplication can be enabled on a project or share, configure the storage pool with meta devices. Meta devices are designated cache devices used to store specific types of metadata to optimize use cases like deduplication.

Deduplication is also only available on datasets with a record size 128K or above.

To enable deduplication, select the Data Deduplication checkbox on the general properties screen for projects or shares. The deduplication ratio will appear in the usage area of the Status

Dashboard. Data written with deduplication enabled is entered into the deduplication table indexed by the data checksum. Deduplication forces the use of the cryptographically strong

SHA-256 checksum. Subsequent writes will identify duplicate data and retain only the existing copy on disk. Deduplication can only happen between blocks of the same size, data written with the same record size. For best results, set the record size to that of the application using the data; for streaming workloads, use a large record size.

If your data does not contain any duplicates, enabling data deduplication will add overhead

(a more CPU-intensive checksum and on-disk deduplication table entries) without providing any benefit. If your data does contain duplicates, enabling data deduplication will both save space by storing only one copy of a given block regardless of how many times it occurs.

Deduplication necessarily will impact performance in that the checksum is more expensive to compute and the metadata of the deduplication table must be accessed and maintained.

Note that deduplication has no effect on the calculated size of a share, but does affect the amount of space used for the pool. For example, if two shares contain the same 1GB file, each will appear to be 1GB in size, but the total for the pool will be just 1GB and the deduplication ratio will be reported as 2x.

To determine if performance has been adversely affected by deduplication, enable advanced analytics and then use analytics to measure "ZFS DMU operations broken down by DMU object type" and check for a higher rate of sustained DDT operations (Data Duplication Table operations) as compared to ZFS operations. If this is happening, more I/O is for serving the deduplication table rather than file I/O.

404 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties

To use deduplication with encryption, keep in mind that only AES with the CCM mode encryption is compatible with deduplication. For more information, see

“Managing Encryption

Keys” on page 642

.

Data compression

The data compression property controls whether data is compressed before being written to disk. Shares can optionally compress data before writing to the storage pool. This allows for much greater storage utilization at the expense of increased CPU utilization. By default, no compression is done. If the compression does not yield a minimum space savings, it is not committed to disk to avoid unnecessary decompression when reading back the data.

Before choosing a compression algorithm, it is recommended that you perform any necessary performance tests and measure the achieved compression ratio.

BUI value

Off

LZ4

LZJB (Fastest)

GZIP-2 (Fast)

GZIP (Default)

GZIP-9 (Best Compression)

CLI value

off lz4 lzjb gzip-2 gzip gzip-9

Description

No compression is done.

An algorithm that typically consumes less CPU than GZIP-

2, but compresses better than

LZJB, depending on the data that is compressed.

A simple run-length encoding that only works for sufficiently simple inputs, but doesn't consume much

CPU.

A lightweight version of the gzip compression algorithm.

The standard gzip compression algorithm.

Highest achievable compression using gzip. This consumes a significant amount of CPU and can often yield only marginal gains.

Checksum

The checksum property controls the checksum used for data blocks. On the appliance, all data is checksummed on disk, and in such a way to avoid traditional pitfalls (phantom reads and write in particular). This allows the system to detect invalid data returned from the devices.

The default checksum (fletcher4) is sufficient for normal operation, but users can increase the checksum strength at the expense of additional CPU load. Metadata is always checksummed using the same algorithm, so this only affects user data (files or LUN blocks).

Shares and Projects 405

Project and Share Properties

BUI value

Fletcher 2 (Legacy)

Fletcher 4 (Standard)

SHA-256 (Extra Strong)

SHA-256-MAC

CLI value

fletcher2 fletcher4 sha256 sha256mac

Description

16-bit fletcher checksum

32-bit fletcher checksum

SHA-256 checksum

Cache device usage

The cache device usage property controls whether cache devices are used for the share. By default, all datasets make use of any cache devices on the system. Cache devices are configured as part of the storage pool and provide an extra layer of caching for faster tiered access. For

more information on cache devices, see “Configuring Storage” on page 122

. This property is independent of whether there are any cache devices currently configured in the storage pool.

For example, it is possible to have this property set to "all" even if there are no cache devices present. If any such devices are added in the future, the share will automatically take advantage of the additional performance. This property does not affect use of the primary (DRAM) cache.

BUI Value

All data and metadata

Metadata only

Do not use cache devices

CLI Value

all metadata none

Description

All normal file or LUN data is cached, as well as any metadata.

Only metadata is kept on cache devices. This allows for rapid traversal of directory structures, but retrieving file contents may require reading from the data devices.

No data in this share is cached on the cache device. Data is only cached in the primary cache or stored on data devices.

Synchronous write bias

The synchronous write bias property controls the behavior when servicing synchronous writes.

By default, the system optimizes synchronous writes for latency, which leverages the log devices to provide fast response times. In a system with multiple disjointed filesystems, this can cause contention on the log devices that can increase latency across all consumers. Even with multiple filesystems requesting synchronous semantics, it may be the case that some filesystems are more latency-sensitive than others.

A common case is a database that has a separate log. The log is extremely latency sensitive, and while the database itself also requires synchronous semantics, it is heavier bandwidth and not

406 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties latency sensitive. In this environment, setting this property to 'throughput' on the main database while leaving the log filesystem as 'latency' can result in significant performance improvements.

This setting will change behavior even when no log devices are present, though the effects may be less dramatic.

The synchronous write bias setting can be bypassed by the Oracle Intelligent Storage Protocol.

Instead of using the write bias defined in the file system, the Oracle Intelligent Storage Protocol can use the write bias value provided by the Oracle Database NFSv4.0 or NFSv4.1 client. The write bias value sent by the Oracle Database NFSv4.0 or NFSv4.1 client is used only for that write request.

BUI Value

Latency

Throughput

CLI Value

latency throughput

Description

Synchronous writes are optimized for latency, leveraging the dedicated log device(s), if any.

Synchronous writes are optimized for throughput. Data is written to the primary data disks instead of the log device(s), and the writes are performed in a way that optimizes for total bandwidth of the system.

Log devices will be used for small amounts of metadata associated with the data writes.

Database record size

The database record size property specifies a suggested block size for files in the file system.

This property is only valid for filesystems and is designed for use with database workloads that access files in fixed-size records. The system automatically tunes block sizes according to internal algorithms optimized for typical access patterns. For databases that create very large files but access them in small random chunks, these algorithms may be suboptimal.

Specifying a record size greater than or equal to the record size of the database can result in significant performance gains. Use of this property for general purpose file systems is strongly discouraged, and may adversely affect performance.

The default record size is 128 KB. The size specified must be a power of two greater than or equal to 512 and less than or equal to 1 MB. Changing the file system's record size affects only files created afterward; existing files and received data are unaffected. If block sizes greater than 128K are used for projects or shares, replication of those projects or shares to systems that do not support large block sizes will fail.

The database record size setting can be bypassed by the Oracle Intelligent Storage Protocol.

Instead of using the record size defined in the file system the Oracle Intelligent Storage Protocol

Shares and Projects 407

Project and Share Properties can use the block size value provided by the Oracle Database NFSv4.0 or NFSv4.1 client. The block size provided by the Oracle Database NFSv4.0 or NFSv4.1 client can only be applied when creating a new database files or table. Block sizes of existing files and tables will not be changed. For more information, see

“Oracle Intelligent Storage Protocol” on page 678 .

Additional replication

The additional replication property controls the number of copies stored of each block, above and beyond any redundancy of the storage pool. Metadata is always stored with multiple copies, but this property allows the same behavior to be applied to data blocks. The storage pool attempts to store these extra blocks on different devices, but it is not guaranteed. In addition, a storage pool cannot be imported if a complete logical device (RAID stripe, mirrored pair, etc) is lost. This property is not a replacement for proper replication in the storage pool, but can be reassuring for paranoid administrators.

Virus scan

The virus scan property controls whether the filesystem is scanned for viruses. This property is only valid for filesystems. This property setting is independent of the state of the virus scan service. Even if the Virus Scan service is enabled, filesystem scanning must be explicitly enabled using this property. Similarly, virus scanning can be enabled for a particular share even

if the service itself is off. For more information about configuration virus scanning, see Virus

Scan

.

Prevent destruction

When set, the share or project cannot be destroyed. This includes destroying a share through dependent clones, destroying a share within a project, or destroying a replication package.

However, it does not affect shares destroyed through replication updates. If a share is destroyed on an appliance that is the source for replication, the corresponding share on the target will be destroyed, even if this property is set. To destroy the share, the property must first be explicitly turned off as a separate step. This property is off by default.

Restrict ownership change

By default, ownership of files cannot be changed except by a root user (on a suitable client with a root-enabled export). This property can be turned off on a per-filesystem or per-project basis by turning off this property. When off, file ownership can be changed by the owner of the file or directory, effectively allowing users to "give away" their own files. When ownership

408 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties is changed, any setuid or setgid bits are stripped, preventing users from escalating privileges through this operation.

LUN Local Properties

These properties apply only to LUNs and are not inherited. They cannot be set on projects.

Volume size

The volume size property is the logical size of the LUN as exported over iSCSI. This property controls the size of the LUN. By default, LUNs reserve enough space to completely fill the volume. Changing the size of a LUN while actively exported to clients may yield undefined results. It may require clients to reconnect and/or cause data corruption on the filesystem on top of the LUN. Check best practices for your particular iSCSI client before attempting this operation.

Thin provisioned

The thin provisioned property controls whether space is reserved for the volume. By default, a

LUN reserves exactly enough space to completely fill the volume. This ensures that clients will not get out-of-space errors at inopportune times. This property allows the volume size to exceed the amount of available space. When set, the LUN will consume only the space that has been written to the LUN. While this allows for thin provisioning of LUNs, most filesystems do not expect to get "out of space" from underlying devices, and if the share runs out of space, it may cause instability and/or data corruption on clients.

When not set, the volume size behaves like a reservation excluding snapshots. It therefore has the same pathologies, including failure to take snapshots if the snapshot could theoretically diverge to the point of exceeding the amount of available space. For more information, see the

Reservation property in “Managing Filesystem and Project Space” on page 434

.

Volume block size

The volume block size property sets the native block size for LUNs. This can be any power of

2 from 512 bytes to 1M, and the default is 8K. This property is static; it is set when the LUN is created and cannot be changed.

Note -

LUNs with a volume block size smaller than 4K may cause performance degradation.

Shares and Projects 409

Project and Share Properties

Other Properties

The following properties are available: Project Default, Filesystem Local, Space Management,

Read-only, and Custom.

Project default

The project default properties are set on a project, but do not affect the project itself. They are used to populate the initial settings when creating a filesystem or LUN, and can be useful when shares have a common set of non-inheritable properties. Changing these properties do not affect existing shares, and the properties can be changed before or after creating the share.

Filesystem local

The filesystem local properties apply only to filesystems, and are convenience properties for managing the root directory of the filesystem. They are not inherited and cannot be set on projects. These access control properties can also be set by in-band protocol operations.

Space management

The space management properties (quota and reservation) apply to both shares and projects, but are not inherited. A project with a quota of 100G will be enforced across all shares, but each individual share will have no quota unless explicitly set.

Read only

The read-only properties represent statistics about the project and share and cannot be changed.

The most common properties of this type are space usage statistics.

Custom

Custom properties are user-defined using a schema. For more information, see “Working with

Schemas” on page 461

.

410 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties

Static Properties

Static (create time) properties are specified at filesystem or LUN creation time, but cannot be changed once the share has been created. These properties control the on-disk data structures, and include internationalization settings, case sensitivity, and volume block size.

In the BUI, static properties can be viewed on the left side of the interface when editing a filesystem or LUN.

TABLE 111

BUI Name

Creation date

Compression ratio

Filesystem and LUN Static Properties

CLI Name

creation compressratio

Case sensitivity

Reject non UTF-8

Normalization

Volume block size (LUNs only)

Origin casesensitivity utf8only normalization volblocksize origin

Data migration source (Filesystems only) shadow

Description

Indicates the date of creation.

Current compression ratio for the filesystem or

LUN, which is a product of the compression algorithm. For more information, see

“Compression ratio” on page 412 .

The case sensitivity property controls whether directory lookups are case-sensitive or caseinsensitive. For more information, see

“Case sensitivity” on page 412

.

This property enforces UTF-8 encoding for all files and directories. For more information, see

“Reject non UTF-8” on page 413 .

The normalization property controls what unicode normalization, if any, is performed on filesystems and directories. Unicode supports the ability to have the same logical name represented by different encodings. For more information, see

“Normalization” on page 413 .

The volume block size property sets the native block size for LUNs. For more information, see

“Volume block size” on page 414 .

Shows the name of the snapshot from which it was cloned. For more information, see

“Origin” on page 414 .

Location of the source if the filesystem is actively shadowing an existing filesystem, either locally or over NFS. For more information, see

“Data Migration Source” on page 414

Shares and Projects 411

Project and Share Properties

Compression ratio

If compression is enabled, this property shows the compression ratio currently achieved for the share. This is expressed as a multiplier. For example, a compression of 2x means that the data is consuming half as much space as the uncompressed contents. For more information

about selecting a compression algorithm, see "Data Compression" described in “Inherited

Properties” on page 402 .

Case sensitivity

The case sensitivity property controls whether directory lookups are case-sensitive or caseinsensitive. It supports the following options:

BUI Value

Mixed

Insensitive

Sensitive

CLI Value

mixed insensitive sensitive

Description

Case sensitivity depends on the protocol being used. For NFS,

FTP, and HTTP, lookups are casesensitive. For SMB, lookups are case-insensitive. This is default, and prioritizes conformance of the various protocols over cross-protocol consistency. When using this mode, it's possible to create files that are distinct over case-sensitive protocols, but clash when accessed over SMB.

In this situation, the SMB server will create a "mangled" version of the conflicts that uniquely identify the filename.

All lookups are case-insensitive, even over protocols (such as

NFS) that are traditionally casesensitive. This can cause confusion for clients of these protocols, but prevents clients from creating name conflicts that would cause mangled names to be used over SMB. This setting should only be used where

SMB is the primary protocol and alternative protocols are considered second-class, where conformance to expected standards is not an issue.

All lookups are case-sensitive, even over SMB where lookups are traditionally case-insensitive. In general, this setting should not be used because the SMB server can

412 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project and Share Properties

BUI Value CLI Value Description

deal with name conflicts via mangled names, and may cause Windows applications to behave strangely.

Reject non UTF-8

This property enforces UTF-8 encoding for all files and directories. When set, attempts to create a file or directory with an invalid UTF-8 encoding will fail. This only affects NFSv3, where the encoding is not defined by the standard. NFSv4.0 and NFSv4.1 always use UTF-8, and SMB negotiates the appropriate encoding. This setting should normally be "on", or else SMB (which must know the encoding in order to do case sensitive comparisons, among other things) will be unable to decode filenames that are created with and invalid UTF-8 encoding. This setting should only be set to "off" in pre-existing NFSv3 deployments where clients are configured to use different encodings. Enabling SMB, NFSv4.0 or NFSv4.1 when this property is set to "off" can yield undefined results if a NFSv3 client creates a file or directory that is not a valid UTF-8 encoding. This property must be set to "on" if the normalization property is set to anything other than "none".

Normalization

The normalization property controls what unicode normalization, if any, is performed on filesystems and directories. Unicode supports the ability to have the same logical name represented by different encodings. Without normalization, the on-disk name stored will be different, and lookups using one of the alternative forms will fail depending on how the file was created and how it is accessed. If this property is set to anything other than "none" (the default), the "Reject non UTF-8" property must also be set to "on".

BUI Value

None

Form C

Form D

Form KC

CLI Value

none formC formD formKC

Description

No normalization is done.

Normalization Form Canonical

Composition (NFC) - Characters are decomposed and then recomposed by canonical equivalence.

Normalization Form Canonical

Decomposition (NFD) - Characters are decomposed by canonical equivalence.

Normalization Form Compatibility

Composition (NFKC) - Characters are decomposed by compatibility

Shares and Projects 413

Project Properties

BUI Value

Form KD

CLI Value

formKD

Description

equivalence, then recomposed by canonical equivalence.

Normalization Form Compatibility

Decomposition (NFKD) - Characters are decomposed by compatibility equivalence.

Volume block size

The volume block size property sets the native block size for LUNs. This can be any power of 2 from 512 bytes to 1M, and the default is 8K.

Note -

LUNs with a volume block size smaller than 4K may cause performance degradation.

Origin

If this is a clone, this is the name of the snapshot from which it was cloned.

Data Migration Source

If set, then this filesystem is actively shadowing an existing filesystem, either locally or over

NFS. For more information about data migration, see “Shadow Migration” on page 465 .

Project Properties

Note -

In the CLI, use the get command to see a list of all properties.

Use the list command to list all children.

TABLE 112

BUI Location

Create Project

Projects Properties

BUI Name

Name

Encryption

CLI Name

project encryption

Property Type

Static

Inherited

Description

Defines the name of the project.

Defines the encryption type.

414 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project Properties

BUI Location BUI Name

Key

General - Space Usage -

Data

Keyname

Quota

Reservation

CLI Name

key keyname quota reservation

General - Space Usage -

Users & Groups

Default user quota

Default group quota defaultuserquota defaultgroupquota

General - Inherited

Properties

User and group

Usage

Mountpoint

Read only users / groups

-mountpoint readonly

Update access time on read

Non-blocking mandatory locking atime nbmand

Property Type

Inherited

Static

Space management

Space management

Space management

Space management

--

Space management

Inherited

Inherited

Inherited inherited

Description

Sets a specific LOCAL or

OKM key.

Identifies the key.

Sets a limit on the amount of space that can be consumed by any particular entity.

Represents a guarantee of space that can be consumed by any particular entity.

Sets a limit on the amount of space that can be consumed by the user.

Sets a limit on the amount of space that can be consumed by the group.

Specifies users and/or groups.

Shows the amount of data used by users and/or groups.

Controls the path used to export filesystems. For more information, see

“Mountpoint” on page 402 .

Controls whether the filesystem contents are read only. For more information, see

“Read only” on page 403 .

Controls whether the access time for files is updated on read. For more information, see

“Update access time on read” on page 403

.

Controls whether SMB locking semantics are enforced over POSIX semantics. For more information, see

“Nonblocking mandatory locking” on page 403 .

Shares and Projects 415

Project Properties

BUI Location BUI Name

Data deduplication

(warning)

CLI Name

dedup

Data compression compression

Property Type

Inherited

Inherited

Checksum checksum

Cache device usage secondarycache

Inherited

Inherited

Synchronous write bias

Database record size

Additional Replication

Virus scan

Prevent destruction logbias recordsize copies vscan nodestroy

Inherited

Inherited

Inherited

Inherited

Inherited

Description

Controls whether duplicate copies of data are eliminated. For more information, see

“Data

Deduplication” on page 404 .

Controls whether data is compressed before being written to disk. For more information, see

“Data compression” on page 405

.

Controls the checksum used for data blocks. For more information, see

“Checksum” on page 405 .

Controls whether cache devices are used for the share.

For more information,

see “Cache device usage” on page 406

.

Controls the behavior when servicing synchronous writes.

For more information,

see “Synchronous write bias” on page 406

.

Specifies a suggested block size for files in the filesystem. For more information,

see “Database record size” on page 407

.

Controls number of copies stored of each block, above and beyond any redundancy of the storage pool. For more information,

see “Additional replication” on page 408

.

Controls whether a filesystem is scanned for viruses. For more information, see

“Virus scan” on page 408

.

Prevents shares or projects from being destroyed when set. For more

416 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Project Properties

BUI Location

General - Custom

Properties

General - Default

Settings - Filesystems

General - Default

Settings - LUNs

Protocols - NFS

Protocols - NFS

Exceptions

BUI Name

Restrict ownership change

Schema

User

Group

Permissions

CLI Name

rstchown custom default_user default_group default_permissions

Property Type

Inherited

--

Creation default

Creation default

Creation default

Description

information, see

“Prevent destruction” on page 408 .

Controls the ownership and can be turned off on a per-filesystem or per-project basis. For more information, see

“Restrict ownership change” on page 408 .

Can be added as needed to attach user-defined tags to projects and shares. For more information, see

“Schema

Properties” on page 463

.

Specifies a user ID or user name.

Specifies a group ID or group name.

Sets the default permissions for filesystem.

Volume size

Thin provisioned default_volsize default_sparse

LUN only, creation default

LUN only, creation default

Shows the maximum volume size and unit of measurement. For more information, see

“Volume size” on page 409

.

Indicates only the amount of space physically consumed by data is used when selected. For more information, see

“Thin provisioned” on page 409

.

Volume block size default_volblocksize Creation default Shows the native block size for LUNs and can be set from 512 bytes to

1M (the default is 8K).

For more information, see

“Volume block size” on page 409

.

NFS sharenfs Inherited NFS Protocol property settings and values are described in

“NFS Protocol

Properties” on page 440

.

Exceptions to the overall sharing modes may be defined for clients or collections of clients. For more

information, see “NFS Share Mode Exceptions” on page 441

Shares and Projects 417

Project Properties

BUI Location

Protocols - SMB

Protocols - SMB

Exceptions

Protocols - HTTP (Inherit from project)

Protocols - FTP (Inherit from project)

Protocols - SFTP (Inherit from project)

Protocols - TFTP (Inherit from project)

Access

Snapshots - Properties

BUI Name

SMB

CLI Name

sharesmb

Property Type

Inherited

Description

SMB Protocol property settings and values are described in

“SMB Protocol

Properties” on page 446

.

Exceptions to the overall sharing modes may be defined for clients or collections of clients. See “SMB Protocol

Share Mode Exceptions” on page 449 .

Share mode sharedav Inherited

Share mode

Share mode

Share mode

ACL behavior on mode change shareftp sharesftp sharetftp aclmode

ACL inheritance behavior aclinherit

.zfs/snapshot visibility snapdir

Inherited

Inherited

Inherited

Inherited

Inherited

Inherited

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Controls how a mode change request interacts with the existing ACL.

Controls how a new file or directory inherits existing ACL settings from the parent directory.

Controls whether filesystem snapshots can be accessed over data protocols at .zfs/ snapshot in the root of the filesystem.

Scheduled snapshot label snaplabel Inherited Appends a user-defined label to each scheduled snapshot and is blank by default.

418 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location

Snapshots - Snapshots

BUI Name

Name

Creation

Unique

Total

Snapshots - Schedules Frequency

Keep at most

Replication (Inherit from project)/Create New

Actions

Target

Pool

Export data path

Limit bandwidth

CLI Name

snapshot name creation space_unique space_data frequency keep target pool export_path max_bandwidth

--

--

Property Type

--

--

Create time

Create time

Inherited

Inherited

Inherited

Inherited

Enable SSL-encryption

Disable compression

Include snapshot

Include clone origin as data use_ssl

-include_snaps

Retain user snapshots on target retain_user_snaps_ on_target include_clone

_origin_as_data

Inherited

Inherited

Inherited

Inherited

Inherited

Project Properties

Description

Specifies the name of the snapshot.

Specifies the date and time when the snapshot is created.

Indicates the amount of unique space used by the snapshot.

Indicates the total amount of space referenced by the snapshot.

Indicates how often the snapshot is taken.

Controls the retention policy for snapshots.

Identifies the replication target system.

Specifies the storage pool on the target where the project will be replicated.

Indicates the export data path.

Specifies a maximum speed for this replication update (in terms of amount of data transferred over the network per second).

Controls whether to encrypt data on the wire using SSL.

Controls whether the compression is enabled or disabled.

Controls whether replication updates include non-replication snapshots.

When set, keeps usergenerated snapshots on the replication target.

Continues to retain snapshots on the target until disabled.

Controls the replication of each share that was

Shares and Projects 419

Filesystem Properties

BUI Location BUI Name

Recovery point objective recovery_point_ objective

Inherited

Replica lag warning alert replica_lag_warning_ alert

Inherited

Replica lag error alert replica_lag_error_ alert Inherited

Update frequency

CLI Name

continuous

Property Type

Inherited

Description

cloned from a share that is external to the replication package on the target.

Specifies the maximum tolerable amount of data loss in the event of a disaster or major outage.

Specifies a limit, represented as a percentage of the RPO, when a minor alert is generated.

Specifies a limit, represented as a percentage of the RPO, when a major alert is generated.

Controls whether this action is being replicated continuously or at manual or scheduled intervals.

Filesystem Properties

Note -

In the CLI, use the get command to see a list of all properties.

TABLE 113

BUI Location

Create Filesystem

Filesystems Properties

BUI Name

Project

CLI Name

select project_name

Property Type

--

Name

Data migration source filesystem shadow

User root-user

--

Create time

Filesystem local

Description

Defines which project the filesystem uses to inherit parameter settings. You can also select the default project.

Defines the name of the filesystem.

Shows the location of the source if you are migrating data.

Specifies the owner of the root directory.

420 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location BUI Name

Group

Permissions or Use

Windows default permissions

Inherit mountpoint

Mountpoint

CLI Name

root_group root_permission

-mountpoint

Reject non UTF-8 utf8only

Property Type

Filesystem local

Filesystem local

--

Inherited

Create time

Case sensitivity

Normalization

Encryption

Inherit Key

Key

Keyname casesensitivity normalization encryption

-key keyname

Create time

Create time

Inherited

--

Inherited

Static

Filesystem Properties

Description

Specifies the group of the root directory.

Specifies standard UNIX permissions for the root directory, or Windows default permissions.

Indicates the mountpoint is inherited if selected.

Controls the path used to export filesystems. For more information, see

“Mountpoint” on page 402 .

Enforces UTF-8 encoding for all filesystems and directories. For more information, see

“Reject non

UTF-8” on page 413

.

Controls whether directory lookups are case-sensitive, case-insensitive, or mixed. For more information, see

“Case sensitivity” on page 412 .

Controls what unicode normalization, if any, is performed on filesystems and directories. For more information, see

“Normalization” on page 413

.

Defines the encryption type. For more information see,

“Managing Encryption

Keys” on page 642

.

Indicates the encryption key is inherited from the parent project if selected.

Sets a specific LOCAL or OKM key and is used when the key is not inherited from the parent project.

Identifies the key.

Shares and Projects 421

Filesystem Properties

BUI Location

General - Space Usage -

Data

BUI Name

Quota

CLI Name

quota

Quota Include snapshots quota_snap

Reservation reservation

General - Space Usage -

Users & Groups

Reservation Include snapshots reservation_snap

Users & Groups

Usage

Quota

General - Properties

(Inherit from project)

Mountpoint

Read only

--

-quota mountpoint readonly

Update access time on read

Non-blocking mandatory locking atime nbmand

Space management

Space management

Space management

--

--

Property Type

Space management

Space management

Inherited

Inherited

Inherited inherited

Description

Sets a limit on the amount of space that can be consumed by any particular entity.

Sets a limit on the amount of space that can be consumed by any particular entity including the snapshots.

Represents a guarantee of space that can be consumed by any particular entity.

Represents a guarantee of space that can be consumed by any particular entity including the snapshots.

Specifies the users and/or groups.

Shows the amount of data used by the users and/or groups.

Sets a limit on the amount of space that can be consumed by any particular entity.

Controls the path used to export filesystems. For more information, see

“Mountpoint” on page 402 .

Controls whether the filesystem contents are read only. For more information, see

“Read only” on page 403

.

Controls whether the access time for files is updated on read. For more information, see

“Update access time on read” on page 403

.

Controls whether SMB locking semantics are enforced over POSIX semantics. For more information, see

“Non-

422 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location BUI Name

Data deduplication

(warning)

CLI Name

dedup

Data compression compression

Property Type

Inherited

Inherited

Checksum checksum

Cache device usage secondarycache

Inherited

Inherited

Synchronous write bias

Database record size

Additional Replication

Virus scan

Prevent destruction logbias recordsize copies vscan nodestroy

Inherited

Inherited

Inherited

Inherited

Inherited

Filesystem Properties

Description

blocking mandatory locking” on page 403 .

Controls whether duplicate copies of data are eliminated. For more information, see

“Data

Deduplication” on page 404

.

Controls whether data is compressed before being written to disk. For more information, see

“Data compression” on page 405

.

Controls the checksum used for data blocks. For more information, see

“Checksum” on page 405 .

Controls whether cache devices are used for the share.

For more information, see

“Cache device usage” on page 406 .

Controls the behavior when servicing synchronous writes.

For more information, see

“Synchronous write bias” on page 406 .

Specifies a suggested block size for files in the filesystem. For more information, see

“Database record size” on page 407

.

Controls number of copies stored of each block, above and beyond any redundancy of the storage pool. For more information, see

“Additional replication” on page 408 .

Controls whether a filesystem is scanned for viruses. For more information, see

“Virus scan” on page 408 .

Prevents shares or projects from

Shares and Projects 423

Filesystem Properties

BUI Location

General - Custom

Properties (Inherit from

Project)

Protocols - NFS

Protocols - NFS

Exceptions

Protocols - SMB

Protocols - SMB

Exceptions

Protocols - Share Level

ACL

Protocols - HTTP (Inherit from project)

Protocols - FTP (Inherit from project)

BUI Name

Restrict ownership change

--

CLI Name

rstchown custom

Property Type

Inherited

--

Description

being destroyed when set. For more information, see

“Prevent destruction” on page 408

.

Controls the ownership and can be turned off on a per-filesystem or per-project basis. For more information, see

“Restrict ownership change” on page 408 .

Custom properties can be added as needed to attach user-defined tags to projects and shares.

NFS sharenfs Inherited NFS Protocol property settings and values are described in

“NFS Protocol

Properties” on page 440

.

Exceptions to the overall sharing modes may be defined for clients or collections of clients. For more

information, see “NFS Share Mode Exceptions” on page 441

SMB sharesmb Inherited SMB Protocol property settings and values are described in

“SMB Protocol

Properties” on page 446

.

Exceptions to the overall sharing modes may be defined for clients or collections of clients. See “SMB Protocol

Share Mode Exceptions” on page 449 .

Type --Indicates the type of the

ACL.

Target ---

Access

Permissions: Inheritance

--

--

--

--

Indicates the target fo the

ACL.

Indicates whether the

ACL access is allowed or denied.

Specifies standard UNIX permissions for the ACL.

Share mode

Share mode sharedav shareftp

Inherited

Inherited

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Determines whether the share is available for reading only, for reading

424 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location BUI Name

Protocols - SFTP (Inherit from project)

Share mode

Protocols - TFTP (Inherit from project)

Share mode

CLI Name

sharesftp

Property Type

Inherited

Access - Root Directory

Access

User

Group

Permissions root_user root_group root_permissions

Access - ACL Behavior

(Inherit from project)

ACL behavior on mode change aclmode

ACL inheritance behavior aclinherit

Access - Root Directory

ACL

Type

Target

Access

--

--

--

Snapshots - Properties

(Inherit from project)

Permissions:Inheritance --

.zfs/snapshot visibility snapdir

--

--

--

--

Inherited

Filesystem local

Filesystem local

Filesystem local

Inherited

Inherited

Scheduled snapshot label sharetftp snaplabel

Inherited

Inherited

Filesystem Properties

Description

and writing, or neither. In the CLI, "on" is an alias for "rw."

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Determines whether the share is available for reading only, for reading and writing, or neither. In the CLI, "on" is an alias for "rw."

Specifies the owner of the root directory.

Specifies the group of the root directory.

Specifies standard UNIX permissions for the root directory.

Controls how a mode change request interacts with the existing ACL.

Controls how a new file or directory inherits existing ACL settings from the parent directory.

Indicates the type of the

ACL.

Indicates the target of the

ACL.

Indicates whether the

ACL access is allowed or denied.

Specifies standard UNIX permissions for the ACL.

Controls whether filesystem snapshots can be accessed over data protocols at .zfs/ snapshot in the root of the filesystem.

Appends a user-defined label to each scheduled

Shares and Projects 425

Filesystem Properties

BUI Location BUI Name

Snapshots - Snapshots Name

Creation

Unique

Total

CLI Name

--

--

--

--

Clones

Frequency Snapshots - Schedule

Keep at most

Replication (Inherit from project)/Create New

Actions

Target

Pool

Export data path

Limit bandwidth

-frequency keep target pool export_path max_bandwidth

--

Create time

Create time

Inherited

Inherited

Inherited

Inherited

Enable SSL-encryption

Disable compression use_ssl compression

Property Type

--

--

--

--

Inherited

Inherited

Description

snapshot and is blank by default.

Specifies the name of the snapshot.

Specifies the date and time when the snapshot is created.

Indicates the amount of unique space used by the snapshot.

Indicates the total amount of space referenced by the snapshot. This represents the size of the filesystem at the time the snapshot was taken, and any snapshot can theoretically take up an amount of space equal to the total size as data blocks are rewritten.

Shows the number of clones of the snapshot.

Indicates how often the snapshot is taken.

Controls the retention policy for snapshots.

Identifies the replication target system.

Specifies the storage pool on the target where the project will be replicated.

Indicates the export data path.

Specifies a maximum speed for this replication update (in terms of amount of data transferred over the network per second).

Controls whether to encrypt data on the wire using SSL.

Controls whether the compression is enabled or disabled.

426 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location

Usage

BUI Name

Include snapshot

CLI Name

include_snaps

Property Type

Inherited

Retain user snapshots on target retain_user_snaps_ on_target

Inherited

Include clone origin as data include_clone_ origin_as_data

Inherited

Recovery point objective recovery_point_ objective

Inherited

Replica lag warning alert replica_lag_warning_ alert

Inherited

Replica lag error alert replica_lag_error_ alert Inherited

Update frequency

Referenced data continuous space_data

Inherited

Read-only

Unused Reservation space_unused_res

Snapshot data

Available data space_snapshots space_available

Read-only

Read-only

Read-only

Filesystem Properties

Description

Controls whether replication updates include non-replication snapshots.

When set, keeps usergenerated snapshots on the replication target.

Continues to retain snapshots on the target until disabled.

Controls the replication of each share that was cloned from a share that is external to the replication package on the target.

Specifies the maximum tolerable amount of data loss in the event of a disaster or major outage.

Specifies a limit, represented as a percentage of the RPO, when a minor alert is generated.

Specifies a limit, represented as a percentage of the RPO, when a major alert is generated.

Controls whether this action is being replicated continuously or at manual or scheduled intervals.

Shows the total amount of space referenced by the active share, independent of any snapshots.

Shows the amount of remaining space that is reserved for the filesystem.

Shows the total amount of data currently held by all snapshots of the share.

Shows any quotas on the share or project, or the

Shares and Projects 427

LUN Properties

BUI Location BUI Name

Total space

CLI Name

space_total

Property Type

Read-only

Description

absolute capacity of the pool.

Shows the sum of referenced data, snapshot data, and unused reservation.

LUN Properties

Note -

In the CLI, use the get command to see a list of all properties.

TABLE 114

BUI Location

Create LUN

LUNs Properties

BUI Name

Project

Name

Volume size

CLI Name

--

-volsize

Property Type

--

--

LUN local

Thin provisioned

Volume block size

Online

Target group

Initiator group(s) sparse volblocksize status targetgroup initiatorgroup

LUN local

Create time

LUN local

LUN local

LUN local

Description

Defines which project the LUN uses to inherit parameter settings.

Defines the name of the

LUN.

Defines the maximum volume size and unit of measurement. For more information, see

“Volume size” on page 409

.

Indicates only the amount of space physically consumed by data is used when selected. For more information, see

“Thin provisioned” on page 409

.

Native block size for the

LUN; any power of 2 from 512 bytes to 1M, and the default is 8K.

Indicates whether it is online or not.

Shows groups of targets used when exporting a

LUN.

Shows groups of initiators that can access the LUN.

428 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location BUI Name

Mountpoint

LU number

Encryption

Inherit key

Key

Keyname

GUID

General - Space Usage -

Data

Volume size

Thin provisioned

CLI Name

mountpoint lunumber encryption

-key keyname lunguid volsize sparse

General - Properties

(Inherit from project)

Data deduplication

(warning) dedup

Data compression compression

LUN Properties

Property Type

Inherited

LUN local

Inherited

--

Inherited

Static

Read-only, LUN local

LUN local

LUN local

Inherited

Inherited

Description

Controls the path used to export filesystems. For more information, see

“Mountpoint” on page 402 .

Sets the logical unit number to zero or automatically assigns the number.

Defines the encryption type.

Indicates the encryption key is inherited from the parent project if selected. For more information see,

“Managing Encryption

Keys” on page 642

.

Sets a specific LOCAL or OKM key and is used when the key is not inherited from the parent project.

Identifies the key.

A globally unique, read-only identifier that identifies the SCSI device.

Defines the maximum volume size and unit of measurement. For more information, see

“Volume size” on page 409

.

Indicates only the amount of space physically consumed by data is used when selected. For more information, see

“Thin provisioned” on page 409

.

Controls whether duplicate copies of data are eliminated. For more information, see

“Data

Deduplication” on page 404

.

Controls whether data is compressed before being written to disk. For more

Shares and Projects 429

LUN Properties

BUI Location

Bandwidth Properties

Custom Properties

(Inherit from Project)

BUI Name

Checksum

Additional replication copies

Cache device usage secondarycache

Synchronous write bias

Prevent destruction

Read Limit

Write Limit

Schema

CLI Name

checksum logbias nodestroy readlimit writelimit schema

Property Type

Inherited

Inherited

Inherited

Inherited

Inherited

--

--

--

Description

information, see

“Data compression” on page 405

.

Controls the checksum used for data blocks. For more information, see

“Checksum” on page 405 .

Controls number of copies stored of each block, above and beyond any redundancy of the storage pool. For more information,

see “Additional replication” on page 408

.

Controls whether cache devices are used for the share.

For more information,

see “Cache device usage” on page 406

.

Controls the behavior when servicing synchronous writes.

For more information,

see “Synchronous write bias” on page 406

.

Prevents shares or projects from being destroyed when set. For more information, see

“Prevent destruction” on page 408

.

Sets the maximum bytes per second that can be read from a disk. M indicates megabytes and

G

indicates gigabytes.

Sets the maximum bytes per second that can written to a disk. M indicates megabytes and

G

indicates gigabytes.

Can be added as needed to attach user-defined tags to projects and shares.

For more information,

see “Working with

Schemas” on page 461

.

430 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

BUI Location

Protocols - Sharing

Options

Protocols - Write Cache

Behavior

Snapshots - Properties

(Inherit from project)

Initiator group(s): LU number initiatorgroup

Write cache enabled writecache

Scheduled snapshot label snaplabel

Snapshots - Snapshots

BUI Name

Online

Target group

Name

Creation

--

--

CLI Name

status targetgroup

Unique

Total

Snapshots - Schedules

Clones

Frequency

Keep at most

Replication (Inherit from project)/Create New

Actions

Target

Pool

Export data path

Limit bandwidth

--

--

-frequency keep target pool export_path max_bandwidth

--

--

--

--

--

Create time

Create time

Inherited

Inherited

Inherited

Inherited

Property Type

LUN local

LUN local

LUN local

LUN local

Inherited

LUN Properties

Description

Indicates whether it is online or not.

Shows groups of targets used when exporting a

LUN.

Shows groups of initiators that can access the LUN.

Controls whether the

LUN caches writes.

Appends a user-defined label to each scheduled snapshot and is blank by default.

Specifies the name of the snapshot.

Specifies the date and time when the snapshot is created.

Indicates the amount of unique space used by the snapshot.

Indicates the total amount of space referenced by the snapshot.

Shows the number of clones of the snapshot.

Indicates how often the snapshot is taken.

Controls the retention policy for snapshots.

Identifies the replication target system.

Specifies the storage pool on the target where the project will be replicated.

Indicates the export data path.

Specifies a maximum speed for this replication update (in terms of amount of data transferred over the network per second).

Shares and Projects 431

Space Management for Shares

BUI Location

Usage

BUI Name

Enable SSL-encryption

CLI Name

use_ssl

Disable compression

Include snapshot compression include_snaps

Retain user snapshots on target retain_user_snaps_ on_target

Update frequency continuous

Inherited

Inherited

Referenced data

Snapshot data

Available data

Total space space_data space_snapshots space_available space_total

Property Type

Inherited

Inherited

Inherited

Read-only

Read-only

Read-only

Read-only

Description

Controls whether to encrypt data on the wire using SSL.

Controls whether the compression is enabled or disabled.

Controls whether replication updates include non-replication snapshots.

When set, keeps usergenerated snapshots on the replication target.

Controls whether this action is being replicated continuously or at manual or scheduled intervals.

Shows the total amount of space referenced by the active share, independent of any snapshots.

Shows the total amount of data currently held by all snapshots of the share.

Shows any quotas on the share or project, or the absolute capacity of the pool.

Shows the sum of referenced data, snapshot data, and unused reservation.

Space Management for Shares

The Oracle ZFS Storage Appliance manages physical storage using a pooled storage model where all filesystems and LUNs share common space. Filesystems never have an explicit size assigned to them, and only take up as much space as they need. LUNs reserve enough physical space to write the entire contents of the device, unless they are thinly provisioned, in which case they behave like filesystems and use only the amount of space physically consumed by data.

432 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shares Terminology

This system provides maximum flexibility and simplicity of management in an environment when users are generally trusted to do the right thing. A stricter environment, where user's data usage is monitored and/or restricted, requires more careful management.

These topics define terminology and how to manage space usage, on a per-share or per-user basis, using quotas and reservations.

“Shares Terminology” on page 433

“Managing Filesystem and Project Space” on page 434

“Setting User or Group Quotas” on page 435

“Working with Identity Management” on page 436

“Share Usage Statistics” on page 438

Shares Terminology

Before getting into details, it is important to understand some basic terms used when talking about space usage on the appliance.

Physical Data - Size of data as stored physically on disk. Typically, this is equivalent to the logical size of the corresponding data, but can be different in the phase of compression or other factors. This includes the space of the active share as well as all snapshots. Space accounting is generally enforced and managed based on physical space.

Logical Data - The amount of space logically consumed by a filesystem. This does not factor into compression, and can be viewed as the theoretical upper bound on the amount of space consumed by the filesystem. Copying the filesystem to another appliance using a different compression algorithm will not consume more than this amount. This statistic is not explicitly exported and can generally only be computed by taking the amount of physical space consumed and multiplying by the current compression ratio.

Referenced Data - This represents the total amount of space referenced by the active share, independent of any snapshots. This is the amount of space that the share would consume should all snapshots be destroyed. This is also the amount of data that is directly manageable by the user over the data protocols.

Snapshot Data - This represents the total amount of data currently held by all snapshots of the share. This is the amount of space that would be free should all snapshots be destroyed.

Quota - A quota represents a limit on the amount of space that can be consumed by any particular entity. This can be based on filesystem, project, user, or group, and is independent of any current space usage.

Reservation - A reservation represents a guarantee of space for a particular project or filesystem. This takes available space away from the rest of the pool without increasing the actual space consumed by the filesystem. This setting cannot be applied to users and groups.

Shares and Projects 433

Managing Filesystem and Project Space

The traditional notion of a statically sized filesystem can be created by setting a quota and reservation to the same value.

Managing Filesystem and Project Space

The simplest way of enforcing quotas and reservations is on a per-project or per-filesystem basis. Quotas and reservations do not apply to LUNs, though their usage is accounted for in the total project quota or reservations.

Data Quotas - A data quota enforces a limit on the amount of space a filesystem or project can use. By default, it will include the data in the filesystem and all snapshots. Clients attempting to write new data will get an error when the filesystem is full, either because

of a quota or because the storage pool is out of space. As described in “Snapshot Space

Management” on page 478

, this behavior may not be intuitive in all situations, particularly when snapshots are present. Removing a file may cause the filesystem to write new data if the data blocks are referenced by a snapshot, so it may be the case that the only way to decrease space usage is to destroy existing snapshots.

If the 'include snapshots' property is unset, then the quota applies only to the immediate data referenced by the filesystem, not any snapshots. The space used by snapshots is enforced by the project-level quota but is otherwise not enforced. In this situation, removing a file referenced by a snapshot will cause the filesystem's referenced data to decrease, even though the system as a whole is using more space. If the storage pool is full (as opposed to the filesystem reaching a preset quota), then the only way to free up space may be to destroy snapshots.

Data quotas are strictly enforced, which means that as space usage nears the limit, the amount of data that can be written must be throttled as the precise amount of data to be written is not known until after writes have been acknowledged. This can affect performance when operating at or near the quota. Because of this, it is generally advisable to remain below the quota during normal operating procedures.

Quotas are managed through the BUI under Shares > General > Space Usage > Data. They are managed in the CLI as the quota and quota_snap properties.

Data Reservations - A data reservation is used to make sure that a filesystem or project has at least a certain amount of available space, even if other shares in the system try to use more space. This unused reservation is considered part of the filesystem, so if the rest of the pool (or project) reaches capacity, the filesystem can still write new data even though other shares may be out of space.

By default, a reservation includes all snapshots of a filesystem. If the 'include snapshots' property is unset, then the reservation only applies to the immediate data of the filesystem. The

434 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Setting User or Group Quotas behavior when taking snapshots may not always be intuitive. If a reservation on filesystem data

(but not snapshots) is in effect, then whenever a snapshot is taken, the system must reserve enough space for that snapshot to diverge completely, even if that never occurs. For example, if a 50G filesystem has a 100G reservation without snapshots, then taking the first snapshot will reserve an additional 50G of space, and the filesystem will end up reserving 150G of space total. If there is insufficient space to guarantee complete divergence of data, then taking the snapshot will fail.

Reservations are managed through the BUI under Shares > General > Space Usage > Data.

They are managed in the CLI as the reservation and reservation_snap properties.

Space Management for Replicating LUNs - When you create a LUN the full physical space you configure for the LUN is reserved and cannot be used by other file systems (unless it is thinly provisioned). For replication, when you take a snapshot of a LUN of any given size, up to twice the size of the LUN is also reserved, depending on how much of the LUN space has been used.

The following list shows the maximum overhead space required when replicating a LUN:

Up to 100% on the source between updates

Up to 200% on the source during an update

Up to 200% on the target

Setting User or Group Quotas

Quotas can be set on a user or group at the filesystem level, as well as the project level. These enforce physical data usage based on the POSIX or Windows identity of the owner or group of the file or directory. There are some significant differences between user and group quotas and filesystem and project data quotas:

User and group quotas can be applied to filesystems and projects.

Default quotas can be set at the project level and inherited by the project's filesystems.

Default quotas set at the project level can be changed at the filesystem level.

Default quotas can be retrieved or modified over the SMB protocol.

User and group quotas are implemented using delayed enforcement. This means that users will be able to exceed their quota for a short period of time before data is written to disk.

Once the data has been pushed to disk, the user will receive an error on new writes, just as with the filesystem-level quota case.

User and group quotas are always enforced against referenced data. This means that snapshots do not affect any quotas, and a clone of a snapshot will consume the same amount of effective quota, even though the underlying blocks are shared.

Shares and Projects 435

Working with Identity Management

User and group reservations are not supported.

User and group quotas, unlike data quotas, are stored with the regular filesystem data. This means that if the filesystem is out of space, you will not be able to make changes to user and group quotas. You must first make additional space available before modifying user and group quotas.

User and group quotas are sent as part of any remote replication. It is up to the administrator to ensure that the name service environments are identical on the source and destination.

NDMP backup and restore of an entire share will include any user or group quotas. Restores into an existing share will not affect any current quotas.

Working with Identity Management

User and group quotas leverage the identity mapping service on the appliance. This allows users and groups to be specified as either UNIX or Windows identities, depending on the environment. Like file ownership, these identities are tracked in the following ways:

If there is no UNIX mapping, a reference to the windows ID is stored.

If there is a UNIX mapping, then the UNIX ID is stored.

This means that the canonical form of the identity is the UNIX ID. If the mapping is changed later, the new mapping will be enforced based on the new UNIX ID. If a file is created by a

Windows user when no mapping exists, and a mapping is later created, new files will be treated as a different owner for the purposes of access control and usage format. This also implies that if a user ID is reused (i.e. a new user name association created), then any existing files or quotas will appear to be owned by the new user name.

It is recommended that any identity mapping rules be established before attempting to actively use filesystems. Otherwise, any change in mapping can sometimes have surprising results.

Working with Filesystem Namespace

Every filesystem on the appliance must be given a unique mountpoint which serves as the access point for the filesystem data. Projects can be given mountpoints, but these serve only as a tool to manage the namespace using inherited properties. Projects are never mounted, and do not export data over any protocol.

All shares must be mounted under /export. While it is possible to create a filesystem mounted at /export, it is not required. If such a share doesn't exist, any directories will be created

436 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Working with Filesystem Namespace dynamically as necessary underneath this portion of the hierarchy. Each mountpoint must be unique within a cluster.

Namespace Nested Mountpoints - It is possible to create filesystems with mountpoints beneath that of other filesystems. In this scenario, the parent filesystems are mounted before children and vice versa. The following cases should be considered when using nested mountpoints:

If the mountpoint doesn't exist, one will be created, owned by root and mode 0755. This mountpoint may or may not be torn down when the filesystem is renamed, destroyed, or moved, depending on circumstances. To be safe, mountpoints should be created within the parent share before creating the child filesystem.

If the parent directory is read-only, and the mountpoint doesn't exist, the filesystem mount will fail. This can happen synchronously when creating a filesystem, but can also happen asynchronously when making a large-scale change, such as renaming filesystems with inherited mountpoints.

When renaming a filesystem or changing its mountpoint, all children beneath the current mountpoint as well as the new mountpoint (if different) will be unmounted and remounted after applying the change. This will interrupt any data services currently accessing the share.

Support for automatically traversing nested mountpoints depends on protocol, as outlined below.

Namespace NFSv2 / NFSv3 / NFSv4.0 / NFSv4.1 - Under NFS, each filesystem is a unique export made visible via the MOUNT protocol. NFSv2 and NFSv3 have no way to traverse nested filesystems, and each filesystem must be accessed by its full path. While nested mountpoints are still functional, attempts to cross a nested mountpoint will result in an empty directory on the client. While this can be mitigated through the use of automount mounts, transparent support of nested mountpoints in a dynamic environment requires

NFSv4.0 or NFSv4.1.

NFSv4.0 and NFSv4.1 have several improvements over NFSv3 when dealing with mountpoints. First is that parent directories can be mounted, even if there is no share available at that point in the hierarchy. For example, if /export/home was shared, it is possible to mount /export on the client and traverse into the actual exports transparently.

More significantly, some NFSv4.0 and NFSv4.1 clients (including Linux) support automatic client-side mounts, sometimes referred to as "mirror mounts". With such a client, when a user traverses a mountpoint, the child filesystem is automatically mounted at the appropriate local mountpoint, and torn down when the filesystem is unmounted on the client. From the server's perspective, these are separate mount requests, but they are stitched together onto the client to form a seamless filesystem namespace.

Namespace SMB - The SMB protocol does not use mountpoints, as each share is made available by resource name. However, each filesystem must still have a unique mountpoint.

Nested mountpoints (multiple filesystems within one resource) are not currently supported, and any attempt to traverse a mountpoint will result in an empty directory.

Shares and Projects 437

Share Usage Statistics

Namespace FTP / FTPS / SFTP - Filesystems are exported using their standard mountpoint. Nested mountpoints are fully supported and are transparent to the user.

However, it is not possible to not share a nested filesystem when its parent is shared. If a parent mountpoint is shared, then all children will be shared as well.

Namespace HTTP / HTTPS - Filesystems are exported under the /shares directory, so a filesystem at /export/home will appear at /shares/export/home over HTTP/HTTPS.

Nested mountpoints are fully supported and are transparent to the user. The same behavior regarding conflicting share options described in the FTP protocol section also applies to

HTTP.

Share Usage Statistics

On the left side of the view (beneath the project panel when collapsed) is a table explaining the current space usage statistics. These statistics are either for a particular share (when editing a share) or for the pool as a whole (when looking at the list of shares). If any properties are zero, then they are excluded from the table.

Some of the usage statistics are also displayed in the CLI context shares show.

The following table describes the BUI and CLI usage properties.

BUI Name

Available space

Referenced data

Snapshot data

Unused reservation

CLI Name

-usage_data usage_snapshots

--

Description

This statistic is implicitly shown as the capacity in terms of capacity percentage in the title. The available space reflects any quotas on the share or project, or the absolute capacity of the pool. The number shown here is the sum of the total space used and the amount of available space.

The amount of data referenced by the data. This includes all filesystem data or LUN blocks, in addition to requisite metadata. With compression, this value may be much less than the logical size of the data contained within the share.

If the share is a clone of a snapshot, this value may be less than the physical storage it could theoretically include, and may be zero.

The amount of space used by all snapshots of the share, including any project snapshots. This size is not equal to the sum of unique space consumed by all snapshots. Blocks that are referenced by multiple snapshots are not included in the per-snapshot usage statistics, but will show up in the share's snapshot data total.

If a filesystem has a reservation set, this value indicates the amount of remaining space that is reserved for the filesystem. This value is not set for LUNs. The

438 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols

BUI Name

Total space

CLI Name

usage_total

Description

appliance prevents other shares from consuming this space, guaranteeing the filesystem enough space. If the reservation does not include snapshots, then there must be enough space when taking a snapshot for the entire snapshot to be overwritten. For more information on reservations, see

“Filesystem Properties” on page 420

.

The sum of referenced data, snapshot data, and unused reservation.

Share and Project Protocols

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

For iSCSI, initiators can discover the target through one of the mechanisms described in

“Configuring Storage Area Network (SAN)” on page 170 .

For information about supported protocol properties, see the following sections:

“NFS Protocol” on page 439

“SMB Protocol” on page 446

“HTTP Protocol” on page 452

“FTP Protocol” on page 452

“SFTP Protocol” on page 453

“TFTP Protocol” on page 453

Related Topics

“NFS Configuration” on page 259

“SMB Configuration” on page 266

NFS Protocol

This section contains the following topics:

“NFS Protocol Properties” on page 440

“NFS Share Mode Exceptions” on page 441

“NFS Protocol Character Set Encodings” on page 444

“NFS Protocol Security Modes” on page 445

Shares and Projects 439

Share and Project Protocols

For more information about the NFS protocol, use these topics:

“NFS Configuration” on page 259

“Filesystem Properties” on page 420

“Project Properties” on page 414

NFSv2 and NFSv3 Security (RFC 2623) (http://www.ietf.org/rfc/rfc2623.txt)

NFSv4 Protocol (RFC 7530) (http://www.ietf.org/rfc/rfc7530.txt)

NFSv4.1 Protocol (RFC 5661) (https://tools.ietf.org/html/rfc5661)

For information about other supported protocols, see the following sections:

“SMB Protocol” on page 446

“HTTP Protocol” on page 452

“FTP Protocol” on page 452

“SFTP Protocol” on page 453

“TFTP Protocol” on page 453

NFS Protocol Properties

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

The following table shows NFS protocol properties and possible values.

TABLE 115

Property

Share mode

NFS Protocol Properties

CLI Value(s)

off/rw/ro

Property Type

Inherited

Disable setuid/setgid file creation

Prevent clients from mounting subdirectories nosuid nosub

Anonymous user mapping anon

Inherited

Inherited

Inherited

Description

Determines whether the share is available for reading only, for reading and writing, or neither. See

“Share and Project

Protocols” on page 439

.

If selected, clients will not be able to create files with the setuid (S_ISUID) and setgid (S_ISGID) bits set, nor enable these bits on existing files via the chmod(2) system call.

If selected, clients will be prevented from directly mounting subdirectories. They will be forced to mount the root of the share. Note: This only applies to the NFSv2 and NFSv3 protocols, not to NFSv4.0 or NFSv4.1.

Unless the "root" option is in effect for a particular client, the root user on that client is treated as an unknown user, and all attempts by that user to access the sharer's files will be treated as attempts by a user with this uid.

440 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols

Property CLI Value(s) Property Type

Character set

Security mode

Enforce reserved ports for system authentication

See

Character Set

Encodings

for possible values.

sec=

See

Security Modes

for list of possible values.

resvport

Inherited

Inherited

Inherited

Description

This file's access bits and ACLs will then be evaluated normally.

Sets the character set default for all clients.

Sets the security mode for all clients.

When set on a share or project in conjunction with the system authentication security mode, requires NFS clients to use low-numbered

("reserved") TCP ports. Some NFS clients, such as Oracle Solaris and Linux, use low-numbered

TCP ports by default. Other clients, such as

Windows, may require configuration.

NFS Share Mode Exceptions

Exceptions to the global sharing mode may be defined for clients or collections of clients by setting client-specific share modes or exceptions. To restrict access to certain clients, set the global sharing mode to none and increasingly grant access to smaller and smaller groups. For example, you could create a share with the global sharing mode set to none, which denies access to all clients, and then grant read-only access to a subset of the clients. Further, you could grant read/write access to an even smaller subset of the clients and, finally, only trusted hosts might have read/write and root-enabled access.

Client-specific share modes take precedence over the global share mode. A client is granted access according to the client-specific share mode that is specified in an exception. In the absence of exceptions, the client is granted access according to the global share mode.

TABLE 116

Client Types

Type

Host(FQDN) or Netgroup

CLI Prefix

none

DNS Domain

IPv4 Subnet

.

@

Description

A single client whose IP address resolves to the specified fully qualified name, or a netgroup containing fully qualified names to which a client's IP address resolves.

All clients whose IP addresses resolve to a fully qualified name ending in this suffix.

All clients whose IP addresses are within the specified IPv4 subnet, expressed in

CIDR notation.

Example

caji.sf.

example.

com sf.example.

com

192.0.2.254

/22

Shares and Projects 441

Share and Project Protocols

Type

IPv6 Subnet

CLI Prefix

@

Description

All clients whose IP addresses are within the specified IPv6 subnet, expressed in

CIDR notation.

Example

2001:db8:

410:d43::/64

For each client or collection of clients, you specify whether the client has read-only or readwrite access to the share. If you are setting an NFS exception, you also specify whether the client has root user privileges or is treated as a user without root access.

Managing Netgroups

Netgroups can be used to control access for NFS exports. However, managing netgroups can be complex. Consider using IP subnet rules or DNS domain rules instead.

If netgroups are used, they will be resolved from NIS or LDAP, depending on which service is enabled. If LDAP is used, each netgroup must be located at the default location, ou=Netgroup,

(Base DN), and must use the standard schema.

The username component of a netgroup entry typically has no effect on NFS; only the hostname is significant. Hostnames contained in netgroups must be canonical and, if resolved using DNS, fully qualified. That is, the NFS subsystem will attempt to verify that the IP address of the requesting client resolves to a canonical hostname that matches either the specified FQDN, or one of the members of one of the specified netgroups. This match must be exact, including any domain components; otherwise, the exception will not match and the next exception will be

tried. For more information on hostname resolution, see DNS

.

As of the 2013.1.0 software release, UNIX client users may belong to a maximum of 1024 groups without any performance degradation. Prior releases supported up to 16 groups per

UNIX client user.

NFS Share Modes and Exception Options

In the CLI, all NFS share modes and exceptions are specified using a single options string for the sharenfs property. This string is a comma-separated list of values. It should begin with one of ro, rw, on, or off, as an analogue to the global share modes described for the BUI.

TABLE 117

BUI Share

Mode Value

None

NFS Share Mode Values (BUI and CLI)

CLI Share Mode

Value

off

Description

Share mode is disabled.

Example

sharesmb=off

442 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols

BUI Share

Mode Value

Read/write

Read only

CLI Share Mode

Value

Description

on

<resource name> on rw

The share name is the dataset name and is available for reading and writing or reading only if the rw or ro NFS exceptions are defined. For all other clients, share mode is disabled.

The share name is the resource name and is available for reading and writing or reading only if the rw or ro NFS exceptions are defined. For all other clients, share mode is disabled.

The share name is the dataset name and is available for reading and writing for all clients if there are no NFS exceptions.

The share name is the dataset name and is available for reading and writing for all clients except those for which the ro exception is defined.

<resource name>

The share name is the resource name and is available for reading and writing for all clients if there are no NFS exceptions.

<resource name>,rw

The share name is the resource name, is available for reading and writing for all clients except those for which the ro exception is defined. NFS exceptions may or may not be defined.

ro

The share name is the dataset name and is available for reading only for all hosts except those for which the rw exception is defined.

<resource name>,ro

The share name is the resource name, is available for reading only for all clients except those for which the rw exception is defined. NFS exceptions may or may not be defined.

Example

sharesmb="on, ro=sf.example.com" sharesmb="myshare, ro=sf.example.com" sharesmb=on sharesmb=rw

or sharesmb="rw, ro=sf.example.com" sharesmb=myshare sharesmb="myshare, rw"

or sharesmb=" myshare,rw,ro=sf.

example.com" sharesmb="ro, rw=sf.example.com" sharesmb="myshare, ro"

or sharesmb=" myshare,ro,rw=sf.

example.com"

The following example sets the share mode for all clients to read-only. The root users on all clients will access the files on the share as if they were the generic "nobody" user.

set sharenfs=ro

Either or both of the nosuid and anon options can also be appended. Therefore, to define the mapping of all unknown users to the uid 153762, you might specify the following: set sharenfs="ro,anon=153762"

Note -

CLI property values that contain the "=" character must be quoted.

Additional NFS exceptions can be specified by appending text of the form "option=collection", where "option" is one of ro, rw, or root, defining the type of access to be granted to the client collection. The collection is specified by the prefix character from Client Types table and either

Shares and Projects 443

Share and Project Protocols a DNS hostname/domain name or CIDR network number. For example, to grant read-write access to all hosts in the sf.example.com domain and root access to those in the 192.168.44.0/24 network, you might use: set sharenfs="ro,anon=153762,rw=.sf.example.com,[email protected]/24"

Note -

This example only applies to NFS exceptions.

Netgroup names can be used anywhere an individual fully qualified hostname can be used. For example, you can permit read-write access to the "engineering" netgroup as follows: set sharenfs="ro,rw=engineering"

NFS Protocol Character Set Encodings

Normally, the character set encoding used for filename is unspecified. The NFSv3 and NFSv2 protocols do not specify the character set. NFSv4.0 and NFSv4.1 are supposed to use UTF-

8, but not all clients do and this restriction is not enforced by the server. If the UTF-8 only option is disabled for a share, these filenames are written verbatim to the filesystem without any knowledge of their encoding. This means that they can only be interpreted by clients using the same encoding. SMB, however, requires filenames to be stored as UTF-8 so that they can be interpreted on the server side. This makes it impossible to support arbitrary client encodings while still permitting access over SMB.

In order to support such configurations, the character set encoding can be set share-wide or on a per-client basis. The following character set encodings are supported: cp932 euc-cn euc-jp euc-jpms euc-kr euc-tw iso8859-1 iso8859-2 iso8859-5 iso8859-6 iso8859-7 iso8859-8 iso8859-9 iso8859-13 iso8859-15 koi8-r shift_jis

The default behavior is to leave the character set encoding unspecified (pass-through). The BUI allows the character set to be chosen through the standard exception list mechanism. In the CLI, each character set itself becomes an option with one or more hosts, with '*' indicating the sharewide setting. For example, the following: hostname:shares default> set sharenfs="rw,euc-kr=*"

Will share the filesystem with 'euc-kr' as the default encoding. The following:

444 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols hostname:shares default> set sharenfs="rw,euc-kr=host1.domain.com,euc-jp=host2.domain.

com"

Use the default encoding for all clients except 'host1' and 'host2', which will use 'euc-kr' and

'euc-jp', respectively. The format of the host lists follows that of other CLI NFS options.

Note that some NFS clients do not correctly support alternate locales; consult your NFS client documentation for details.

NFS Protocol Security Modes

Security modes are set on a per-share basis. The following list describes Kerberos security settings:

krb - End-user authentication through Kerberos V5

krb5i - krb5 plus integrity protection (data packets are tamper proof

krb5p - krb5i plus privacy protection (data packets are tamper proof and encrypted)

Security modes are specified by appending text in the form "option=mode" where option is sec and mode is the security setting. For example: hostname: shares default> set sharenfs="sec=krb5"

Note -

CLI property values that contain the "=" character must be quoted.

Combinations of Kerberos types can be specified in the security mode setting. The combination security modes let clients mount with any Kerberos type listed, as shown in the following table.

TABLE 118

Setting

sys krb5 krb5:krb5i krb5i krb5:krb5i:krb5p krb5p

Combinations of Kerberos types

Description

System Authentication

Kerberos v5 only - Clients must mount using this flavor.

Kerberos v5, with integrity - Clients may mount using any flavor listed.

Kerberos v5 integrity only - Clients must mount using this flavor.

Kerberos v5, with integrity or privacy - Clients may mount using any flavor listed.

Kerberos v5 privacy only - Clients may mount using this flavor.

Reserved Ports

To set reserved ports for system authentication, use resvport as shown in this example:

Shares and Projects 445

Share and Project Protocols set sharenfs="sec=sys,rw,resvport"

Note that resvport can only be used with the system authentication security mode sec=sys.

SMB Protocol

This section contains the following topics:

“SMB Protocol Properties” on page 446

“Client-side Caching Property” on page 447

“Opportunistic Locks Property” on page 448

“SMB Protocol Share Mode Exceptions” on page 449

“Share-Level ACLs” on page 452

For more information about the SMB protocol, use these topics:

“SMB Configuration” on page 266

“Filesystem Properties” on page 420

“Project Properties” on page 414

For information about other supported protocols, see the following sections:

“NFS Protocol” on page 439

“HTTP Protocol” on page 452

“FTP Protocol” on page 452

“SFTP Protocol” on page 453

“TFTP Protocol” on page 453

SMB Protocol Properties

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

The following table shows SMB protocol properties and possible values.

TABLE 119

Property

Share mode

SMB Protocol Properties

CLI Value(s)

off/on/rw/ro

Property Type

Inherited

Description

Determines whether the share is available for reading only, for reading and writing,

or neither. See “SMB Protocol Share Mode

Exceptions” on page 449

.

446 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols

Property

Resource name

CLI Value(s)

resource_name/off/ on

Property Type

Inherited

Enable access-based enumeration abe

Enable guest access guestok

Is a DFS namespace dfsroot

Client-side caching policy csc

Opportunistic locks policy oplocks

Enable continuous availability cont_avail

Inherited

Inherited

Inherited

Inherited

Inherited

Inherited

Description

Shows the name by which SMB clients refer to this share. The resource name off indicates no SMB client may access the share, and the resource name on indicates the share will be exported with the filesystem's name.

Performs access-based enumeration when enabled.

Grants guest access when enabled. This property is disabled by default.

Indicates whether this share is provisioned as a standalone DFS namespace.

Indicates per-share configuration options provided to support client-side caching. For more information, see

“Client-side Caching

Property” on page 447

.

Enables or disables opportunistic locks at the share level. For more information, see

“Opportunistic Locks

Property” on page 448

When enabled, SMB3 clients can request persistent file handles for the share. This allows the appliance to store the state associated with a persistent file handle in stable, persistent storage. The state can be transparently restored in the event of a controller failure, such as a takeover and failback operation on clustered controllers.

Continuously available SMB shares are not allowed to be shared over NFS or used on workloads such as Home Directory that have a very high number of opens/closes.

Continuously available SMB shares are only recommended for enterprise applications that have limited number of opens/closes.

Client-side Caching Property

The client-side caching property (csc) controls whether files and programs from the share are cached on the local client for offline use when disconnected from the appliance.

BUI value

No caching

CLI value

none

Description

Disables client-side caching for the share. No files or programs from the share are available offline. This

Shares and Projects 447

Share and Project Protocols

BUI value

Manual caching

Automatic document caching

Automatic program caching

CLI value

manual documents programs

Description

option blocks Offline Files on the client computers from making copies of the files and programs on the shared folder.

Only specified files and programs are cached on the local client and available offline. This is the default option when you set up a shared folder. By using this option, no files or programs are available offline by default. You can control which files and programs to access when you are not connected to the network.

All files accessed from the share are cached on the local client and available offline. Files are automatically reintegrated when the local client is online again. Programs accessed from the share are not available offline unless previously cached locally.

All programs accessed from the share are cached on the local client and available offline. When online, the programs are run from the local client. Additionally, all files accessed from the share are cached on the local client and available offline.

Files are automatically reintegrated when the local client is online again.

Opportunistic Locks Property

Opportunistic locks are a client-caching mechanism that facilitates local caching to reduce network traffic and improve performance. The property (oplocks) controls whether the server grants or denies opportunistic locks at the share level, and applies to both lease (SMB 2.1 and above) and legacy (SMB 2.0 and below) opportunistic locks.

The client requests an opportunistic lock on a file within a share, and that request is either granted or denied depending on the server configuration and the current state of the file. If the client attempts to access a file in a manner inconsistent with the opportunistic locks that have already been granted for that file, a conflict occurs. In such cases, the server initiates a process to break the existing opportunistic locks before proceeding with the conflicting operation.

Enabling opportunistic locks improves performance when files within a share are accessed by a single client. In some scenarios, however, such as when the same file is accessed

448 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols simultaneously by multiple clients, it can introduce unnecessary overhead. Opportunistic locks can thus be enabled or disabled per share, instead of globally controlled, based on the expected pattern of workloads.

If an opportunistic locks property is not defined at the share level, the default is the global opportunistic locks property set at the service level. For more information, see "Enable oplocks" in section

“SMB Service Properties” on page 267 .

BUI Value

Enabled

Disabled

<empty>

CLI Value

enabled disabled

--

Description

Enables opportunistic locks for a share

Disables opportunistic locks for a share

The opportunistic locks property is neither enabled or disabled. Uses the global opportunistic locks property when the share-level property is not set.

Example

set sharesmb="myshare, oplocks=enabled, abe=off,dfsroot=false" set sharesmb="myshare, oplocks=disabled, abe=off,dfsroot=false" set sharesmb="myshare, abe=off,dfsroot=false"

SMB Protocol Share Mode Exceptions

Exceptions to the global sharing mode may be defined for clients or collections of clients by setting client-specific share modes or exceptions. To restrict access to certain clients, set the global sharing mode to none and increasingly grant access to smaller and smaller groups. For example, you could create a share with the global sharing mode set to none, which denies access to all clients, and then grant read-only access to a subset of the clients. Further, you could grant read/write access to an even smaller subset of the clients and, finally, only trusted hosts might have read/write access.

TABLE 120

Client Types

Type

Host(FQDN) or Netgroup

CLI Prefix

none

DNS Domain

.

Description

A single client whose IP address resolves to the specified fully qualified name, or a netgroup containing fully qualified names to which a client's IP address resolves.

All clients whose IP addresses resolve to a fully

Example

caji.sf.example.com

sf.example.com

Shares and Projects 449

Share and Project Protocols

Type

IPv4 Subnet

IPv6 Subnet

CLI Prefix

@

@

Description

qualified name ending in this suffix.

All clients whose IP addresses are within the specified IPv4 subnet, expressed in CIDR notation.

All clients whose IP addresses are within the specified IPv6 subnet, expressed in CIDR notation.

Example

192.0.2.254/22

2001:db8:410:d43::/64

For each client or collection of clients, you specify whether the client has read-only or readwrite access to the share.

Managing netgroups - Netgroups can be used to control access for SMB exports. However, managing netgroups can be complex. Consider using IP subnet rules or DNS domain rules instead.

If netgroups are used, they will be resolved from NIS or LDAP, depending on which service is enabled. If LDAP is used, each netgroup must be located at the default location, ou=Netgroup,

(Base DN), and must use the standard schema.

The username component of a netgroup entry typically has no effect on SMB; only the hostname is significant. Hostnames contained in netgroups must be canonical and, if resolved using DNS, fully qualified. That is, the SMB subsystem will attempt to verify that the IP address of the requesting client resolves to a canonical hostname that matches either the specified FQDN, or one of the members of one of the specified netgroups. This match must be exact, including any domain components; otherwise, the exception will not match and the next exception will be tried. For more information on hostname resolution, see

DNS .

As of the 2013.1.0 software release, UNIX client users may belong to a maximum of 1024 groups without any performance degradation. Prior releases supported up to 16 groups per

UNIX client user.

SMB Share Modes and Exception Options

In the CLI, all SMB share modes and exceptions are specified using a single options string for the sharesmb property. This string is a comma-separated list of values. It should begin with one of ro, rw, on, or off, as an analogue to the global share modes described for the BUI.

TABLE 121

BUI Share

Mode Value

None

SMB Share Mode Values (BUI and CLI)

CLI Share Mode

Value

off

Description

Share mode is disabled.

Example

sharesmb=off

450 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Share and Project Protocols

BUI Share

Mode Value

Read/write

Read only

CLI Share Mode

Value

Description

on

<resource name> on rw

The share name is the dataset name and is available for reading and writing or reading only if the rw or ro SMB exceptions are defined. For all other clients, share mode is disabled.

The share name is the resource name and is available for reading and writing or reading only if the rw or ro SMB exceptions are defined. For all other clients, share mode is disabled.

The share name is the dataset name and is available for reading and writing for all clients if there are no SMB exceptions.

The share name is the dataset name and is available for reading and writing for all clients except those for which the ro exception is defined.

<resource name>

The share name is the resource name and is available for reading and writing for all clients if there are no SMB exceptions.

<resource name>,rw

The share name is the resource name, is available for reading and writing for all clients except those for which the ro exception is defined. SMB exceptions may or may not be defined.

ro

The share name is the dataset name and is available for reading only for all hosts except those for which the rw exception is defined.

<resource name>,ro

The share name is the resource name, is available for reading only for all clients except those for which the rw exception is defined. SMB exceptions may or may not be defined.

Example

sharesmb="on, ro=sf.example.com" sharesmb="myshare, ro=sf.example.com" sharesmb=on sharesmb=rw

or sharesmb="rw, ro=sf.example.com" sharesmb=myshare sharesmb="myshare, rw"

or sharesmb=" myshare,rw,ro=sf.

example.com" sharesmb="ro, rw=sf.example.com" sharesmb="myshare, ro"

or sharesmb=" myshare,ro,rw=sf.

example.com"

The following example sets the share mode for all clients to read-only.

set sharesmb=ro

Additional SMB exceptions can be specified by appending text of the form "option=collection", where "option" is either ro or rw. You cannot grant root access with SMB exceptions. The collection is specified by the prefix character from table 114, and either a DNS hostname/ domain name or CIDR network number.

For example, to grant read-write access to all hosts in the sf.example.com domain: set sharesmb="ro,rw=.sf.example.com"

This example grants read-only access to clients with the IP addresses 2001:db8:410:d43::/64 and 192.0.2.254/22:

Shares and Projects 451

Share and Project Protocols set sharesmb="on,[email protected][2001:db8:410:d43::/64]:@192.0.2.254/22"

Netgroup names can be used anywhere an individual fully qualified hostname can be used. For example, you can permit read-write access to the "engineering" netgroup as follows: set sharesmb="ro,rw=engineering"

Share-Level ACLs

A share-level access control list (ACL), when combined with the ACL of a file or directory in the share, determines the effective permissions for that file. By default, this ACL grants everyone full control. This ACL provides another layer of access control above the ACLs on files and allows for more sophisticated access control configurations. This property may only be set once the filesystem has been exported by configuring the SMB resource name. If the filesystem is not exported over the SMB protocol, setting the share-level ACL has no effect.

When access-based enumeration is enabled, clients may see directory entries for files which they cannot open. Directory entries are filtered only when the client has no access to that file.

For example, if a client attempts to open a file for read/write access but the ACL grants only read access, that open request will fail but that file will still be included in the list of entries.

For more information about ACLs, see “Access Control Lists for Filesystems” on page 453

.

HTTP Protocol

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

For the HTTP protocol (sharedav) and for an Object Store, users can set the share mode to determine if the filesystem is available for read only (ro), read and write (rw or on), or neither

(off).

Related Topics

“Project Properties” on page 414

“Filesystem Properties” on page 420

FTP Protocol

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

452 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Access Control Lists for Filesystems

For the FTP protocol (shareftp), users can set the share mode to determine if the filesystem is available for read only (ro), read and write (rw or on), or neither (off).

Related Topics

“Project Properties” on page 414

“Filesystem Properties” on page 420

SFTP Protocol

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

For the SFTP protocol (sharesftp), users can set the share mode to determine if the filesystem is available for read only (ro), read and write (rw or on), or neither (off).

Related Topics

“Project Properties” on page 414

“Filesystem Properties” on page 420

TFTP Protocol

Each share has protocol-specific properties that define the behavior of different protocols for that share. These properties can be defined for each share or inherited from a share's project.

For the TFTP protocol (sharetftp), users can set the share mode to determine if the filesystem is available for read only (ro), read and write (rw or on), or neither (off).

Related Topics

“Project Properties” on page 414

“Filesystem Properties” on page 420

Access Control Lists for Filesystems

You can set options to control ACL behavior as well as control access to the root directory of the filesystem.

Note -

ACLs are available only for filesystems.

Shares and Projects 453

Access Control Lists for Filesystems

For more information about ACLs, see the following topics:

“Root Directory Access” on page 454

“ACL Behavior on Mode Change” on page 455

“ACL Inheritance Behavior” on page 456

“Root Directory ACL” on page 457

Root Directory Access

To set basic access control for the root directory of the filesystem, go to Shares > Shares >

filesystem > Access. These settings can be managed in-band via whatever protocols are being used, but they can also be specified here for convenience. These properties cannot be changed on a read-only filesystem, as they require changing metadata for the root directory of the filesystem.

User - The owner of the root directory. This can be specified as a user ID or user name. For

more information on mapping UNIX and Windows users, see Identity Mapping . For UNIX-

based NFS access, this can be changed from the client using the chown command.

Group - The group of the root directory. This can be specified as a group ID or group name.

For more information on mapping UNIX and Windows groups, see

Identity Mapping

. For

UNIX-based NFS access, this can be changed from the client using the chgrp command.

Permissions - Standard UNIX permissions for the root directory. For UNIX-based NFS access, this can be changed from the client using the chmod command. The permissions are divided into three types.

Access Type

User

Group

Other

Description

User that is the current owner of the directory.

Group that is the current group of the directory.

All other accesses.

For each access type, the following permissions can be granted.

Type

Read

Write

Execute

R

W

X

Description

Permission to list the contents of the directory.

Permission to create files in the directory.*

Permission to look up entries in the directory. If users have

454 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Access Control Lists for Filesystems

Type Description

execute permissions but not read permissions, they can access files explicitly by name but not list the contents of the directory.

Related Topics

“ACL Behavior on Mode Change” on page 455

“ACL Inheritance Behavior” on page 456

“Root Directory ACL” on page 457

ACL Behavior on Mode Change

When an ACL is modified via chmod(2) using the standard UNIX user/group/other permissions, the simplified mode change request will interact with the existing ACL in different ways depending on the setting of this property. To edit the ACL behavior on mode change, see

Editing a Project BUI

,

CLI .

TABLE 122

BUI Value

Discard ACL

Mode Change Values

CLI Value

discard

Mask ACL with mode

Do not change ACL mask passthrough

Description

All ACL entries that do not represent the mode of the directory or file are discarded. This is the default behavior.

The permissions are reduced, such that they are no greater than the group permission bits, unless it is a user entry that has the same UID as the owner of the file or directory. In this case, the ACL permissions are reduced so that they are no greater than owner permission bits. The mask value also preserves the ACL across mode changes, provided an explicit ACL set operation has not been performed.

No changes are made to the ACL other than generating the necessary

ACL entries to represent the new mode of the file or directory.

Related Topics

“Root Directory ACL” on page 457

Shares and Projects 455

Access Control Lists for Filesystems

“ACL Inheritance Behavior” on page 456

“Root Directory ACL” on page 457

ACL Inheritance Behavior

When a new file or directory is created, it is possible to inherit existing ACL settings from the parent directory. This property controls how this inheritance works. These property settings usually only affect ACL entries that are flagged as inheritable - other entries are not propagated regardless of this property setting. However, all trivial ACL entries are inheritable when used with SMB. A trivial ACL represents the traditional UNIX owner/group/other entries. To edit the ACL inheritance behavior, see Editing a Project

BUI , CLI

.

TABLE 123

ACL Inheritance Behavior Values

BUI Value

Do not inherit entries

CLI Value

discard

Only inherit deny entries

Inherit all but "write ACL" and

"change owner"

Inherit all entries

Inherit all but "execute" when not specified noallow restricted passthrough passthrough-x

Description

No ACL entries are inherited. The file or directory is created according to the client and protocol being used.

Only inheritable ACL entries specifying "deny" permissions are inherited.

Removes the "write_acl" and

"write_owner" permissions when the ACL entry is inherited, but otherwise leaves inheritable ACL entries untouched. This is the default.

All inheritable ACL entries are inherited. The "passthrough" mode is typically used to cause all "data" files to be created with an identical mode in a directory tree. An administrator sets up ACL inheritance so that all files are created with a mode, such as

0664 or 0666.

Same as 'passthrough', except that the owner, group, and everyone

ACL entries inherit the execute permission only if the file creation mode also requests the execute bit.

The "passthrough" setting works as expected for data files, but you might want to optionally include the execute bit from the file creation mode into the inherited ACL. One example is an output file that is generated from tools, such as "cc" or "gcc". If the inherited ACL

456 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Access Control Lists for Filesystems

BUI Value CLI Value

Inherit all, but preserve mode from client passthrough-mode-preserve

Description

doesn't include the execute bit, then the output executable from the compiler won't be executable until you use chmod(1) to change the file's permissions.

Inheritable ACL entries are inherited, while preserving the creation mode specified by the application. This preserves the inheritance bits so

SMB creates ACLs that interoperate well with shares accessed over NFS and SMB simultaneously. This property setting is only available after applying the deferred update for ACL Passthrough with Mode

Preservation. For more information, see “Deferred Updates” in Oracle

ZFS Storage Appliance Customer

Service Manual

.

When using SMB to create a file in a directory with a trivial ACL, all ACL entries are inherited.

As a result, the following behavior occurs:

Inheritance bits display differently when viewed in SMB or NFS. When viewing the ACL directory in SMB, inheritance bits are displayed. In NFS, inheritance bits are not displayed.

When a file is created in a directory using SMB, its ACL entries are shown as inherited; however, when viewed through NFS, the directory has no inheritable ACL entries.

If the ACL is changed so that it is no longer trivial, e.g., by adding an access control entry

(ACE), this behavior does not occur.

If the ACL is modified using SMB, the resulting ACL will have the previously synthetic inheritance bits turned into real inheritance bits.

Related Topics

“Project Properties” on page 414

Root Directory ACL

Fine-grained access on files and directories is managed via Access Control Lists. An ACL describes what permissions are granted, if any, to specific users or groups. The appliance supports NFSv4.0 and NFSv4.1-style ACLs, also accessible over SMB. POSIX draft ACLs

(used by NFSv3) are not supported. Some trivial ACLs can be represented over NFSv3, but making complicated ACL changes may result in undefined behavior when accessed over

NFSv3.

Shares and Projects 457

Access Control Lists for Filesystems

Like root directory access, this property only affects the root directory of the filesystem. ACLs can be controlled through in-band protocol management; BUI and CLI provide a way to set the ACL just for the root directory of the filesystem. You can use in-band management tools if the BUI is not an option. Changing this ACL does not affect existing files and directories in the filesystem. Depending on the ACL inheritance behavior, these settings may or may not be inherited by newly created files and directories. However, all ACL entries are inherited when

SMB is used to create a file in a directory with a trivial ACL.

An ACL is composed of any number of ACEs (access control entries). Each ACE describes a type/target, a set of permissions, inheritance flags and a mode. ACEs are applied in order, starting at the beginning of the ACL, to determine whether a given action should be permitted.

For information on in-band configuration ACLs through data protocols, consult the appropriate client documentation. The BUI interface for managing ACLs and the effect on the root directory are described here.

Share - ACL Types

TABLE 124

Type

Owner

Group

Everyone

Named User

Named Group

Description

Current owner of the directory. If the owner is changed, this ACE will apply to the new owner.

Current group of the directory. If the group is changed, this ACE will apply to the new group.

Any user.

User named by the 'target' field. The user can be specified as a user ID or a name resolvable by the current name service configuration.

Group named by the 'target' field. The group can be specified as a group ID or a name resolvable by the current name service configuration.

TABLE 125

Mode

Allow

Deny

Share - ACL Modes

Description

The permissions are explicitly granted to the ACE target.

The permissions are explicitly denied to the ACE target.

TABLE 126

(r)

Share - ACL Permissions

Permission

Read

Read Data/List Directory

Description

Permission to list the contents of a directory. When inherited by a file, permission to read the data of the file.

458 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

(R)

(w)

(p)

(x)

(a)

(d)

(D)

(A)

(W)

(c)

(C)

(o)

Access Control Lists for Filesystems

Permission

Execute File/Traverse Directory

Read Attributes

Read Extended Attributes

Write

Write Data/Add File

Append Data/Add Subdirectory

Delete

Delete Child

Write Attributes

Write Extended Attributes

Admin

Read ACL/Permissions

Write ACL/Permissions

Change Owner

Inheritance

Description

Permission to traverse (lookup) entries in a directory. When inherited by a file, permission to execute the file.

Permission to read basic attributes

(non-ACLs) of a file. Basic attributes are considered to be the stat level attributes, and allowing this permission means that the user can execute ls and stat equivalents.

Permission to read the extended attributes of a file or do a lookup in the extended attributes directory.

Permission to add a new file to a directory. When inherited by a file, permission to modify a file's data anywhere in the file's offset range.

This include the ability to grow the file or write to any arbitrary offset.

Permission to create a subdirectory within a directory. When inherited by a file, permission to modify the file's data, but only starting at the end of the file. This permission (when applied to files) is not currently supported.

Permission to delete a file.

Permission to delete a file within a directory. As of the 2011.1 software release, if the sticky bit is set, a child file can only be deleted by the file owner.

Permission to change the times associated with a file or directory.

Permission to create extended attributes or write to the extended attributes directory.

Permission to read the ACL.

Permission to write the ACL or change the basic access modes.

Permission to change the owner.

Shares and Projects 459

Access Control Lists for Filesystems

(f)

(d)

(i)

(n)

Permission

Apply to Files

Apply to Directories

Do not apply to self

Do not apply past children

Description

Inherit to all newly created files in a directory.

Inherit to all newly created directories in a directory.

The current ACE is not applied to the current directory, but does apply to children. This flag requires one of "Apply to Files" or "Apply to

Directories" to be set.

The current ACE should only be inherited one level of the tree, to immediate children. This flag requires one of "Apply to Files" or

"Apply to Directories" to be set.

When the option to use Windows default permissions is used at share creation time, an ACL with the following three entries is created for the share's root directory:

TABLE 127

Type

Owner

Group

Everyone

Share Root Directory Entities

Action

Allow

Allow

Allow

Access

Full Control

Read and Execute

Read and Execute

In the CLI, set the root directory ACL properties after navigating to the shares context and selecting a project and filesystem. Use colons to separate the ACE properties, and separate multiple ACE entries with commas. The target and inheritance fields are optional. To set the properties, enter set root_acl=ace1,ace2,ace3,..., where acen is: type:<target:>permissions:<inheritance:>mode

Examples: set [email protected]:r:allow set [email protected]:rwx:fd:allow set root_acl=user:root:r:allow

460 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Working with Schemas

Working with Schemas

In addition to the standard built in properties, you can configure any number of additional properties that are available on all shares and projects. These properties are given basic types for validation purposes, and are inherited like most other standard properties. The values are never consumed by the software in any way, and exist solely for end-user consumption. The property schema is global to the system, across all pools, and is synchronized between cluster peers.

To work with schemas, see the following sections:

“Creating a Schema (BUI)” on page 461

“Creating a Schema (CLI)” on page 461

“Schema Properties” on page 463

7.

8.

5.

6.

1.

2.

3.

4.

Creating a Schema (BUI)

Go to Shares > Schema.

Click the '+' icon to add a new property to the schema property list.

Enter the name of the property ("contact").

Enter a description of the property ("Owner Contact").

Choose a type for the new property ("Email Address").

Click Apply.

Navigate to an existing share or project.

Change the "Owner Contact" property under the "Custom Properties" section.

1.

2.

3.

Creating a Schema (CLI)

Go to the schema context (shares schema).

Create a new property named "contact" (create contact).

Set the description for the property (set description="Owner Contact").

Shares and Projects 461

Creating a Schema (CLI)

4.

5.

6.

7.

Set the type of the property (set type=EmailAddress).

Commit the changes (commit).

Go to an existing share or project.

Set the "custom:contact" property.

Example 16

Example Schema

The schema context can be found at Shares > Schema".

carp:> shares schema carp:shares schema> show

Properties:

NAME TYPE DESCRIPTION owner EmailAddress Owner Contact

Each property is a child of the schema context, using the name of the property as the token. To create a property, use the create command: carp:shares schema> create department carp:shares schema department (uncommitted)> get

type = String

description = department carp:shares schema department (uncommitted)> set description="Department Code"

description = Department Code (uncommitted) carp:shares schema department (uncommitted)> commit carp:shares schema>

Within the context of a particular property, fields can be set using the standard CLI commands: carp:shares schema> select owner carp:shares schema owner> get

type = EmailAddress

description = Owner Contact carp:shares schema owner> set description="Owner Contact Email"

description = Owner Contact Email (uncommitted) carp:shares schema owner> commit

Once custom properties have been defined, they can be accessed like any other property under the name "custom:<property>":

462 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Creating a Schema (CLI) carp:shares default> get

...

custom:department = 123-45-6789

custom:owner =

...

carp:shares default> set custom:[email protected]

custom:owner = [email protected] (uncommitted) carp:shares default> commit

Schema Properties

To define custom properties, access the Shares > Schema navigation item. The current schema is displayed as a list, and entries can be added or removed as needed. Each property has the following fields:

TABLE 128

Field

NAME

DESCRIPTION

Schema Property Fields

TYPE

Description

The CLI name for this property. This must contain only alphanumeric characters or the characters ".:_\".

The BUI name for this property. This can contain arbitrary characters and is used in the help section of the

CLI

The property type, for validation purposes. This must be one of the types described below.

The valid types for properties are:

TABLE 129

BUI Type

String

Integer

Positive Integer

Boolean

Valid Types for Properties

CLI Type

String

Integer

PositiveInteger

Boolean

Email Address

Hostname or IP

EmailAddress

Host

Description

Arbitrary string data. This is the equivalent of no validation.

A positive or negative integer

A positive integer

A true/false value. In the BUI this is presented as a checkbox, while in the CLI it must be one of the values

"true" or "false".

An email address. Only minimal syntactic validation is done.

A valid DNS hostname or IP (v4 or v6) address.

Shares and Projects 463

Creating a Schema (CLI)

Once defined, the properties are available under the general properties tab, using the description provided in the property table. Properties are identified by their CLI name, so renaming a property will have the effect of removing all existing settings on the system. A property that is removed and later renamed back to the original name will still refer to the previously set values.

Changing the types of properties, while supported, may have undefined results on existing properties on the system. Existing properties will retain their current settings, even if they would be invalid given the new property type.

464 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Shadow Migration

A common task for administrators is to move data from one location to another. In the most abstract sense, this problem encompasses a large number of use cases, from replicating data between servers to keeping user data on laptops in sync with servers. There are many external tools available to do this, but the appliance has two integrated solutions for migrating data that addresses the most common use cases. The first, replication, is intended for replicating data between one or more appliances, and is covered separately; see

“Remote

Replication” on page 507 . The second, shadow migration, is described here.

Shadow migration is a process for migrating data from external NAS sources with the intent of replacing or decommissioning the original once the migration is complete. This is most often used when introducing a new appliance into an existing environment in order to take over file sharing duties of another server, but a number of other novel uses are possible, outlined below.

To use shadow migration, see the following sections:

“Understanding Shadow Migration” on page 466

“Creating a Shadow Filesystem” on page 468

“Managing Background Migration” on page 469

“Handling Migration Errors” on page 469

“Monitoring Migration Progress” on page 470

“Canceling Migration” on page 473

“Snapshotting Shadow File Systems” on page 473

“Backing Up Shadow File Systems” on page 474

“Replicating Shadow File Systems” on page 474

“Migrating Local File Systems” on page 474

“Using Shadow Migration Analytics” on page 475

“Testing Potential Shadow Migration using the CLI” on page 475

“Migrating Data from an Active NFS Server using the CLI” on page 476

Shadow Migration 465

Understanding Shadow Migration

Understanding Shadow Migration

Shadow migration uses interposition, but it is integrated into the appliance and does not require a separate physical machine. When filesystems are created, they can optionally "shadow" an existing directory, either locally or over NFS. In this scenario, downtime is scheduled once, where the source appliance X is placed into read-only mode, a share is created with the shadow property set, and clients are updated to point to the new share on the Oracle ZFS Storage

Appliance. Clients can then access the appliance in read-write mode.

FIGURE 27

Shadow Migration

Once the shadow property is set, data is transparently migrated in the background from the source appliance locally. If a request comes from a client for a file that has not yet been migrated, the appliance will automatically migrate this file to the local server before responding

466 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Understanding Shadow Migration to the request. This may incur some initial latency for some client requests, but once a file has been migrated, all accesses are local to the appliance and have native performance. It is often the case that the current working set for a filesystem is much smaller than the total size, so once this working set has been migrated, regardless of the total native size on the source, there will be no perceived impact on performance.

The downside to shadow migration is that it requires a commitment before the data has finished migrating, though this is the case with any interposition method. During the migration, portions of the data exist in two locations, which means that backups are more complicated, and snapshots may be incomplete and/or exist only on one host. It is therefore extremely important that any migration between two hosts first be tested thoroughly to make sure that identity management and access controls are setup correctly. This need not test the entire data migration, but it should be verified that files or directories that are not world readable are migrated correctly, ACLs (if any) are preserved, and identities are properly represented on the new system.

Shadow migration is implemented using on-disk data within the filesystem, so there is no external database and no data stored locally outside the storage pool. If a pool is failed over in a cluster, or both system disks fail and a new head node is required, all data necessary to continue shadow migration without interruption will be kept with the storage pool.

The following lists the restrictions on the shadow source:

In order to properly migrate data, the source filesystem or directory *must be read-only*.

Changes made to files source may or may not be propagated based on timing, and changes to the directory structure can result in unrecoverable errors on the appliance.

Shadow migration supports migration only from NFS sources. NFSv4.0 and NFSv4.1

filesystems will yield the best results. NFSv2 and NFSv3 migration are possible, but ACLs will be lost in the process and files that are too large for NFSv2 cannot be migrated using that protocol. Migration from SMB sources is not supported.

Shadow migration of LUNs is not supported.

During migration, if the client accesses a file or directory that has not yet been migrated, there is an observable effect on behavior. The following lists the shadow file system semantics:

For directories, client requests are blocked until meta-data infrastructure is created on the migration target for any intervening directories for which infrastructure is not yet established. For files, only the portion of the file being requested is migrated, and multiple clients can migrate different portions of a file at the same time.

Files and directories can be arbitrarily renamed, removed, or overwritten on the shadow filesystem without any effect on the migration process.

For files that are hard links, the hard link count may not match the source until the migration is complete.

The majority of file attributes are migrated when the directory is created, but the on-disk size (st_nblocks in the UNIX stat structure) is not available until a read or write operation is

Shadow Migration 467

Creating a Shadow Filesystem

■ done on the file. The logical size will be correct, but a du(1) or other command will report a zero size until the file contents are actually migrated.

If the appliance is rebooted, the migration will pick up where it left off originally. While it will not have to re-migrate data, it may have to traverse some already-migrated portions of the local filesystem, so there may be some impact to the total migration time due to the interruption.

Data migration makes use of private extended attributes on files. These are generally not observable except on the root directory of the filesystem or through snapshots. Adding, modifying, or removing any extended attribute that begins with SUNWshadow will have undefined effects on the migration process and will result in incomplete or corrupt state. In addition, filesystem-wide state is stored in the .SUNWshadow directory at the root of the filesystem. Any modification to this content will have a similar effect.

Once a filesystem has completed migration, an alert will be posted, and the shadow attribute will be removed, along with any applicable metadata. After this point, the filesystem will be indistinguishable from a normal filesystem.

Data can be migrated across multiple filesystems into a singe filesystem, through the use of

NFSv4.0 or NFSv4.1 automatic client mounts (sometimes called "mirror mounts") or nested local mounts.

Use the following rules to migrate identity information for files, including ACLs:

The migration source and target appliance must have the same name service configuration.

The migration source and target appliance must have the same NFSv4.0 or NFSv4.1 mapid domain

The migration source must support NFSv4.0 and NFSv4.1. Use of NFSv3 is possible, but some loss of information will result. Basic identity information (owner and group) and

POSIX permissions will be preserved, but any ACLs will be lost.

The migration source must be exported with root permissions to the appliance.

If you see files or directories owned by "nobody", it likely means that the appliance does not have name services setup correctly, or that the NFSv4.0 or NFSv4.1 mapid domain is different. If you get 'permission denied' errors while traversing filesystems that the client should otherwise have access to, the most likely problem is failure to export the migration source with root permissions.

Creating a Shadow Filesystem

The shadow migration source can only be set when a filesystem is created. In the BUI, this is available in the filesystem creation dialog. In the CLI, it is available as the shadow property. The property takes one of the following forms:

468 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Managing Background Migration

Local - file:///<path>

NFS - nfs://<host>/<path>

The BUI also allows the alternate form <host>:/<path> for NFS mounts, which matches the syntax used in UNIX systems. The BUI also sets the protocol portion of the setting (file:// or nfs://

) via the use of a pull down menu. When creating a filesystem, the server will verify that the path exists and can be mounted.

Managing Background Migration

When a share is created, it will automatically begin migrating in the background, in addition to servicing inline requests. This migration is controlled by the shadow migration service. There is a single global tunable, which is the number of threads dedicated to this task. Increasing the number of threads will result in greater parallelism at the expense of additional resources.

The shadow migration service can be disabled, but this should only be used for testing purposes, or when the active of shadow migration is overwhelming the system to the point where it needs to be temporarily stopped. When the shadow migration service is disabled, synchronous requests are still migrated as needed, but no background migration occurs. With the service disabled, no shadow migration will ever complete, even if all the contents of the filesystem are read manually. It is highly recommended to always leave the service enabled.

Handling Migration Errors

Because shadow migration requires committing new writes to the server prior to migration being complete, it is very important to test migration and monitor for any errors. Errors encountered during background migration are kept and displayed in the BUI as part of shadow migration status. Errors encountered during other synchronous migration are not tracked, but will be accounted for once the background process accesses the affected file. For each file, the remote filename as well as the specific error are kept. Clicking on the information icon next to the error count will bring up this detailed list. The error list is not updated as errors are fixed, but simply cleared by virtue of the migration completing successfully.

Shadow migration will not complete until all files are migrated successfully. If there are errors, the background migration will continually retry the migration until it succeeds. This allows the administrator to fix any errors (such as permission problems), let the migration complete, and be assured of success. If the migration cannot complete due to persistent errors, the migration can be canceled, leaving the local filesystem with whatever data was able to be migrated. This should only be used as a last resort; once migration has been canceled, it cannot be resumed.

Shadow Migration 469

Monitoring Migration Progress

Monitoring Migration Progress

To monitor shadow migration progress, the appliance provides such statistics as:

Size of data transferred so far

Estimate of remaining size to be migrated

Migration time so far

Migration time remaining

Migration errors

At the beginning of migration, the appliance obtains the source filesystem statistics and calculates its size. It uses these values to provide a reasonably accurate visual representation of migration progress and an estimation of the remaining data to be migrated. Of note, the remaining bytes is an estimate based on the assumption that an entire filesystem is being migrated. If only part of the source file system is migrated, the remaining bytes estimate is inaccurate. If the source filesystem has nested filesystems, the total filesystem size is recalculated when the nested mount point is discovered during migration, and the remaining bytes are re-estimated based on the newly calculated total. Estimation of remaining bytes may be inaccurate if the source filesystem uses compression. These values are available in the BUI and CLI through both the standard filesystem properties as well as properties of the shadow migration node (or UI panel).

Note -

When a sparse file (a file with empty blocks) is migrated, the target file will be smaller than the source file size. Shadow migration does not write the empty blocks to the target file, resulting in less space usage.

The following tasks describe how to monitor shadow migration progress and view any resulting errors. To view shadow migration errors using the RESTful API, see “Filesystem Operations” in Oracle ZFS Storage Appliance RESTful API Guide, Release OS8.7.0 .

1.

Monitoring Migration Progress and Errors (BUI)

Go to Shares > Shares, and select a filesystem with shadow migration source.

470 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Monitoring Migration Progress and Errors (CLI)

2.

Under Shadow Migration, examine the progress bar and shadow migration status.

3.

To view shadow migration errors, click the edit icon .

1.

Monitoring Migration Progress and Errors (CLI)

Go to a filesystem with shadow migration source and enter shadow, and then enter list.

hostname:shares default/file_sys1> shadow hostname:shares default/file_sys1 shadow> list

Properties:

source = nfs://zfs0000-15/sm/errors

transferred = (unset)

remaining = 1.37G

elapsed = 0h3m

errors = 23

complete = true

time = (unset)

Children:

errors => Shadow Migration Errors hostname:shares default/file_sys1 shadow>

Note -

If there is no shadow migration source defined shadow=none, then the shadow command is invalid for the filesystem: hostname:shares default/xyz_1> shadow error: invalid command "shadow"

2.

To view shadow migration errors, enter child node errors and enter help to view a list of subcommands.

Shadow Migration 471

Monitoring Migration Progress and Errors (CLI) hostname:shares default/file_sys1 shadow> errors hostname:shares default/file_sys1 shadow errors> help

Subcommands that are valid in this context:

help [topic] => Get context-sensitive help. If [topic] is specified,

it must be one of "builtins", "commands", "general",

"help" or "script".

show => Show information pertinent to the current context

done => Finish operating on "errors"

select [entry] => Select the specified entry to get its properties,

set its properties, or run a subcommand

list => Lists up to the first 100 errors. The "-a" option may be

used to list all the errors if there are more that 100

errors. The "-number" option may be used to list the first

(number) of errors. Format: list -a or list -xx

3.

Enter show to view individual migration errors in the current context.

hostname:shares default/file_sys1 shadow errors> show

Errors:

PATH REASON ak-2013-dev-on-clone.tar.gz Permission denied test_dir/CREDITS.html Permission denied test_dir/CREDITS_ja.html Permission denied test_dir/CREDITS_pt_BR.html Permission denied test_dir/CREDITS_zh_CN.html Permission denied test_dir/DISTRIBUTION.txt Permission denied test_dir/LEGALNOTICE.txt Permission denied test_dir/LICENSE.txt Permission denied test_dir/README.html Permission denied test_dir/README_ja.html Permission denied test_dir/README_pt_BR.html Permission denied test_dir/README_zh_CN.html Permission denied test_dir/THIRDPARTYLICENSE.txt Permission denied test_dir/bin Permission denied test_dir/cnd2 Permission denied test_dir/etc Permission denied test_dir/gsf1 Permission denied test_dir/ide10 Permission denied test_dir/modCluster.properties Permission denied

472 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Canceling Migration

4.

test_dir/nb6.5 Permission denied test_dir/forms.css Permission denied test_dir/platform9 Permission denied test_dir/websvccommon1 Permission denied

To view an individual error, enter the select command and an individual error name. Then enter show.

To view individual error properties, use the get command.

hostname:shares default/file_sys1 shadow errors> select test_dir/nb6.5 hostname:shares default/file_sys1 shadow errors test_dir/nb6.5> show

Properties:

path = test_dir/nb6.5

reason = Permission denied hostname:shares default/file_sys1 shadow errors test_dir/nb6.5> get path

path = test_dir/nb6.5

hostname:shares default/file_sys1 shadow errors test_dir/nb6.5> get reason

reason = Permission denied hostname:shares default/file_sys1 shadow errors test_dir/nb6.5> done hostname:shares default/file_sys1 shadow errors>

Canceling Migration

Migration can be canceled, but this should only be done in extreme circumstances when the source is no longer available. Once migration has been canceled, it cannot be resumed.

The primary purpose is to allow migration to complete when there are uncorrectable errors on the source. If the complete filesystem has finished migration except for a few files or directories, and there is no way to correct these errors (i.e. the source is permanently broken), then canceling the migration will allow the local filesystem to resume status as a 'normal' filesystem.

To cancel migration in the BUI, click the close icon next to the progress bar in the left column of the share in question. In the CLI, migrate to the shadow node beneath the filesystem and run the cancel command.

Snapshotting Shadow File Systems

Shadow filesystems can be snapshotted; however, the state of what is included in the snapshot is arbitrary. Files that have not yet been migrated will not be present, and implementation

Shadow Migration 473

Backing Up Shadow File Systems details (such as SUNWshadow extended attributes) may be visible in the snapshot. This snapshot can be used to restore individual files that have been migrated or modified since the original migration began. Because of this, it is recommended that any snapshots be kept on the source until the migration is completed, so that unmigrated files can still be retrieved from the source if necessary. Depending on the retention policy, it may be necessary to extend retention on the source in order to meet service requirements. While snapshots can be taken, these snapshots cannot be rolled back to, nor can they be the source of a clone.

Backing Up Shadow File Systems

Filesystems that are actively migrating shadow data can be backed using NDMP as with any other filesystem. The shadow setting is preserved with the backup stream, but will be restored only if a complete restore of the filesystem is done and the share doesn't already exist. Restoring individual files from such a backup stream or restoring into existing filesystems may result in inconsistent state or data corruption. During the full filesystem restore, the filesystem will be in an inconsistent state (beyond the normal inconsistency of a partial restore) and shadow migration will not be active. Only when the restore is completed is the shadow setting restored.

If the shadow source is no longer present or has moved, the administrator can observe any errors and correct them as necessary.

Replicating Shadow File Systems

Filesystems that are actively migrating shadow data can be replicated using the normal mechanism, but only the migrated data is sent in the data stream. As such, the remote side contains only partial data that may represent an inconsistent state. The shadow setting is sent along with the replication stream, so when the remote target is failed over, it will keep the same shadow setting. As with restoring an NDMP backup stream, this setting may be incorrect in the context of the remote target. After failing over the target, the administrator can observe any errors and correct the shadow setting as necessary for the new environment.

Migrating Local File Systems

In addition to its primary purpose of migrating data from remote sources, the same mechanism can also be used to migrate data from local filesystem to another on the appliance. This can be used to change settings that otherwise cannot be modified, such as creating a compressed version of a filesystem or changing the recordsize for a filesystem after the fact. In this model, the old share (or subdirectory within a share) is made read-only or moved aside, and a new

474 Oracle ZFS Storage Appliance Administration Guide, Release OS8.7.0 • July 2017

Using Shadow Migration Analytics share is created with the shadow property set using the file protocol. Clients access this new share, and data is written using the settings of the new share.

Using Shadow Migration Analytics

In addition to standard monitoring on a per-share basis, it is also possible to monitor shadow migration system-wide through Analytics. The shadow migration analytics are available under the "Data Movement" category. There are three basic statistics available:

Shadow Migration Requests - This statistic tracks requests for files or directories that are not cached and known to be local to the filesystem. It does account for both migrated and unmigrated files and directories, and it can be used to track the latency incurred as part of shadow migration, as well as track the progress of background migration. It can be broken down by file, share, project, or latency. It currently encompasses both synchronous and asynchronous (background) migration, so it is not possible to view only latency visible to clients.

Shadow Migration Bytes - This statistic tracks bytes transferred as part of migrating file or directory contents. This does not apply to metadata (extended attributes, ACLs, etc). It gives a rough approximation of the data transferred, but source datasets with a large amount of metadata will show a disproportionally small bandwidth. The complete bandwidth can be observed by looking at network analytics. This statistic can be broken down by local filename, share, or project.

Shadow Migration Operations - This statistic tracks operations that require going to the source filesystem. This can be used to track the latency of requests from the shadow migration source. It can be broken down by file, share, project, or latency.

Testing Potential Shadow Migration using the CLI

Before attempting a complete migration, it is important to test the migration to make sure that the appliance has appropriate permissions and security attributes are translated correctly. Once you are confident that the basic setup is functional, the filesystems can be setup for the final migration.

Note -

As part of capacity planning, remember to take into account default/user group quotas because the quotas could be exceeded if the source is larger than the destination. Also, shadow migration will fail if the target runs out of disk space.

1.

Configure the source so that the appliance has root access to the share.

This typically involves adding an NFS host-based exception or setting

Shadow Migration 475

Migrating Data from an Active NFS Server using the CLI

2.

3.

4.

the anonymous user mapping (the latter having more significant security implications).

Create a share on the local filesystem w