Prepare NetApp clustered data ONTAP file servers
Collectors for NetApp file servers
Collectors for NetApp file servers are dedicated Windows servers with the collector service running.
We strongly recommend that you use a Collector server within the same network segment as the NetApp file server, otherwise performance and routing problems may occur.
The FS Logga for NetApp file servers does not require a filter driver installation like on Windows file servers.
Set NetApp file servers findable
In Active Directory registered NetApp file servers have a typical value set in the LDAP attribute operatingSystem. This property is used by the collector to detect NetApp file servers and mark it as NetApp file server type in the FS Logga configuration.
By default, the operatingSystem value of the NetApp file servers is set to OnTap or NetApp in the collector configuration file. If your NetApp file servers use different values for the operatingSystem property, you can adjust the search parameters.
If your NetApp file server is not registered in Active Directory, you must create a computer account and set the operatingSystem attribute accordingly.
Configuration file
pnCollector.config.xml
Computer
Collector server which is configured for the NetApp file server.
Path
%ProgramData%\Protected Networks\8MAN\cfg
If the file does not exist, copy the "template" from the following path:
old: %ProgramFiles%\Protected Networks\8MAN\etc
new: %ProgramFiles%\solarwinds\ARM\etc
Code
<?xml version="1.0" encoding="utf-8"?>
<config>
<tracer>
<netapp>
<NetappOperatingSystems>OnTap,NetApp</NetappOperatingSystems>
</netapp>
</tracer>
</config>
Possible Values
Add your operatingSystem values comma-separated.
If your NetApp file servers have different values for the property “operatingSystem” then insert all these values separated by comma.
If no or not all NetApp file servers register the property “operatingSystem” in the Active Directory leave the entry empty in the collectors configuration file. With an empty entry you will get all non-EMC or non-Windows computer accounts from Active Directory visible for the used account.
Set up encrypted data transfer on the collector
The following steps are only necessary if communication between NetApp and the collector is to be encrypted.
If you have configured encrypted data transfer (see chapter Creating the External Engine Configuration) you also have to adapt the pnTracer.config.xml file on the collector server. For each file server (CIFS server on the NetApp) to be monitored on this collector, the following entry have to be added under <tracer><netapp><ssl><cifsServers>:
<name of cifs server>
<switchOn type="System.Boolean">true</switchOn>
<protocol type="System.Int32">5</protocol>
<serverCertificateName>name of certificate from certificate store to use</serverCertificateName>
</name of cifs server>
The certificate must be installed in the computers certificate store.
For <protocol> the following values are possible: TLS = 1, TLS1.1 = 2, TLS1.2 = 3, SSL2 = 4, SSL3 = 5. Default is SSL3 (5).
Choose a protocol available on both collector and NetApp.
FPolicy feature
The FS-Logga for NetApp file server uses the NetApp FPolicy feature. Therefore it has to be activated and properly configured via CLI.
To configure the FPolicy feature you have to use an account of role admin or vsadmin on the NetApp.
In all following CLI commands the parameter “<vserver_name>” has to be replaced by the name of the SVM (Storage Virtual Machine).
Creating the event configuration
The event configuration determines:
- which events will be monitored
- which events will not be monitored
- which protocol is used (only the CIFS protocol is supported by FS Logga)
Change only the parameter “<vserver_name>”. All other changes may lead to missing events in the reports or to higher load of collector and NetApp because of processing of not used events.
Command
fpolicy policy event create -vserver <vserver_name> -event-name event_8manlogga_cifs -file-operations create, create_dir, delete, delete_dir, read, write, rename, rename_dir, setattr, open -protocol cifs -filters first-read, first-write, open-with-delete-intent
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
With the following command you can check the result:
fpolicy policy event show
Creating the External Engine Configuration
The External Engine Configuration determines to which server (defined by IP address and port) the events has to be sent by the NetApp. The IP address has to be an address of the FS-Logga collector reachable by the NetApp. The port must be a free and reachable port on the collector.
Command
fpolicy policy external-engine create -vserver <vserver_name> -engine-name engine_8manlogga -primary-servers <collector-ip> -port 2002 -extern-engine-type asynchronous -ssl-option <ssl-option>
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
<collector-ip>
- IP address of the collector
<ssl-option>
- "
no-auth
" - no encryption - "
server-auth
" - use encryption
If you want to use encryption, it must be configured on the collector and on the NetApp.
With the following command you can check the result:
fpolicy policy external-engine show
Creating the FPolicy Configuration
The FPolicy Configuration is the assembly of Event- and External Engine Configuration.
Command
fpolicy policy create -vserver <vserver_name> -policy-name 8manlogga -events event_8manlogga_cifs -engine engine_8manlogga -is-mandatory false
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
With the following command you can check the result:
fpolicy policy show
Creating the scope for the FPolicy
Use the following command to specify the volumes to be monitored, including their shares, directories, and files.
Command
fpolicy policy scope create -vserver <vserver_name> -policy-name 8manlogga -volumes-to-include "*"
Optional: Replace
"*"
If only certain volumes are to be monitored, we recommend specifying a comma-separated list of these volumes instead of the wildcard ("*"). This reduces the load on the NetApp file server and on the collector.
Enable FPolicy
If all of the above steps were successful, you need to activate the policy. Even if only one policy is defined, the system requires a sequence number.
Command
fpolicy enable -vserver <vserver_name> -policy-name 8manlogga -sequence-number 1
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
The sequence number must always be specified, even if there is only one FPolicy. It determines the order in which the FPolicies are processed.
With the following command you can check the result:
fpolicy show-enabled
Domain accounts
To read the shares local pathes an account is needed which is member of the local group "Power Users" on the NetApp SVM. With this account the Logga has to be configured later.
Command
vserver cifs users-and-groups local-group add-members -vserver <vserver_name> -group-name "BUILTIN\Power Users" -member-names <domain\user>
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
<domain\user>
- User account used to configure FS Logga within ARM
The Logga uses the ONTAP API to read FPolicy data and request the NetApp to start Logging for the external engine. For this the Logga needs an account with restricted access rights on the NetApp. Therefore a new role should be created and the rights of this role will be defined.
Commands
security login role create -role 8manrole -vserver <vserver_name> -cmd "vserver fpolicy"
security login role create -role 8manrole -vserver <vserver_name> -cmd "volume" -access readonly
security login role create -role 8manrole -vserver <vserver_name> -cmd "vserver" -access readonly
security login role create -role 8manrole -vserver <vserver_name> -cmd "version" -access readonly
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
With the following command you can check the result:
security login role show
Assign the new role to the account used by the Logga
security login create -username <domain\username> -application ontapi -authmethod domain -role
8manrole -vserver <vserver_name>
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
<domain\username>
- User account used to configure FS Logga within ARM
With the following command you can check the result:
security login show
Firewall configuration
The Logga uses the ONTAP API via https to read FPolicy data and to request the NetApp to start logging for the external engine. The service https must be configured on a LIF (Logical Interface) of the SVM. This LIF must be reachable by the collector.
Use the following command to see the service that is active on which SVM firewall policy:
system service firewall policy show
The assignment of firewall policies to LIF of a certain SVM can be checked with:
network interface show -vserver <vserver_name> -fields firewall-policy
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
If a firewall policy with the service https is already active on a LIF of the SVM, then you only need to change the 'allow-list':
system services firewall policy modify -vserver <vserver_name> -policy <current_firewall_policy>
-service https -allow-list <collector-ip/32>
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
<current_firewall_policy>
- already activated firewall policy
<collector-ip/32>
- IP address of the collector
If you do not want to change the current firewall policy, you can create a copy of this firewall policy, perform the necessary changes, and then assign this new firewall policy to the appropriate LIF:
system services firewall policy clone -vserver <vserver_name> -policy <current_firewall_policy>
-destination-policy 8manlogga_fp
If the https service already exists in the cloned firewall policy:
system services firewall policy modify -vserver <vserver_name> -policy 8manlogga_fp -service https
-allow-list <collector-ip/32>
If the https service is not present in the cloned firewall policy:
system services firewall policy create -vserver <vserver_name> -policy 8manlogga_fp -service https
-allow-list <collector-ip/32>
network interface modify -vserver <vserver_name> -lif <lif> -firewall-policy 8manlogga_fp
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
<current_firewall_policy>
- already activated firewall policy
<collector-ip/32>
- IP address of the collector
<lif>
- Name of the Logical Interface
Certificate configuration for encrypted event data transfer
If you have configured encrypted event data transfer between NetApp and Logga (see “Creating the External Engine Configuration”) then the public certificate of certificate authority that is used to sign the collector certificate has to be installed on the SVM:
security certificate install -vserver <vserver_name> -type client-ca
Replace:
<vserver_name>
- name of the SVM (Storage Virtual Machine)
Use the following command to verify that the certificate has been installed:
security certificate show