Isilon OneFS. Version Administration Guide

Transcription

1 Isilon OneFS Version Administration Gide

2 Pblished December, 2012 Copyright EMC Corporation. All rights reserved. EMC believes the information in this pblication is accrate as of its pblication date. The information is sbject to change withot notice. The information in this pblication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this pblication, and specifically disclaims implied warranties of merchantability or fitness for a particlar prpose. Use, copying, and distribtion of any EMC software described in this pblication reqires an applicable software license. EMC², EMC, and the EMC logo are registered trademarks or trademarks of EMC Corporation in the United States and other contries. All other trademarks sed herein are the property of their respective owners. For the most p-to-date prodct docmentation, go to the Isilon Cstomer Spport Center. EMC Corporation Hopkinton, Massachsetts In North America OneFS Administration Gide

3 CONTENTS Chapter 1 Introdction to Isilon scale-ot NAS 15 Architectre...16 Isilon Node...16 Internal and external networks...17 Isilon clster...17 Clster administration...17 Qorm...17 Splitting and merging...18 Storage pools...18 IP address pools...19 The OneFS operating system...19 Data-access protocols...19 Identity management and access control...20 Strctre of the file system...21 Data layot...21 Writing files...21 Reading files...22 Metadata layot...22 Locks and concrrency...22 Striping...22 Data protection overview...23 N+M data protection...24 Data mirroring...24 The file system jornal...25 Virtal hot spare...25 Balancing protection with storage space...25 VMware integration...25 The iscsi option...25 Software modles...26 Chapter 2 Athentication and access control 27 Data access control...29 ACLs...29 UNIX permissions...30 Mixed-permission environments...30 Roles and privileges...31 Bilt-in roles...31 OneFS privileges...32 Athentication...34 Local provider...34 File provider...34 Active Directory...35 LDAP...35 NIS...35 Athentication provider featres...36 Identity management...36 Identity types...36 Access tokens...37 ID mapping...38 OneFS Administration Gide 3

4 CONTENTS On-disk identity selection...39 User mapping across identities...40 Configring ser mapping...40 Well-known secrity identifiers...41 Access zones...41 Home directories...42 Home directory creation throgh SMB...42 Home directory creation throgh SSH and FTP...42 Home directory creation in a mixed environment...43 Defalt home directory settings in athentication providers...44 Spported expansion variables...44 Managing access permissions...45 Configre access management settings...45 Modify ACL policy settings...46 Update clster permissions...52 Managing roles...53 View roles...53 Create a cstom role...53 Modify a role...53 Delete a cstom role...54 Create a local ser...54 Create a local grop...55 Managing sers and grops...56 Modify a local ser...56 Modify a local grop...56 Delete a local ser...56 Delete a local grop...57 Creating file providers...57 Create a file provider...57 Generate a password file...58 Managing file providers...58 Modify a file provider...58 Delete a file provider...58 Password file format...59 Grop file format...59 Netgrop file format...60 Create an Active Directory provider...60 Managing Active Directory providers...61 Modify an Active Directory provider...61 Delete an Active Directory provider...61 Configre Kerberos settings...61 Active Directory provider settings...62 Create an LDAP provider...63 Managing LDAP providers...66 Modify an LDAP provider...66 Delete an LDAP provider...66 Create a NIS provider...66 Managing NIS providers...67 Modify a NIS provider...67 Delete a NIS provider...67 Create an access zone...68 Managing access zones...69 Modify an access zone...69 Associate an IP address pool with an access zone...69 Delete an access zone OneFS Administration Gide

5 CONTENTS Chapter 3 File sharing 71 NFS...72 SMB...72 HTTP...72 FTP...73 Mixed protocol environments...73 Write caching with SmartCache...73 Write caching for asynchronos writes...74 Write caching for synchronos writes...74 Create an NFS export...75 Create an SMB share...75 Configre NFS file sharing...76 Disable NFS file sharing...77 NFS service settings...77 NFS export behavior settings...78 NFS performance settings...78 NFS client compatibility settings...80 Configre SMB file sharing...80 Disable SMB file sharing...81 File and directory permission settings...81 Snapshots settings directory...82 SMB performance settings...82 SMB secrity settings...83 Configre and enable HTTP file sharing...83 Configre and enable FTP file sharing...84 Managing NFS exports...84 Modify an NFS export...85 Delete an NFS export...85 View and configre defalt NFS export settings...85 Managing SMB shares...86 Add a ser or grop to an SMB share...86 Modify an SMB share...86 Configre mlti-protocol home directory access...87 Delete an SMB share...87 Chapter 4 Snapshots 89 Data protection with SnapshotIQ...90 Snapshot disk-space sage...90 Snapshot schedles...91 Snapshot aliases...91 File and directory restoration...91 File clones...91 File clones considerations...92 iscsi LUN clones...93 Snapshot locks...93 Snapshot reserve...93 SnapshotIQ license fnctionality...93 Creating snapshots with SnapshotIQ...94 Create a SnapRevert domain...94 Create a snapshot...95 Create a snapshot schedle...95 Snapshot naming patterns...96 Managing snapshots...99 Redcing snapshot disk-space sage...99 OneFS Administration Gide 5

6 CONTENTS Delete snapshots Modify a snapshot Modify a snapshot alias View snapshots Snapshot information Restoring snapshot data Revert a snapshot Restore a file or directory sing Windows Explorer Restore a file or directory throgh a UNIX command line Clone a file from a snapshot Managing snapshot schedles Modify a snapshot schedle Delete a snapshot schedle View snapshot schedles Managing with snapshot locks Create a snapshot lock Modify a snapshot lock Delete a snapshot lock Snapshot lock information Configre SnapshotIQ settings SnapshotIQ settings Set the snapshot reserve Chapter 5 Data replication with SyncIQ 109 Replication policies and jobs Sorce and target clster association Fll and differential replication Controlling replication job resorce consmption Replication reports Replication snapshots Sorce clster snapshots Target clster snapshots Data failover and failback with SyncIQ Data failover Data failback Recovery times and objectives for SyncIQ SyncIQ license fnctionality Creating replication policies Exclding directories in replication Exclding files in replication File criteria options Configre defalt replication policy settings Create a replication policy Create a SyncIQ domain Assess a replication policy Managing replication to remote clsters Start a replication job Pase a replication job Resme a replication job Cancel a replication job View active replication jobs View replication performance information Replication job information Initiating data failover and failback with SyncIQ Fail over data to a secondary clster OneFS Administration Gide

7 CONTENTS Fail over SmartLock directories Failover revert Fail back data to a primary clster Prepare SmartLock directories for failback Fail back SmartLock directories Managing replication policies Modify a replication policy Delete a replication policy Enable or disable a replication policy View replication policies Replication policy information Replication policy settings Managing replication to the local clster Cancel replication to the local clster Break local target association View replication jobs targeting the local clster Remote replication policy information Managing replication performance rles Create a network traffic rle Create a file operations rle Modify a performance rle Delete a performance rle Enable or disable a performance rle View performance rles Managing replication reports Configre defalt replication report settings Delete replication reports View replication reports Replication report information Managing failed replication jobs Resolve a replication policy Reset a replication policy Perform a fll or differential replication Chapter 6 Data layot with FlexProtect 141 File striping Data protection levels FlexProtect data recovery Smartfail Node failres Managing protection levels Data protection level information Data protection level disk space sage Chapter 7 NDMP backp 147 NDMP two way backp NDMP protocol spport Spported DMAs NDMP hardware spport NDMP backp limitations NDMP performance recommendations Exclding files and directories from NDMP backps Configring basic NDMP backp settings Configre and enable NDMP backp OneFS Administration Gide 7

8 CONTENTS Disable NDMP backp View NDMP backp settings NDMP backp settings Create an NDMP ser accont Managing NDMP ser acconts Modify the password of an NDMP ser accont Delete an NDMP ser accont View NDMP ser acconts Managing NDMP backp devices Detect NDMP backp devices Modify an NDMP backp device name Delete a device entry for a disconnected NDMP backp device View NDMP backp devices NDMP backp device settings Managing NDMP backp ports Modify NDMP backp port settings Enable or disable an NDMP backp port View NDMP backp ports NDMP backp port settings Managing NDMP backp sessions Terminate an NDMP session View NDMP sessions NDMP session information View NDMP backp logs NDMP environment variables Chapter 8 File retention with SmartLock 163 SmartLock operation modes Enterprise mode Compliance mode Replication and backp with SmartLock Data replication in compliance mode Data replication and backp in enterprise mode SmartLock license fnctionality SmartLock considerations Set the compliance clock View the compliance clock Creating a SmartLock directory Retention periods Atocommit time periods Create a SmartLock directory Managing SmartLock directories Modify a SmartLock directory View SmartLock directory settings SmartLock directory configration settings Managing files in SmartLock directories Set a retention period throgh a UNIX command line Set a retention period throgh Windows Powershell Commit a file to a WORM state throgh a UNIX command line Commit a file to a WORM state throgh Windows Explorer Override the retention period for all files in a SmartLock directory Delete a file committed to a WORM state View WORM stats of a file OneFS Administration Gide

9 CONTENTS Chapter 9 Protection domains 175 Protection domain considerations Create a protection domain Delete a protection domain View protection domains Protection domain types Chapter 10 Clster administration 179 User interfaces Web administration interface Command-line interface Node front panel OneFS Platform API Connecting to the clster Log in to the web administration interface Open an SSH connection to a clster Restart or sht down the clster Licensing Activating licenses Activate a license throgh the web administration interface Activate a license throgh the command-line interface View license information Unconfigring licenses Unconfigre a license General clster settings Configring the clster date and time Set the clster date and time Specify an NTP time server Set the clster name Specify contact information View SNMP settings Configre SMTP settings Configring SpportIQ Enable and configre SpportIQ Disable SpportIQ Enable or disable access time tracking Specify the clster join mode Specify the clster character encoding Clster statistics Performance monitoring Clster monitoring Monitor the clster View node stats Events and notifications Monitoring clster hardware View node hardware stats SNMP monitoring Clster maintenance Replacing node components Upgrading node components Managing clster nodes Remote spport sing SpportIQ SpportIQ scripts Upgrading OneFS OneFS Administration Gide 9

10 CONTENTS Clster join modes Event notification settings System job management Job engine overview Job performance impact Job impact policies Job priorities Managing system jobs Monitoring system jobs Creating impact policies Managing impact policies Chapter 11 SmartQotas 217 Qotas overview Qota types Usage acconting and limits Disk-sage calclations Qota notifications Qota notification rles Qota reports Creating qotas Create an acconting qota Create an enforcement qota Managing qotas Search for qotas Manage qotas Export a qota configration file Import a qota configration file Managing qota notifications Configre defalt qota notification settings Configre cstom qota notification rles Map an notification rle for a qota Configre a cstom qota notification template Managing qota reports Create a qota report schedle Generate a qota report Locate a qota report Basic qota settings Advisory limit qota notification rles settings Soft limit qota notification rles settings Hard limit qota notification rles settings Limit notification settings Qota report settings Cstom notification template variable descriptions Chapter 12 Storage pools 239 Storage pool overview Atoprovisioning Virtal hot spare and SmartPools Spillover and SmartPools Node pools Add or move node pools in a tier Change the name or protection level of a node pool SSD pools OneFS Administration Gide

11 CONTENTS File pools with SmartPools Tiers Create a tier Rename a tier Delete a tier File pool policies Pool monitoring Monitor node pools and tiers View nhealthy sbpools Creating file pool policies with SmartPools Managing file pool policies Configre defalt file pool policy settings Configre defalt file pool protection settings Configre defalt I/O optimization settings Modify a file pool policy Copy a file pool policy Prioritize a file pool policy Use a file pool template policy Delete a file pool policy SmartPools settings Defalt file pool protection settings Defalt file pool I/IO optimization settings Chapter 13 Networking 255 Clster internal network overview Internal IP address ranges Clster internal network failover External client network overview External network settings IP address pools Connection balancing with SmartConnect External IP failover NIC aggregation VLANs DNS name resoltion IPv6 spport Configring the internal clster network Modify the internal IP address range Modify the internal network netmask Configre and enable an internal failover network Disable internal network failover Configring an external network Adding a sbnet Managing external client sbnets Managing IP address pools Managing IP address pool interface members Configre DNS settings Managing external client connections with SmartConnect Configre client connection balancing Client connection settings Managing network interface provisioning rles Create a node provisioning rle Modify a node provisioning rle Delete a node provisioning rle OneFS Administration Gide 11

12 CONTENTS Chapter 14 Hadoop 281 Hadoop spport overview Hadoop clster integration Managing HDFS Configre the HDFS protocol Create a local ser Enable or disable the HDFS service Chapter 15 Antivirs 285 On-access scanning Antivirs policy scanning Individal file scanning Antivirs scan reports ICAP servers Spported ICAP servers Anitvirs threat responses Configring global antivirs settings Exclde files from antivirs scans Configre on-access scanning settings Configre antivirs threat response settings Configre antivirs report retention settings Enable or disable antivirs scanning Managing ICAP servers Add and connect to an ICAP server Test an ICAP server connection Modify ICAP connection settings Temporarily disconnect from an ICAP server Reconnect to an ICAP server Remove an ICAP server Create an antivirs policy Managing antivirs policies Modify an antivirs policy Delete an antivirs policy Enable or disable an antivirs policy View antivirs policies Managing antivirs scans Scan a file Manally rn an antivirs policy Stop a rnning antivirs scan Managing antivirs threats Manally qarantine a file Rescan a file Remove a file from qarantine Manally trncate a file View threats Antivirs threat information Managing antivirs reports Export an antivirs report View antivirs reports View antivirs events Chapter 16 iscsi 297 iscsi targets and LUNs OneFS Administration Gide

13 CONTENTS Using SmartConnect with iscsi targets isns client service Access control for iscsi targets CHAP athentication Initiator access control iscsi considerations and limitations Spported SCSI mode pages Spported iscsi initiators Configring the iscsi and isns services Configre the iscsi service Configre the isns client service View iscsi sessions and throghpt Create an iscsi target Managing iscsi targets Modify iscsi target settings Delete an iscsi target View iscsi target settings Configring iscsi initiator access control Configre iscsi initiator access control Control initiator access to a target Modify initiator name Remove an initiator from the access list Create a CHAP secret Modify a CHAP secret Delete a CHAP secret Enable or disable CHAP athentication Creating iscsi LUNs Create an iscsi LUN Clone an iscsi LUN Managing iscsi LUNs Modify an iscsi LUN Delete an iscsi LUN Migrate an iscsi LUN to another target Import an iscsi LUN View iscsi LUN settings Chapter 17 VMware integration 315 VASA Isilon VASA alarms VASA storage capabilities VAAI VAAI spport for block storage VAAI spport for NAS Configring VASA spport Enable VASA Download the Isilon vendor provider certificate Add the Isilon vendor provider Disable or re-enable VASA Chapter 18 File System Explorer 319 Browse the file system Create a directory Modify file and directory properties View file and directory properties OneFS Administration Gide 13

14 CONTENTS File and directory properties OneFS Administration Gide

15 CHAPTER 1 Introdction to Isilon scale-ot NAS The EMC Isilon scale-ot NAS storage platform combines modlar hardware with nified software to harness nstrctred data. Powered by the distribted OneFS operating system, an EMC Isilon clster delivers a scalable pool of storage with a global namespace. The platform's nified software provides centralized web-based and command-line administration to manage the following featres: A symmetrical clster that rns a distribted file system Scale-ot nodes that add capacity and performance Storage options that manage files, block data, and tiering Flexible data protection and high availability Software modles that control costs and optimize resorces Architectre...16 Isilon Node...16 Internal and external networks...17 Isilon clster...17 The OneFS operating system...19 Strctre of the file system...21 Data protection overview...23 VMware integration...25 The iscsi option...25 Software modles...26 Introdction to Isilon scale-ot NAS 15

16 Introdction to Isilon scale-ot NAS Architectre Isilon Node OneFS combines the three traditional layers of storage architectre file system, volme manager, and data protection into a scale-ot NAS clster. In contrast to a scale-p approach, EMC Isilon takes a scale-ot approach by creating a clster of nodes that rns a distribted file system. Each node adds resorces to the clster. Becase each node contains globally coherent RAM, as a clster becomes larger, it becomes faster. Meanwhile, the file system expands dynamically and redistribtes content, which eliminates the work of partitioning disks and creating volmes. Nodes work as peers to spread data across the clster. Segmenting and distribting data a process known as striping not only protects data, bt also enables a ser connecting to any node to take advantage of the entire clster's performance. The se of distribted software to scale data across commodity hardware sets OneFS apart from other storage systems. No master device controls the clster; no slaves invoke dependencies. Instead, each node helps control data reqests, boosts performance, and expands the clster's capacity. As a rack-montable appliance, a node incldes the following components in a 2U or 4U rack-montable chassis with an LCD front panel: memory, CPUs, RAM, NVRAM, network interfaces, InfiniBand adapters, disk controllers, and storage media. An Isilon clster comprises three or more nodes, p to 144. When yo add a node to a clster, yo increase the clster's aggregate disk, cache, CPU, RAM, and network capacity. OneFS grops RAM into a single coherent cache so that a data reqest on a node benefits from data that is cached anywhere. NVRAM is groped to write data with high throghpt and to protect write operations from power failres. As the clster expands, spindles and CPU combine to increase throghpt, capacity, and inpt-otpt operations per second (IOPS). EMC Isilon makes several types of nodes, all of which can be added to a clster to balance capacity and performance with throghpt or IOPS: Node Use Case - - S-Series IOPS-intensive applications X-Series NL-Series High-concrrency and throghpt-driven workflows Near-primary accessibility, with near-tape vale The following EMC Isilon nodes improve performance: Node Fnction - - Performance Accelerator Independent scaling for high performance Backp Accelerator High-speed and scalable backp-and-restore soltion 16 OneFS Administration Gide

17 Introdction to Isilon scale-ot NAS Internal and external networks Isilon clster Clster administration A clster incldes two networks: an internal network to exchange data between nodes and an external network to handle client connections. Nodes exchange data throgh the internal network with a proprietary, nicast protocol over InfiniBand. Each node incldes redndant InfiniBand ports so yo can add a second internal network in case the first one fails. Clients reach the clster with 1 GigE or 10 GigE Ethernet. Since every node incldes Ethernet ports, the clster's bandwidth scales with performance and capacity as yo add nodes. An Isilon clster consists of three or more hardware nodes, p to 144. Each node rns the Isilon OneFS operating system, the distribted file-system software that nites the nodes into a clster. A clster s storage capacity ranges from a minimm of 18 TB to a maximm of 15.5 PB. OneFS centralizes clster management throgh a web administration interface and a command-line interface. Both interfaces provide methods to activate licenses, check the stats of nodes, configre the clster, pgrade the system, generate alerts, view client connections, track performance, and change varios settings. In addition, OneFS simplifies administration by atomating maintenance with a job engine. Yo can schedle jobs that scan for virses, inspect disks for errors, reclaim disk space, and check the integrity of the file system. The engine manages the jobs to minimize impact on the clster's performance. With SNMP versions 1, 2c, and 3, yo can remotely monitor hardware components, CPU sage, switches, and network interfaces. EMC Isilon spplies management information bases (MIBs) and traps for the OneFS operating system. OneFS also incldes a RESTfl application programming interface known as the Platform API to atomate access, configration, and monitoring. For example, yo can retrieve performance statistics, provision sers, and tap the file system. The Platform API integrates with OneFS role-based access control to increase secrity. See the Isilon Platform API Reference. Qorm An Isilon clster mst have a qorm to work properly. A qorm prevents data conflicts for example, conflicting versions of the same file in case two grops of nodes become nsynchronized. If a clster loses its qorm for read and write reqests, yo cannot access the OneFS file system. For a qorm, more than half the nodes mst be available over the internal network. A seven-node clster, for example, reqires a for-node qorm. A 10-node clster reqires a six-node qorm. If a node is nreachable over the internal network, OneFS separates the node from the clster, an action referred to as splitting. When the split node can reconnect with the clster and resynchronize with the other nodes, the node rejoins the clster's majority grop, an action referred to as merging. Althogh a clster can contain only one majority grop, nodes that split from the majority side can form mltiple grops. A OneFS clster contains two qorm properties: Internal and external networks 17

18 Introdction to Isilon scale-ot NAS Splitting and merging Storage pools 18 OneFS Administration Gide read qorm (efs.gmp.has_qorm) write qorm (efs.gmp.has_sper_block_qorm) By connecting to a node with SSH and rnning the sysctl command-line tool as root, yo can view the stats of both types of qorm. Here is an example for a clster that has a qorm for both read and write operations, as the command's otpt indicates with a 1, for tre: sysctl efs.gmp.has_qorm efs.gmp.has_qorm: 1 sysctl efs.gmp.has_sper_block_qorm efs.gmp.has_sper_block_qorm: 1 The degraded states of nodes sch as smartfail, read-only, offline, and so on affect qorm in different ways. A node in a smartfail or read-only state affects only write qorm. A node in an offline state, however, affects both read and write qorm. In a clster, the combination of nodes in different degraded states determines whether read reqests, write reqests, or both work. A clster can lose write qorm bt keep read qorm. Consider a for-node clster in which nodes 1 and 2 are working normally. Node 3 is in a read-only state, and node 4 is in a smartfail state. In sch a case, read reqests to the clster scceed. Write reqests, however, receive an inpt-otpt error becase the states of nodes 3 and 4 break the write qorm. A clster can also lose both its read and write qorm. If nodes 3 and 4 in a for-node clster are in an offline state, both write reqests and read reqests receive an inptotpt error, and yo cannot access the file system. When OneFS can reconnect with the nodes, OneFS merges them back into the clster. Unlike a RAID system, an Isilon node can rejoin the clster withot being rebilt and reconfigred. Splitting and merging optimize the se of nodes withot yor intervention. OneFS monitors every node in a clster. If a node is nreachable over the internal network, OneFS separates the node from the clster, an action referred to as splitting. When the clster can reconnect to the node, OneFS adds the node back into the clster, an action referred to as merging. If a clster splits dring a write operation, OneFS might need to re-allocate blocks for the file on the side with the qorm, which leads allocated blocks on the side withot a qorm to become orphans. When the split nodes reconnect with the clster, the OneFS Collect system job reclaims the orphaned blocks. Meanwhile, as nodes split and merge with the clster, the OneFS AtoBalance job redistribtes data evenly among the nodes in the clster, optimizing protection and conserving space. Storage pools segment nodes and files into logical divisions to simplify the management and storage of data. A storage pool comprises node pools and tiers. Node pools grop eqivalent nodes to protect data and ensre reliability. Tiers combine node pools to optimize storage by need, sch as a freqently sed high-speed tier or a rarely accessed archive. The SmartPools modle grops nodes and files into pools. By defalt, the basic nlicensed technology provisions node pools and creates one file pool. When yo license the SmartPools modle, yo receive more featres. Yo can, for example, create mltiple file pools and govern them with policies. The policies move files, directories, and file

19 Introdction to Isilon scale-ot NAS IP address pools pools among node pools or tiers. Yo can also define how OneFS handles write operations when a node pool or tier is fll. A virtal hot spare, which reserves space to reprotect data if a drive fails, comes with both the licensed and nlicensed technology. Within a sbnet, yo can partition a clster's external network interfaces into pools of IP address ranges. The pools empower yo to cstomize yor storage network to serve different grops of sers. Althogh yo mst initially configre the defalt external IP sbnet in IPv4 format, yo can configre additional sbnets in IPv4 or IPv6. Yo can associate IP address pools with a node, a grop of nodes, or NIC ports. For example, yo can set p one sbnet for storage nodes and another sbnet for accelerator nodes. Similarly, yo can allocate ranges of IP addresses on a sbnet to different teams, sch as engineering and sales. Sch options help yo create a storage topology that matches the demands of yor network. In addition, network provisioning rles streamline the setp of external connections. After yo configre the rles with network settings, yo can apply the settings to new nodes. As a standard featre, the OneFS SmartConnect modle balances connections among nodes by sing a rond-robin policy with static IP addresses and one IP address pool for each sbnet. The licensed version of SmartConnect adds featres, sch as defining IP address pools to spport mltiple DNS zones. The OneFS operating system Data-access protocols A distribted operating system based on FreeBSD, OneFS presents an Isilon clster's file system as a single share or export with a central point of administration. The OneFS operating system does the following: Spports common data-access protocols, sch as SMB and NFS. Connects to mltiple identity management systems, sch as Active Directory and LDAP. Athenticates sers and grops. Controls access to directories and files. With the OneFS operating system, yo can access data with mltiple file-sharing and transfer protocols. As a reslt, Microsoft Windows, UNIX, Linx, and Mac OS X clients can share the same directories and files. OneFS spports the following protocols. Protocol Description - - SMB Server Message Block gives Windows sers access to the clster. OneFS works with SMB 1, SMB 2, and SMB 2.1. With SMB 2.1, OneFS spports client opportnity locks (oplocks) and large (1 MB) MTU sizes. The defalt file share is /ifs. NFS The Network File System enables UNIX, Linx, and Mac OS X systems to remotely mont any IP address pools 19

20 Introdction to Isilon scale-ot NAS Protocol Description - - sbdirectory, inclding sbdirectories created by Windows sers. OneFS works with versions 2 throgh 4 of the Network File System protocol (NFSv2, NFSv3, NFSv4). The defalt export is / ifs. FTP iscsi HDFS HTTP File Transfer Protocol lets systems with an FTP client connect to the clster to exchange files. The Internet Small Compter System Interface protocol provides access to block storage. The Hadoop Distribted File System protocol makes it possible for a clster to work with Apache Hadoop, a framework for data-intensive distribted applications. HDFS integration reqires a separate license. Hyper Text Transfer protocol gives systems browser-based access to resorces. OneFS incldes limited spport for WebDAV. Identity management and access control OneFS works with mltiple identity management systems to athenticate sers and control access to files. In addition, OneFS featres access zones that allow sers from different directory services to access different resorces based on their IP address. Rolebased access control, meanwhile, segments administrative access by role. OneFS athenticates sers with the following identity management systems: Microsoft Active Directory (AD) Lightweight Directory Access Protocol (LDAP) Network Information Service (NIS) Local sers and local grops A file provider for acconts in /etc/spwd.db and /etc/grop files. With the file provider, yo can add an athoritative third-party sorce of ser and grop information. Yo can manage sers with different identity management systems; OneFS maps the acconts so that Windows and UNIX identities can coexist. A Windows ser accont managed in Active Directory, for example, is mapped to a corresponding UNIX accont in NIS or LDAP. To control access, an Isilon clster works with both the access control lists (ACLs) of Windows systems and the POSIX mode bits of UNIX systems. When OneFS mst transform a file's permissions from ACLs to mode bits or from mode bits to ACLs, OneFS merges the permissions to maintain consistent secrity settings. OneFS presents protocol-specific views of permissions so that NFS exports display mode bits and SMB shares show ACLs. Yo can, however, manage not only mode bits bt also ACLs with standard UNIX tools, sch as the chmod and chown commands. In addition, ACL policies enable yo to configre how OneFS manages permissions for networks that mix Windows and UNIX systems. 20 OneFS Administration Gide

21 Introdction to Isilon scale-ot NAS Strctre of the file system Access zones OneFS incldes an access zones featre. Access zones allow sers from different athentication providers, sch as two ntrsted Active Directory domains, to access different OneFS resorces based on an incoming IP address. An access zone can contain mltiple athentication providers and SMB namespaces. RBAC for administration OneFS incldes role-based access control (RBAC) for administration. In place of a root or administrator accont, RBAC lets yo manage administrative access by role. A role limits privileges to an area of administration. For example, yo can create separate administrator roles for secrity, aditing, storage, and backp. OneFS presents all the nodes in a clster as a global namespace that is, as the defalt file share, /ifs. In the file system, directories are inode nmber links. An inode contains file metadata and an inode nmber, which identifies a file's location. OneFS dynamically allocates inodes, and there is no limit on the nmber of inodes. To distribte data among nodes, OneFS sends messages with a globally rotable block address throgh the clster's internal network. The block address identifies the node and the drive storing the block of data. Data layot Writing files OneFS evenly distribtes data among a clster's nodes with layot algorithms that maximize storage efficiency and performance. The system continosly reallocates data to conserve space. OneFS breaks data down into smaller sections called blocks, and then the system places the blocks in a stripe nit. By referencing either file data or erasre codes, a stripe nit helps safegard a file from a hardware failre. The size of a stripe nit depends on the file size, the nmber of nodes, and the protection setting. After OneFS divides the data into stripe nits, OneFS allocates, or stripes, the stripe nits across nodes in the clster. When a client connects to a node, the client's read and write operations take place on mltiple nodes. For example, when a client connects to a node and reqests a file, the node retrieves the data from mltiple nodes and rebilds the file. Yo can optimize how OneFS lays ot data to match yor dominant access pattern concrrent, streaming, or random. On a node, the inpt-otpt operations of the OneFS software stack split into two fnctional layers: A top layer, or initiator, and a bottom layer, or participant. In read and write operations, the initiator and the participant play different roles. When a client writes a file to a node, the initiator on the node manages the layot of the file on the clster. First, the initiator divides the file into blocks of 8 KB each. Second, the initiator places the blocks in one or more stripe nits. At 128 KB, a stripe nit consists of 16 blocks. Third, the initiator spreads the stripe nits across the clster ntil they span a width of the clster, creating a stripe. The width of the stripe depends on the nmber of nodes and the protection setting. After dividing a file into stripe nits, the initiator writes the data first to non-volatile random-access memory (NVRAM) and then to disk. NVRAM retains the information when the power is off. Dring the write transaction, NVRAM gards against failed nodes with jornaling. If a node fails mid-transaction, the transaction restarts withot the failed node. When the Strctre of the file system 21

22 Introdction to Isilon scale-ot NAS node retrns, it replays the jornal from NVRAM to finish the transaction. The node also rns the AtoBalance job to check the file's on-disk striping. Meanwhile, ncommitted writes waiting in the cache are protected with mirroring. As a reslt, OneFS eliminates mltiple points of failre. Reading files Metadata layot In a read operation, a node acts as a manager to gather data from the other nodes and present it to the reqesting client. Becase an Isilon clster's coherent cache spans all the nodes, OneFS can store different data in each node's RAM. By sing the internal InfiniBand network, a node can retrieve file data from another node's cache faster than from its own local disk. If a read operation reqests data that is cached on any node, OneFS plls the cached data to serve it qickly. In addition, for files with an access pattern of concrrent or streaming, OneFS pre-fetches in-demand data into a managing node's local cache to frther improve seqential-read performance. OneFS protects metadata by spreading it across nodes and drives. Metadata which incldes information abot where a file is stored, how it is protected, and who can access it is stored in inodes and protected with locks in a B+ tree, a standard strctre for organizing data blocks in a file system to provide instant lookps. Meanwhile, OneFS replicates a file's metadata at least to the protection level of the file. Working together as peers, all the nodes help manage metadata access and locking. If a node detects an error in metadata, the node looks p the metadata in an alternate location and then corrects the error. Locks and concrrency OneFS incldes a distribted lock manager that orchestrates locks on data across all the nodes in a clster. The lock manager grants locks for the file system, byte ranges, and protocols, inclding SMB share-mode locks and NFS advisory locks. OneFS also spports SMB opportnistic locks and NFSv4 delegations. Becase OneFS distribtes the lock manager across all the nodes, any node can act as a lock coordinator. When a thread from a node reqests a lock, the lock manager's hashing algorithm typically assigns the coordinator role to a different node. The coordinator allocates a shared lock or an exclsive lock, depending on the type of reqest. A shared lock allows sers to share a file simltaneosly, typically for read operations. An exclsive lock allows only one ser to access a file, typically for write operations. Striping In a process known as striping, OneFS segments files into nits of data and then distribtes the nits across nodes in a clster. Striping protects yor data and improves clster performance. To distribte a file, OneFS redces it to blocks of data, arranges the blocks into stripe nits, and then allocates the stripe nits to nodes over the internal network. 22 OneFS Administration Gide

23 Introdction to Isilon scale-ot NAS At the same time, OneFS distribtes erasre codes that protect the file. The erasre codes encode the file's data in a distribted set of symbols, adding space-efficient redndancy. With only a part of the symbol set, OneFS can recover the original file data. Taken together, the data and its redndancy form a protection grop for a region of file data. OneFS places the protection grops on different drives on different nodes creating data stripes. Becase OneFS stripes data across nodes that work together as peers, a ser connecting to any node can take advantage of the entire clster's performance. By defalt, OneFS optimizes striping for concrrent access. If yor dominant access pattern is streaming--that is, lower concrrency, higher single-stream workloads, sch as with video--yo can change how OneFS lays ot data to increase seqential-read performance. To better handle streaming access, OneFS stripes data across more drives. Streaming is most effective on clsters or sbpools serving large files. Data protection overview An Isilon clster is designed to serve data even when components fail. By defalt, OneFS protects data with erasre codes, enabling yo to retrieve files when a node or disk fails. As an alternative to erasre codes, yo can protect data with two to eight mirrors. When yo create a clster with five or more nodes, erasre codes deliver as mch as 80 percent efficiency. On larger clsters, erasre codes provide as mch as for levels of redndancy. OneFS applies data protection at the level of the file, not the block. Yo can, however, set different protection levels on directories, files, file pools, sbpools, and the clster. Althogh a file inherits the protection level of its parent directory by defalt, yo can change the protection level at any time. OneFS protects metadata and inodes at the same protection level as their data. A system job called FlexProtect detects and repairs degraded files. In addition to erasre codes and mirroring, OneFS incldes the following featres to help protect the integrity, availability, and confidentiality of data: Featre Description - - Antivirs OneFS can send files to servers rnning the Internet Content Adaptation Protocol (ICAP) to scan for virses and other threats. Clones NDMP backp and restore Protection domains OneFS enables yo to create clones that share blocks with other files to save space. OneFS can back p data to tape and other devices throgh the Network Data Management Protocol. Althogh OneFS spports both NDMP 3-way and 2-way backp, 2-way backp reqires an Isilon Backp Accelerator node. Yo can apply protection domains to files and directories to prevent changes. The following software modles also help protect data, bt they reqire a separate license: Data protection overview 23

24 Introdction to Isilon scale-ot NAS Licensed Featre Description - - SyncIQ SyncIQ replicates data on another Isilon clster and atomates failover and failback operations between clsters. If a clster becomes nsable, yo can fail over to another Isilon clster. SnapshotIQ SmartLock Yo can protect data with a snapshot a logical copy of data stored on a clster. The SmartLock tool prevents sers from modifying and deleting files. With a SmartLock license, yo can commit files to a write-once, read-many state: The file can never be modified and cannot be deleted ntil after a set retention period. SmartLock can help yo comply with Secrities and Exchange Commission Rle 17a-4. N+M data protection OneFS spports N+M erasre code levels of N+1, N+2, N+3, and N+4. In the N+M data model, N represents the nmber of nodes, and M represents the nmber of simltaneos failres of nodes or drives that the clster can handle withot losing data. For example, with N+2 the clster can lose two drives on different nodes or lose two nodes. To protect drives and nodes separately, OneFS also spports N+M:B. In the N+M:B notation, M is the nmber of disk failres, and B is the nmber of node failres. With N +3:1 protection, for example, the clster can lose three drives or one node withot losing data. The defalt protection level for clsters larger than 18 TB is N+2:1. The defalt for clsters smaller than 18 TB is N+1. The qorm rle dictates the nmber of nodes reqired to spport a protection level. For example, N+3 reqires at least seven nodes so yo can maintain a qorm if three nodes fail. Yo can, however, set a protection level that is higher than the clster can spport. In a for-node clster, for example, yo can set the protection level at 5x. OneFS protects the data at 4x ntil a fifth node is added, after which OneFS atomatically reprotects the data at 5x. Data mirroring Yo can protect on-disk data with mirroring, which copies data to mltiple locations. OneFS spports two to eight mirrors. Yo can se mirroring instead of erasre codes, or yo can combine erasre codes with mirroring. Mirroring, however, consmes more space than erasre codes. Mirroring data three times, for example, dplicates the data three times, which reqires more space than erasre codes. As a reslt, mirroring sits transactions that reqire high performance, sch as with iscsi LUNs. 24 OneFS Administration Gide

25 Introdction to Isilon scale-ot NAS The file system jornal Yo can also mix erasre codes with mirroring. Dring a write operation, OneFS divides data into redndant protection grops. For files protected by erasre codes, a protection grop consists of data blocks and their erasre codes. For mirrored files, a protection grop contains all the mirrors of a set of blocks. OneFS can switch the type of protection grop as it writes a file to disk. By changing the protection grop dynamically, OneFS can contine writing data despite a node failre that prevents the clster from applying erasre codes. After the node is restored, OneFS atomatically converts the mirrored protection grops to erasre codes. A jornal, which records file-system changes in a battery-backed NVRAM card, recovers the file system after failres, sch as a power loss. When a node restarts, the jornal replays file transactions to restore the file system. Virtal hot spare When a drive fails, OneFS ses space reserved in a sbpool instead of a hot spare drive. The reserved space is known as a virtal hot spare. In contrast to a spare drive, a virtal hot spare atomatically resolves drive failres and contines writing data. If a drive fails, OneFS migrates data to the virtal hot spare to reprotect it. Yo can reserve as many as for disk drives as a virtal hot spare. Balancing protection with storage space Yo can set protection levels to balance protection reqirements with storage space. Higher protection levels typically consme more space than lower levels becase yo lose an amont of disk space to storing erasre codes. The overhead for the erasre codes depends on the protection level, the file size, and the nmber of nodes in the clster. Since OneFS stripes both data and erasre codes across nodes, the overhead declines as yo add nodes. VMware integration OneFS integrates with several VMware prodcts, inclding vsphere, vcenter, and ESXi. For example, OneFS works with the VMware vsphere API for Storage Awareness (VASA) so that yo can view information abot an Isilon clster in vsphere. OneFS also works with the VMware vsphere API for Array Integration (VAAI) to spport the following featres for block storage: hardware-assisted locking, fll copy, and block zeroing. VAAI for NFS reqires an ESXi plg-in. With the Isilon for vcenter plg-in, yo can backp and restore virtal machines on an Isilon clster. With the Isilon Storage Replication Adapter, OneFS integrates with the VMware vcenter Site Recovery Manager to recover virtal machines that are replicated between Isilon clsters. The iscsi option Block-based storage offers flexible storage and access. OneFS enables clients to store block data on an Isilon clster by sing the Internet Small Compter System Interface (iscsi) protocol. With the iscsi modle, yo can configre block storage for Windows, Linx, and VMware systems. On the network side, the logical network interface (LNI) framework dynamically manages interfaces for network resilience. Yo can combine mltiple network interfaces with LACP The file system jornal 25

26 Introdction to Isilon scale-ot NAS and LAGG to aggregate bandwidth and to fail over client sessions. The iscsi modle reqires a separate license. Software modles Yo can license additional EMC Isilon software modles to manage a clster by sing advanced featres. SmartLock SmartLock protects critical data from malicios, accidental, or prematre alteration or deletion to help yo comply with SEC 17a-4 reglations. Yo can atomatically commit data to a tamper-proof state and then retain it with a compliance clock. SyncIQ atomated failover and failback SyncIQ replicates data on another Isilon clster and atomates failover and failback between clsters. If a clster becomes nsable, yo can fail over to another Isilon clster. Failback restores the original sorce data after the primary clster becomes available again. File clones OneFS provides provisioning of fll read/write copies of files, LUNs, and other clones. OneFS also provides virtal machine linked cloning throgh VMware API integration. SnapshotIQ SnapshotIQ protects data with a snapshot a logical copy of data stored on a clster. A snapshot can be restored to its top-level directory. SmartPools SmartPools enable yo to create mltiple file pools governed by file-pool policies. The policies move files and directories among node pools or tiers. Yo can also define how OneFS handles write operations when a node pool or tier is fll. SmartConnect A SmartConnect license adds advanced balancing policies to evenly distribte CPU sage, client connections, or throghpt. The licensed mode also lets yo define IP address pools to spport mltiple DNS zones in a sbnet. In addition, SmartConnect spports IP failover, also known as NFS failover. InsightIQ The InsightIQ virtal appliance monitors and analyzes the performance of yor Isilon clster to help yo optimize storage resorces and forecast capacity. Aspera for Isilon Aspera moves large files over long distances fast. Aspera for Isilon is a clster-aware version of Aspera technology for non-disrptive, wide-area content delivery. iscsi OneFS spports the Internet Small Compter System Interface (iscsi) protocol to provide block storage for Windows, Linx, and VMware clients. The iscsi modle incldes parallel LUN allocation and zero-copy spport. HDFS OneFS works with the Hadoop Distribted File System protocol to help clients rnning Apache Hadoop, a framework for data-intensive distribted applications, analyze big data. SmartQotas The SmartQotas modle tracks disk sage with reports and enforces storage limits with alerts. 26 OneFS Administration Gide