Migration Management

·         Please configure the same time zone of HDI and the Management console. If these time zones are different, the different time zone is applied the configuration and display of the migration management time.

NFS Service

·         When stopping or restarting NFS service, please request the administrator using service of a client to suspend access to File Sharing.

·         When using the nfscacheflush command, please do not access from an NFS client to a file system. If the nfscacheflush command is used during accessing, an EIO error may occur.

·         When the file system is used and a file lock demand competes by the NFS protocol version 2 or the version 3, and the TCP protocol from the NFS client using a version higher than Red Hat software Enterprise Linux Advanced Platform v5.2 (Linux version 2.6.18-92.e15), file lock operation may become slow.

CIFS Service

·         The first CIFS access after failover or failback may fail. In this case, retry the operation.

·         When CIFS clients display a shortcut file with the offline attribute, the file's icon might not be displayed.
You can confirm whether the file is shortcut file or not from the line of type on the details expression of Explorer.

KAQG72016-E Message

·         Check the status of the cluster. If the status is DISABLE, contact maintenance personnel.

The CIFS bypass traverse checking" function

·         The default setting of "CIFS bypass traverse checking" when creating a file system has been changed as Table 4 in 4.2.0-00 or later.

Table 4.  The default operation of creating a file system

·         CIFS bypass traverse checking function has been setup as disable if the update installation from a version former than 4.2.0-00 is performed. Please change the setting when you use CIFS bypass traverse checking function

Integrating with HCP

·         If the update installation from a version former than 3.2.1-00 is performed, then replica HCP setting is deactivated. Configure replica HCP again as necessary. If the file system refers to data in a file system on another HDI system, configure replica system again as necessary.

·         When update installation is performed from a version earlier than 3.2.0-00, perform one of the following operations.

o    - Create a user account of tenant administrator with the name same as data access account in HCP.

o    - After update installation of Hitachi File Services Manager, perform the setting of tenant administrator using HCP Settings of Configuration Wizard.

·         When a file of 200MB or larger is migrated with the HTTP compression enabled while other than "0" is set to the period for monitoring the transfer speed and the lowest transfer speed to the HCP system, the average speed of transfer may be lower than the limit and the migration may fail with time-out. Set "0" to the period for monitoring the transfer speed and the lowest transfer speed, so that a time-out does not occur until the time set to time-out of communication to HCP has passed even when the transfer speed to HCP is low.

·         When the priority of file stubbing is changed by arcconfedit command, if the priority of stubbing is high, the processing time of data reading/writing from a client and migration/recall may get longer. Do not keep the stubbing priority high but change it in the case that an increase in data writing from clients is expected.

·         When a failure occurs in the network between HDI and HCP or in HCP, a wait for a response from HCP continues, which may affect the performance of accesses from file share clients to HDI. In order to mitigate the effect on the access performance, set the wait time until reconnecting to HCP by arcconfedit command to be larger than --low-speed-time option. However, if a temporary communication errors frequently occur, such as a case where HDI is combined with HCP via network, as the wait status can be solved by the temporary communication error, set 60 or lower value. When an operation with communication to HCP, such as migration and recall, is performed under the condition that the communication error is detected but the wait time has not yet passed, a communication error is returned instead of connecting to HCP. If the wait time has passed, connecting to HCP is tried. Note that access to HCP is disabled until the wait time passes even when the error has been solved. Therefore, set the wait time to "0" and see if accesses to HCP are enabled. If the user can successfully access, restore the setting to the previous.

·         By the default setting, 5% (upper limit 40GB) of total capacity of the file system are secured as the reserved space that a system uses when creating a file system in 5.2.0-00 or later which links to HCP. This reserved space prevents that migration process and stubbing process are affected when the file system lacked the capacity. Because user cannot use reserved space, design total capacity of file system as total of user capacity and reserved space.

·         If the update installation from a version former than 5.2.0-00 is performed, reserved space is set as 0% to existing file systems. If necessary, set reserved space using arcresvset command.

·         When the reserved space is set in 5.2.0-00 or later, update management information process starts at 0:07 a.m. for stubbing process. This updating process takes up to an hour. While this process is running, the load of the system increases.

·         If KAQM55019-E message is reported at policy or schedule setting, the file system may be full. In this case, run arcresvget command and check the reservation capacity of the file system combined with HCP. If reservation capacity is not set, check the free capacity of the file system. If there is no free capacity, delete unnecessary files.

·         When user's operation to unmount the file system coincides with the migration event on the file system, there may be a case that KAQM04045-E displayed and the unmount operation fails. In above case is observed, please make sure that the migration completes and try to unmount the file system.

·         If user run arcmigstatus command while HDI runs migration, there might be chance to get KAQM37764-I message in output of the command. In the case, please re-run the command after a while.

·         If migration is performed using the Large File Transfer function during data import, the Large File Transfer processing fails and normal migration takes place. Set the Large File Transfer function to be disabled during data import.

CIFS Access Log

·         If the update installation from a version former than 4.0.0-03 is performed, "Rename items" (renaming files or folders) event of CIFS access log is not set in the Setting Events Logged to the CIFS Access Log page in GUI. If necessary, set the CIFS access log setting.

Negotiation Mode (4.1.0-02 or later)

·         With the negotiation mode having been added in 4.1.0-02, when the update installation from a version former than that is performed, the following negotiation mode name is changed. However, no action is required because the setting is not changed.

Before the change

(1) 1000Base Full Duplex

After the change

(1) 1000Base Full Duplex(Auto Negotiation)

·         In addition, when the update installation from a version former than 3.2.3-00 is performed, the following negotiation mode names are changed. However, no action is required because the settings are not changed.

Before the change

(1) 100Base Full Duplex

(2) 100Base Half Duplex

After the change

(1) 100Base Full Duplex(Auto Negotiation)

(2) 100Base Half Duplex(Auto Negotiation)

Internet Explorer 11.0 for the management console

·         An operation to open different window or tab by a click of anchor or button on the window may cause an unnecessary window (such as blank or in transition window) to be opened concurrently. In this case, close the unnecessary window. If this problem persists, create a new Windows user account and then operate the browser with the new user.

The subfolder monitoring function

·         When the setting of subfolder monitoring function (a function to report any change in response to a request for "monitoring all files and folders under the specified folder" from a CIFS client) is changed from "Disable" to "Enable", if many CIFS clients are connected, HDI may be highly loaded. In this case, setting the subfolder monitoring function to "disable" can solve the high load status.

SNMP manager

·         Hitachi-specific MIB object definition file is changed with the version 3.2.0-00. When update installation is performed from a version earlier than 3.2.0-00 to this version, the MIB definition file loaded in SNMP manager needs to be updated too. Load the MIB definition file from the following path of provided media.

\etc\snmp\STD-EX-MIB.txt

Editing link trunking

·         When link trunking information is edited, virtual IP addresses are reset. The time required to reset the virtual IP address is about 10 to 20 seconds per virtual IP address.
For this, if all the following conditions are met, editing link trunking may turn to time-out and fail. (Time-out time is 30 minutes.)

5)      Multiple VLAN interfaces are set to the link trunking port.

6)      90 or more virtual IP addresses in total are set to the set VLAN interfaces.

When the link trunking is edited under the above conditions, delete the interfaces set to the target link trunking port, reduce the number of virtual IP addresses to be less than that of (b), and then edit the link trunking. After editing link trunking is complete, set the interfaces again.

Using RID method user mapping

·         Make sure to set mapping for a domain registered to node.
If the above mapping is not set, access to share directory from a trusted domain user is disabled.

The subtree quota monitoring function

·         When the subtree Quota monitoring is set with versions earlier than 3.2.0-00, "the measure for the problem of CPU usage increase at subtree Quota monitoring" with versions 5.2.0-00 and later does not become effective.

·         To enable the measure, set the subtree Quota monitoring again to one of directories with the subtree Quota monitoring set in each file system.

Read write content sharing

·         If a file with a long name is migrated to a .conflict directory concurrently with an update in a different location, the file cannot be opened and copied to an arbitrary location other than .conflict directory. Therefore, set a file name to be 235 bytes or less in the case of NFS client.

·         If power supply of node stops during migration, all end users who use Read Write Content Sharing cannot operate directories.
At the time, the message below is output in hsmarc.log of each node.

KAQM37038-E Migration failed because a file of the same name exists on the HCP system. (file path = /system/namespace-name/mig_results/sync_list.number)

Also, the size of the following object referred from HCP namespace browser is 0.

https://rwcs-system.tenant-name.host-name/rest/system/namespace-name/mig_results/sync_list.maximum-number

To restore the status, contact HCP administrator and ask to download and upload the latest version of "sync_list.maximum-number" displayed on [Show versions] of HCP namespace browser.

·         When an RWCS file system that has not been mounted for a long period of time (default: 7 or more days) is mounted again, KAQM37021-E error may be reported. In this case, inconsistency of file system occurs so that run arcrestore command to ensure the consistency of file system.

Linking with HCP Anywhere

·         When you stop a power supply of HCP Anywhere or HCP in environment linking with HCP Anywhere, please stop a power supply of the HDI earlier.
If you stop a power supply of HCP Anywhere or HCP without stopping a power supply of the HDI, reporting from HDI to HCP Anywhere might fail in KAQM71018-E (authentication error) and service of the HDI might stop.
If KAQM71018-E (authentication error) occurs, please start HCP Anywhere and HCP, ask a manager of HCP Anywhere to reissue the password for the authentication, and perform [Update HCP Anywhere Credentials] in GUI of the HDI.

Access from Windows Server 2008 or Windows Vista

·         When accessing a CIFS share from Windows Server 2008 or Windows Vista using SMB2, a measure described in Microsoft Knowledge Base 978625 is required. Check Knowledge Base and contact Microsoft Windows support.
If the measure is not taken, Windows client becomes STOP error and error messages; "STOP: 0x00000027 (parameter1, parameter2, parameter3, parameter4)", and "mrxsmb20.sys - Address parameter1 base at parameter2, Datestamp parameter3", may appear on the blue screen.

The SMB3.0 encryption function

·         A CIFS client supporting SMB3.0 can access CIFS share with SMB3.0 encryption enabled.
For the setting on HDI when the encryption is used, see the table below.

ACL for the shared directory

All of the information regarding ACL for the shared directory are stored in share_info.tdb. Maximum size of share_info.tdb is 64 Mbyte. CIFS service failure may be caused due to the disk space shortage if the size is more than 64 Mbyte. Size of share_info.tdb depends on "the number of CIFS share" and "total of the number of ACE for the shared directory of each share". For this reason, set "the number of CIFS share" and "total of the number of ACE for the shared directory of each share" so that the size of share_info.tdb does not exceed 64 Mbyte. The following is the example of setting.

You can see the size of share_info.tdb by collecting node log files and checking the share_info.tdb size shown below.

·         Cluster Model

(node 0)

/enassys/hifailsafe/CHN1/share_info.tdb

(node 1)

/enassys/hifailsafe/CHN5/share_info.tdb

·         Non-Cluster Model

/etc/cifs/CHN/CHN1/share_info.tdb

Deny setting of ACL

In versions earlier than 5.0.1-00, deny setting of ACL does not take priority as intended due to the problem that has been fixed with 5.0.1-00. The priority order of deny setting incorrectly may be higher caused by this problem. As a solution, set the ACL order again by the following resetting procedures after update installation.

To reset, perform one of the following operations.

·         Resetting procedure from Windows command.

7)      Run icacls command for the topmost directory (*1) of the resetting target file.

Record all of ACLs under the specified directories displayed.

8)      Make the setting from the topmost directory (*1) to all of subordinate directories/files by icacls command based on the ACLs recorded in (1).

Example)

o    ACL displayed in (1).

file-path userA:(OI)(CI)(W)

o    For the command of the setting in (2), change options according to the ACLs displayed in (1).

icacls file-path /grant userA:(OI)(CI)(W)

·         Resetting procedure from Windows Properties window.

9)      From the topmost directory (*1) of resetting target to all of subordinate directories/files, display ACLs by selecting [Properties], [Security], and then [Detailed setting] and record all ACLs.

10)   From the topmost directory (*1) to all subordinate directories/files, delete entries of deny access setting by selecting [Properties], [Security], [Detailed setting] and then [Change access permission], and then set the access permission in an arbitrary order based on the ACLs recorded in (1).

*1: The topmost directory means the following.

o    In case of setting recursively the ACL to the directory tree, it means the top of the directory of the tree.

o    In case of setting the ACL only to specific directory, it means the directory.

o    In case of setting the ACL only to specific file, it means the directory in which the file belongs.

NFS share creation

For a host that is allowed to access the NFS share, specify a host name that starts with an alphabet and consists of alphanumeric, hyphen (-) and underscore (_).

Outputting the system operation information

When operation information of the system is output to a directory on a file system by running sysinfoget command, if the directory name contains any multi-byte characters, extracting the archive file output by sysinfoget command may fail depending on the OS environment where the operation information is transferred.

To output operation information to a directory on the file system, output the information to a directory whose name does not contain multi-byte characters, or convert the character code of the archive file to the one that is used in the OS environment where the information is transferred by using an application for conversion.

Creating keytab file for Kerberos authentication

Do not use space, quotation mark ("), and colon (:) for a name of keytab file for Kerberos authentication.

The file system setting information display

If a failure occurs on a file system, the setting information of the file system may not be displayed correctly on single node GUI.
Restore the failure condition, perform refresh processing, and then refer the file system setting information.

ACL setting for the Authenticated Users and Network accounts

Access control by ACL setting for Authenticated Users and Network accounts which are Windows built-in accounts is not supported for Classic ACL type file system.
The function can be applied to Advanced ACL type file systems only.

The Window’s [Previous Versions] tab

When past versions are displayed on the [Previous Versions] tab, if available past versions are not displayed, close the tab, wait for a while, and then open the tab again.
The above phenomenon may occur when the [Previous Versions] tab is displayed while a migration operation is in process.

Filesystems

Do not mount filesystem as Read-Only.

Connecting Mac OSX 10.10/10.11 as CIFS client

The following notes applies when connecting Mac OSX 10.10 and 10.11 as a CIFS client because only SMB2.0 is supported.

11)   Specify SMB2.0 for SMB protocol that is used for accesses from the CIFS client on HDI.
For detailed settings, refer to "Hitachi Data Ingestor Cluster Administrator's Guide" or "Hitachi Data Ingestor Single Node Administrator's Guide".
On the setting of the client with Mac OSX 10.10/10.11, minor versions, such as SMB2.0/2.1, cannot be specified. In this case, make the setting on HDI.

12)   With Mac OSX 10.9 or earlier, only SMB1.0 is supported as a CIFS client. To have both versions; Mac OSX 10.9 or earlier and Mac OSX 10.10/10.11, as CIFS clients, confine the connecting SMB version for the client with Mac OSX 10.9 or earlier to 1.0 by the setting on each client.
For detailed settings, refer to "Hitachi Data Ingestor File System Protocols (CIFS/NFS) Administrator's Guide".
If the Mac OSX is upgraded from a version 10.9 or earlier to 10.10/10.11, apply the setting of (1) and then release the restriction of (2) (to confine the SMB version to 1.0).

13)   If any multi-byte characters are used for CIFS share name with Mac OSX 10.11, because of a matter of Mac client, connection from the Mac client to CIFS may be disabled.
Avoid the use of multi-byte characters for share names.

Connecting Mac OSX as CIFS client

Notes applied to Mac OSX regardless of version are as follows.

14)   Even when having write permission, an operation to write on a file may fail with Mac OSX depending on the behavior of application running on the Mac OSX.
For this, make sure to apply the settings below in advance when performing an operation with file update on Mac OSX.

a)       For users who operate or groups to which the users belong, set Full control permission for folders with extension of .TemporaryItems and all files and folders in the folders directly under a CIFS share.

b)      For users, set "Delete" permission for the operation target files or "Delete subfolders and files" permission for parent folders of the operation target files.

c)       Set access permission for the upper folder of operation target files for users who operate and groups to which the users belong so that the access permission can be inherited from the upper folder.

15)   While only the user who is operating a file has access permission for the file, if access permission for the file is set for a different user on "Sharing & Permissions" panel of Mac OSX Finder, all ACLs may be deleted.
To avoid the above, set access permission for the upper folder of the file for both users who operate and groups to which the users belong so that the access permission can be inherited from the upper folder.

16)   When writing on a read-only file from Mac OSX standard TextEdit, an error for having no permission is displayed and the writing may fail.
For users who release the read-only attribute of the file, add "Change Permissions" permission for the file.

SMB signing

If you use SMB signing for communication with a CIFS client, you can prevent man-in-the-middle attacks that tamper with SMB packets being transferred. Note, however, that the security improvements granted by SMB signing will also degrade file access performance.

Before you can use SMB signing, the necessary settings must be specified for both the client and the HDI system. The HDI system always uses SMB signing when the client requests SMB signing for communication via the SMB 2.0, SMB 2.1, or SMB 3.0 protocol. In addition, you can use the cifsoptset command to specify whether to use SMB signing for SMB 1.0 communication. With the initial settings, the HDI system does not use SMB signing for SMB 1.0 communication.

Selecting time zone

If you choose a time zone where daylight-saving time is introduced or abolished in 2009 or later, time on HDI may differ from current local time.
To use such a time zone, use Greenwich Mean Time (GMT).

Using offline files with Guest account

When CIFS Client that HDI treats as a guest account accesses a file in the offline state, it may not be accessible.
When referring to a file in the offline state, do not perform CIFS access with the guest account.
As for the guest account, see the Hitachi Data Ingestor Cluster Administrator's Guide or the Hitachi Data Ingestor Single Node Administrator's Guide.

WWW browser security setting

On the security setting in the Advanced tab on WWW browser connected to HDI or management server, clear check boxes for Use SSL2.0 and Use SSL3.0.