StoreOnce 6500 and 6600 System User Guide

Transcription

1 StoreOnce 6500 and 6600 System User Guide For StoreOnce software version 3.16.x Abstract This document is the user guide for the Hewlett Packard Enterprise StoreOnce Systems and is intended for users who install, operate, and maintain the StoreOnce System. Always check for the most current documentation, including localized versions (PDF) for your product. Refer to the Quick Specs on for supported features for your model. Part Number: BB Published: March 2017 Edition: 3

2 2011, 2017 Hewlett Packard Enterprise Development LP Notices The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website. Acknowledgments Intel, Itanium, Pentium, Intel Inside, and the Intel Inside logo are trademarks of Intel Corporation in the United States and other countries. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Adobe and Acrobat are trademarks of Adobe Systems Incorporated. Java and Oracle are registered trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group.

3 Contents Getting started...10 The StoreOnce System Management Console StoreOnce Graphical User Interface (GUI) components...10 Overview of the StoreOnce System page Viewing service set information...13 Select service set StoreOnce System models...15 Powering on If power on is unsuccessful Powering off using the StoreOnce CLI...17 Rebooting the system using the StoreOnce CLI...18 VTL (Virtual Tape Libraries)...19 VTL Configuration page Fibre Channel Settings tab...19 To edit Fibre Channel settings...20 Port assignment for StoreOnce Systems with multiple Fibre Channel ports VTL Libraries page...20 Working with the libraries list (top half of page)...21 VTL libraries parameters (top half of page)...21 Device Details tab Creating a library (administrators only)...26 Editing library details (administrators only)...27 Deleting a library (administrators only)...28 Emulation types for tape devices Interface Information tab To change a drive assignment on Fibre Channel ports Cartridges tab...31 To create a cartridge (administrators only) Deleting a cartridge (administrators only)...32 To delete all or a range of cartridges (administrators only) To write protect a cartridge (administrators only) Editing the maximum cartridge size (administrators only)...33 Moving or unloading cartridges Editing barcodes in bulk Make Replication Target libraries visible to the host NAS functions NAS server configuration page and service sets CIFS server tab Configuring None authentication mode Configuring User authentication mode Using AD authentication mode...39 NFS server tab Enabling and disabling NFS Browsability...43 Configuring NFS server hosts NAS share configuration page List of shares...44 Contents 3

4 Create NAS shares Creating CIFS shares...47 Create NFS shares...49 Editing NAS share details Delete NAS shares...50 Replication functions...51 What is an appliance?...51 Identifying the appliance Data VIF IP address Status tab...52 Partner Appliances (Replication) Target Appliances tab...53 Source Appliances tab Source Appliance Permissions tab Local Settings (Replication) tab General Settings tab Bandwidth Limiting tab Blackout Windows tab...59 Event History (Replication) tab VT Mappings (Replication)...60 Source and target library mappings Running the replication wizard (virtual tape devices)...62 Recovering a Source Appliance (Virtual Tape devices) NAS Mappings (Replication)...65 Source and target share details Running the replication wizard (NAS) Recovering a source appliance (NAS shares) Reverse replication using the wizard...69 Promoting a Target Share over the WAN using NAS StoreOnce Catalyst functions...72 What is StoreOnce Catalyst?...72 Benefits of StoreOnce Catalyst...72 StoreOnce Catalyst Terminology StoreOnce Catalyst page...73 StoreOnce Catalyst Status tab...74 StoreOnce Catalyst Settings tab StoreOnce Catalyst Clients tab StoreOnce Catalyst Blackout Windows tab...78 StoreOnce Catalyst Bandwidth Limiting Windows tab Fibre Channel Settings tab...80 Configuring StoreOnce Catalyst over Fibre Channel StoreOnce Catalyst Stores page Store details tab Permissions tab (administrators only) Item summary tab...94 Data jobs tab Outbound copy jobs tab Inbound copy jobs tab System information messages StoreOnce Catalyst Best Practices Housekeeping function Contents

5 The Housekeeping page Configuring blackout windows Pausing housekeeping StoreOnce reporting Activity report Reporting page Hardware page Monitoring the StoreOnce System server Monitoring switches Monitoring the storage Drives (enclosure) Storage configuration and reporting File System Report tab Storage Configuration tab View storage configuration Scanning for storage Storage Configuration page parameters Manage storage configuration Creating RAID volumes Expanding the file system Deleting all storage configurations Delete an Alien Volume or delete an invalid RAID Volume Reporting Central Appliance registration Registering an appliance Exporting a certificate Importing certificates Modifying appliance details Unregister an appliance Viewing license information Hardware license fields Viewing license details License details fields Group configuration Appliances Creating an appliance group Modifying an appliance group Deleting an appliance group Virtual devices Creating or modifying a virtual device group Deleting a virtual device group Removing a device from a device group Appliance reports Appliance status reports Replication status Appliance throughput reports Stream count reports Select Device button Contents 5

6 Appliance storage reports Appliance deduplication ratio report Appliance capacity usage report Appliance capacity forecasting report Appliance couplet report Capacity Threshold Alerts Adding a capacity threshold alert Modifying a capacity threshold alert Deleting a capacity threshold alert Device reports Select device (appliance tabs) Select device (device tabs) Select device (appliance Federated Stores tab only) Device status reports Device throughput reports Device storage reports Device deduplication ratio Device capacity usage Device StoreOnce Federated Catalyst stores reports StoreOnce Federated Catalyst stores deduplication ratio StoreOnce Federated Catalyst stores capacity usage StoreOnce Federated Catalyst stores throughput System resource reporting CPU/Memory reports Disk utilization reports Network utilization reports Fibre Channel utilization reports (for devices that support FC) Report Scheduler Adding an report Modifying an report Deleting an report Access and Device Configuration Device Configuration page Firmware page To view and upgrade firmware Firmware page fields User Management User types and user roles Adding a local user (administrator only) Adding an external user (administrator only) Adding a group (administrator only) Modifying a user Deleting a user or group (administrator only) User Interface SSL certificates Generating a self-signed certificate Generating a Certificate Signing Request Importing a certificate Exporting a previously installed certificate Event Management Log export Adding a new recipient Editing a recipient Deleting a recipient Contents

7 Test Events ( ) Managing notifications SNMP GUI functions Test SNMP Agent Setup Modifying the SNMP Agent Setup Viewing SNMP trapsinks list and individual details Adding an SNMP trapsink Modifying an SNMP trapsink Deleting an SNMP trapsink Viewing the SNMP Users list Adding an SNMP user Modifying an SNMP user Deleting an SNMP user SNMP Events page Support Ticket (administrators only) Data collection Collect data Download data collection Delete data collection Maintenance License management Instant-on licenses Full license entitlement Redeeming a license Adding a license by pasting a license string Adding a license by loading a license file Viewing license information on the StoreOnce GUI Hardware license fields Viewing license details License details fields Time and Date GUI page Viewing current date and time setting Resetting the time zone to the default UTC Changing the time zone Changing the date and time Adding an NTP server configuration Deleting or disabling an NTP server configuration Optional hardware What is Optional Hardware? Validating new licenses and updating controller card status Viewing details for currently configured licenses Controller card status fields Optional Hardware Configuration page slot messages Security features Enrolling a StoreOnce appliance with an external key manager Expanding a cluster Network configuration Network Configuration List Current Network Configuration Factory Default Network Configuration Custom Network Configuration List To add a custom network configuration Contents 7

8 To set up static routing To edit or delete a static route To view a custom configuration Editing a custom configuration To add a VLAN enabled Port Set and VLAN Subnet To add nodes to a network configuration To add encryption to a subnet Encryption guidelines To delete encryption links To write protect or un-protect a configuration Deleting a custom configuration Remote Support Remote Support page Configuring and modifying Remote Support Customer Information page Entering and modifying customer information Entitlement page Status page Events Events tab parameters Filtering and searching for events Acknowledging events Deleting events from the log Exporting the events log Remote Event Suppression Configuration save and restore process Configuration file When should a configuration file be generated? Contents of the configuration text file Settings restored after automatic recovery Performing a configuration save Prerequisites for a configuration restore Restoring from the configuration zip file Deleting configuration files from an appliance Basic troubleshooting Password problems Pulling a Support Ticket Licensing problems Multiple users Problems connecting to the StoreOnce System from the backup application Timeout problems with NAS CIFS shares NFS stale handle error If backup or replication fails StoreOnce Catalyst troubleshooting Performance StoreOnce System configuration problems Transferring licenses Contents

9 Advanced troubleshooting Enabling power on after power has been lost VLAN networking problems Software update process Firmware updates What happens to the GUI during failover Running failback Failover with CIFS Server in AD authentication Reduced performance using Data in Flight Encryption Quick Restore ISO Image Hewlett Packard Enterprise Systems Insight Manager Key Parameters StoreOnce 6500 System StoreOnce 6600 System Websites Support and other resources Accessing Hewlett Packard Enterprise Support Accessing updates Customer self repair Remote support Warranty information Regulatory information Documentation feedback Additional regulatory information Belarus Kazakhstan Russia marking Turkey RoHS material content declaration Ukraine RoHS material content declaration Contents 9

10 Getting started The StoreOnce System Management Console The StoreOnce System GUI and CLI together make up the Management Console. The online help and the StoreOnce System user guide describe how to use the StoreOnce System GUI. The StoreOnce Command Line Interface (CLI) provides an alternative way of administering and monitoring the system. Some tasks are only accessible from the StoreOnce CLI. StoreOnce CLI commands require an SSH client application (freely available from the internet) and must be run from an SSH terminal session. The StoreOnce System CLI Reference Guide describes how to use the StoreOnce System CLI commands. Supported browsers The StoreOnce Management GUI is supported on the following web-browsers: Internet Explorer 9, 10, and 11 (note that Internet Explorer 8 is not supported and some StoreOnce features will not work) Mozilla Firefox v23 and above, and Firefox ESR24 The TLS protocol version 1.0 is no longer supported. You must manually enable TLS 1.1 or 1.2 in your browser to access the StoreOnce GUI. StoreOnce Graphical User Interface (GUI) components The web browser being used to communicate with the StoreOnce System must have Active Scripting or JavaScript enabled. If it does not, some of the browser buttons may not be displayed. After 15 minutes of inactivity, the session times out and returns to the Login screen. The GUI includes: 10 Getting started

11 Title bar: Displays the StoreOnce System model, the user name and role, and contains the Logout and Help buttons. System Status (top left side panel): Displays the last time the system was updated (the machine time) and a count of event status categories. The following icons are used in the System Status area. They do not identify the event that has affected the status. To view the individual events for more detail, select Events from the Navigator, as described in Events. Indicates standard information. Indicates a warning state. Attention is needed but the error is not critical to the successful operation of the device. For example, a single disk failure occurs or disks are installed in an expansion shelf but not licensed. Indicates a critical state. The system requires immediate attention. This icon may also appear in the Details area of the screen with a red square background (rather than a red circle). Navigator (left side panel): Displays available GUI topics and enables navigation to selected topic pages. A plus (+) sign next to a topic indicates additional options; click the plus sign to expand the selection and click the minus sign (-) to contract the selection. Topic page (main window): Initially, the main window displays the top-level StoreOnce topic page. To display the page for that selection, select another topic from the Navigator. Some Topic pages require selection of an item, such as a service set, VTL library, NAS share, or StoreOnce Catalyst store in the top half of the page to display details specific to the selected item in the lower half of the page. Some Topic pages include multiple tabs within the page, for example the VTL Libraries page. Select a tab to display information and actions appropriate to that tab. For more information about service sets, see Select service set on page 13. Help button: The Help button in the top right-hand corner of each page displays context-sensitive information for the current page in a pop-up window. The Help window can be resized in the normal way; click and drag on a side or a corner to expand or contract the window. The information in the header shows you where the help has been called from. Hyperlinks allow you to move to the next and previous pages. The information in the footer also provides navigation options. The Home link navigates to the Home page for the help, which gives you access to the complete online help. This page also contains Contents, Search, and Index options. You will need to resize the page to use it effectively. Overview of the StoreOnce System page The initial page at GUI logon provides important information about system status and processes that are running. The StoreOnce System page also provides access to individual StoreOnce functions, which are available as sub topics (click + to display them in the Navigator). System Information The System Information section of the Status page provides information unique to an individual StoreOnce System. Overview of the StoreOnce System page 11

12 Table 1: System information parameters Parameter Type Node Name Serial Number Cluster Management IP Software Revision Data VIF IPs Description The model of StoreOnce System. The node name for this Service Set. The serial number of the entire cluster. Use this serial number when contacting Hewlett Packard Enterprise Support. (It is the same as the serial number on the License management on page 170 page.) The IP address that provides access to the StoreOnce Management Console (GUI and CLI) and applies to the whole cluster, not individual couplets. The software revision of the node on which the Service Set is running. Use this revision when adding couplets to check that all Service Sets are running the latest and the same software. The Data VIF IP addresses for data. Use these addresses when configuring backup applications to send data to the StoreOnce System. The IP addresses can be IPv6 or IPv4 addresses. If VLAN tagging has been configured on your network, a scrollable list allows you to see all the VLAN IP addresses that have been configured. For more information about VLAN tagging, see the installation planning and preparation guide for your product. Status The Status provides details about the rolled-up status of the system or Service Set and the status of the services running. Table 2: Status parameters Parameter Service Set or Overall Status StoreOnce Subsystem Virtual Tape NAS StoreOnce Catalyst Replication Housekeeping Description The state of the system or service set. The status of the background support processes such as Event Manager and Resource Manager. The status of the VTL service. The status of the NAS service. The status of the StoreOnce Catalyst service. The status of the Replication service. The status of the Housekeeping service. Storage Usage 12 Getting started

13 The Storage Usage provides details about the amount of data on the system. Table 3: Storage Usage parameters Parameter User Data Stored Size On Disk Deduplication Ratio Capacity Saved Description The amount of data written by the backup application (before deduplication) to all stores on that service set. The amount of disk space used to store the data deduplicated in all stores on that service set. The deduplication ratio. The amount of capacity saved (as a percentage) by deduplicating the data. Viewing service set information On the lower StoreOnce main page, the screen displays parameters specific to service sets: Click on a service set to display status information for the services running on that set. Click on any column heading to change the sort order or select which columns are displayed. A single-couplet configuration has two Service Sets and is the minimum configuration. Additional couplets increase Service Sets, two for each couplet, up to a maximum of eight. The following example shows a configuration with eight Service Sets. Therefore, it has four couplets. Table 4: Service set parameters Field Name Current Node Main Node Failover Node Service Set Status Failover Status Description The name of the Service Set. The node on which the Service Set is running. This node is normally the Main node, unless a failover state has been invoked. The name of the node on which the Service Set normally runs. The name of the failover node for the Service Set. The status of the Service Set, such as: Running, Starting, Fault, Not Started, Stopped, or Unknown. The failover status of the Service Set. The three possible values for each service set are: Enabled (green), Disabled (white X), and Failed Over (red). This field is useful when running software upgrades or after a reboot to check the failover status of Service Sets. Select service set A service set is a collection of various services, such as VTL, NAS, Replication, and StoreOnce Catalyst. There is one instance of each service per service set. The auto-configuration process registers and starts a service set by launching a process on the server for each of the services. Administrators can create elements such as libraries, NAS shares, replication mappings, and StoreOnce Catalyst stores for a service set. They can also expand or contract the service sets that make up a Viewing service set information 13

14 Federated store. When creating or modifying such an element, the system prompts you to select the target service set to which it relates. IMPORTANT: The number of available service sets depends on the number of couplets in the cluster configuration. The minimum is 2 (for a single couplet in one rack), the maximum is 8 (for a two rack installation with four couplets). Table 5: Select Target Service Set parameters Parameter Name Status Available <devices> Remaining Description The name of the Service Set. There are two for each couplet in your cluster configuration. The status of the Service Set. This column is displayed when you create a library or share and indicates how many devices you can still create for this service set. The maximum devices available depends upon the number of couplets in your configuration. The maximum is 48 for a single couplet. Why are there two service sets for each couplet? There are two service sets for each couplet installed in the StoreOnce System rack to ensure resilience and failover. Each Service Set has a VIF associated with it. This VIF is the IP address used to configure replication mappings and StoreOnce VTL, NAS, or StoreOnce Catalyst devices as backup targets in the backup application. Each node in a couplet can run both service sets during a node failure, and each service set has its own set of service processes and storage. Each service set is associated with: A primary node, the node on which it usually runs. A secondary node, where it will run if the primary node fails. Each node can act as the secondary node for the main Service Set on the other. During a failover, the service set moves transparently from the primary node to the secondary node. Because each storage cluster in the couplet has two connections, one from each node, the service set can still access storage on the primary node even though it is now running on the secondary node. 14 Getting started

15 StoreOnce System models Table 6: Overview of StoreOnce Systems Model Base Storage Capacity Storage Expansion Options Optional Hardware StoreOnce 6500 System StoreOnce 6600 System Each couplet consists of two server nodes and two disk enclosures, each with an initial 44 TB of preconfigured storage Each couplet consists of two server nodes and two disk enclosures, each with an initial 44 TB of preconfigured storage There are two options for expanding storage: StoreOnce 6500 System Capacity Upgrade Disk Pack: The StoreOnce 6500 System (88 TB) Capacity Expansion kit is a pack of twenty-two 4 TB disks, which are added to the original disk enclosure A maximum of five of these kits can be used with the first enclosure until all disk bays are full. StoreOnce 6500 System Capacity Upgrade Enclosure with Disks: Once all bays in the disk enclosure are full, it is possible to add a couplet to your StoreOnce 6500 System. This task is performed by Hewlett Packard Enterprise service engineers. There are two options for expanding storage: By adding disks to both disk enclosures in a couplet (StoreOnce 6600 System 88 TB Capacity Expansion): This expansion kit contains twenty-two 4TB disks, which are added to the original disk enclosures in the Not supported If adding a StoreOnce 6600 couplet to a 6500 cluster, 2 x 8 Gb Fibre Channel cards must be installed in the Optional Hardware PCI-E slots of each node of the StoreOnce 6600 couplet. Supported Two PCI-E slots in each server in a couplet available for Optional Hardware (these slots must be installed in pairs and you must install the same type in each server in a couplet): 10 GbE SFP Network cards 8 Gb Fibre Channel cards StoreOnce System models 15

16 Model Base Storage Capacity Storage Expansion Options sequence described in this guide. A maximum of five of these kits can be used with each couplet until all disk bays are full in both disk enclosures. By adding couplets to the cluster (StoreOnce TB 2nd/4th Couplet and/or StoreOnce TB 3rd Couplet): Once all bays in both enclosures connected to a couplet are full, it may be possible to add a couplet to your HPE StoreOnce 6600 System. The maximum cluster configuration accommodates four couplets. Optional Hardware 16 Gb Fibre Channel cards Powering on To power on the appliance, you must use the StoreOnce CLI and/or power on buttons. You can shut down or reboot the appliance using either the StoreOnce CLI or the StoreOnce Management GUI on the Maintenance page. See Maintenance on page 169 for more information about using the StoreOnce GUI for power off options. To power on after a power loss, see Enabling power on after power has been lost on page 214. IMPORTANT: It is best to failover a service set during the node power on or reboot sequence in case of unexpected errors with the node. If network switches and storage enclosures have been powered off, power on those first (using the power on switches). After maintenance activities, both servers must be powered on at the same time so that the checks in the code can complete before the file system starts. 1. Power on the servers using either: 16 Powering on

17 The power on button on each server to trigger a cold boot and automatically power on. StoreOnce CLI commands to power on a node remotely. (This method requires a server node that is running.) For example, if a node was powered off using CLI commands, power it up again using the following CLI command: hardware powerup nodex 2. After a successful power on, ensure that failover is enabled. To check the status of failover: hardware show node status To enable failover if it is off: system enable failover 3. Once failover is enabled, check that no service sets have failed over during any reboot sequence: To check the status of the service sets: hardware show node status You can also use the GUI to check the status. Look at the StoreOnce System page of the GUI and check the failover status of the service set. To fail them back: system failback setx You can also use the GUI to failback a node. Locate the node in the Hardware pages of the GUI and click Failback this server. If power on is unsuccessful IMPORTANT: A previous unclean shutdown will lead to integrity checking of the storage and your user data. Depending upon the amount of data stored on the couplet, this process can take several hours. Be patient to see whether the Service Set will come online without further intervention or reboot. If node or a couplet fails to successfully power on after a node experienced an unclean power off, power off both nodes in the couplet (using the power buttons on the nodes if necessary). Power on one node and then power on the other node in the couplet. Powering off using the StoreOnce CLI Various commands exist to shut down a node or a cluster. Use the correct command to perform the task required. More details can be found in the StoreOnce System CLI Reference Guide. A power off command only powers off the server component. If the maintenance activity requires the disk enclosure or internal network switch to be powered off, power them off manually. system shutdown: This command gracefully shuts down the cluster by shutting down all services and StoreOnce service sets before powering down the servers. when you power up, the deduplication If power on is unsuccessful 17

18 stores will start up from a clean state. Servers will be in the off state, and will require powering on via the power button. hardware poweroff nodex: This command uses the ilo port to turn off the server, which does not allow StoreOnce service sets to shutdown gracefully. Deduplication stores shut down in an unclean state and require integrity checking (an automatic process) on the next power on. To avoid this condition, the service set on a given node should be failed over to the backup node using the system failover setx command before powering down the node. Rebooting the system using the StoreOnce CLI More details can be found in the StoreOnce System CLI Reference Guide. You can use the following CLI commands to reboot your system: system reboot: This command gracefully reboots the cluster by shutting down all services and StoreOnce service sets before rebooting the servers. This means on reboot the deduplication stores will start up from a clean state. hardware reboot nodex : This command uses the ilo port to reboot the server, which does not allow StoreOnce service sets to reboot gracefully. The result is deduplication stores shutting down in an unclean state and requiring integrity checking (an automatic process) on reboot. The following sequence is recommended if you wish to reboot a node in a controlled way. It fails over the service set before rebooting the node. 1. system enable failover 2. system failover setx 3. system reboot nodex Once nodex has completed reboot: system failback nodex 18 Rebooting the system using the StoreOnce CLI

19 VTL (Virtual Tape Libraries) VTL Licensing requirements No licensing is required for VTL emulations unless using the Security features Data at Rest Encryption, Data in Flight Encryption, and Secure Erase. VTL (or NAS) replication requires a license on the target site, but only if replication is used. VTL replication requires a replication license per couplet, for each couplet in the appliance. Replication encryption using IPsec is part of the Security license. See To add encryption to a subnet. VTL Configuration page Select VTL from the StoreOnce System Navigator menu to display the current VTL configuration. The following functions are available from the StoreOnce VTL page: VTL configuration, which allows an administrator to manage the interface settings for libraries. Library and cartridge management. Equivalent StoreOnce CLI commands are available for the tasks described in this section. See the StoreOnce System CLI Reference Guide. The top half of this page displays available service sets. Click on the service set to display the Fibre Channel Settings tab for the VTL devices configured for that service set in the lower half of the page. Fibre Channel Settings tab If your system supports a Fibre Channel interface, this tab is displayed as the default when you select StoreOnce VTL. Table 7: Fibre Channel settings Setting Port Index Port Location Status Speed Description Libraries can be configured to use the ports in various combinations. See Creating a library (administrators only) on page 26 for more information. The physical location of the Fibre Channel port The PCI-E card slot number that the card is in, and then the physical port number. For example, HBA-6 Port1. The status of each port, which may be OK, Down, Warning, Error, or Not Used. Warnings occur if the port is not available or is down. They also appear if the system is unable to obtain Speed information. Errors occur if there is a fault or the system cannot obtain the link status. The default is Auto, which is the recommended option. The speed will be auto-negotiated between the switch and StoreOnce appliance to choose the highest supported speed. For users who wish to fix the speed, other values are available, as follows: 16Gbs, 8Gbs, 4Gbs, or 2Gbs (not recommended). Table Continued VTL (Virtual Tape Libraries) 19

20 Setting Topology Beacon Description The default is N_Port, when a single target device creates many virtual devices on a fabric attached port. N_Port requires the switch port to support NPIV (N_Port ID Virtualisation). Individual ports can be beaconed via the GUI. This toggles an LED on the physical HBA. The color of this button changes to show the current status of the beacon; grey is off, blue is on. To edit Fibre Channel settings Users with administrator permissions may edit these settings. 1. Click Edit to make the fields configurable for each port. 2. Make the preferred changes to the speed and/or topology, and click Update. CAUTION: This update resets the Fibre Channel link and may affect any backup or restore jobs running. Fibre Channel settings apply to the whole appliance. The settings can also be edited in the StoreOnce Catalyst section of the GUI if you are backing up to StoreOnce Catalyst target devices over Fibre Channel. Fibre Channel settings, defined on either page, apply to all target devices being backed up over Fibre Channel. Therefore, any changes here will also apply to StoreOnce Catalyst target devices over Fibre Channel and conversely. Changing the port speed causes the port status to be reported as Down; refresh the VTL Configuration page to verify that the port is back online. Check the Hardware Tree and the Events page to see the change. 3. Click Continue at the warning prompt to continue applying the changes. 4. Changes affect all service sets running on the node. Port assignment for StoreOnce Systems with multiple Fibre Channel ports When creating a library, you may select either one or multiple Fibre Channel ports for the Library controller virtual robotics interface. The Fibre Channel Information section identifies both the HBA card and the port number that will be used, for example HBA-6.Port1 is Port 1 on the FC card in slot 6. Drives within a virtual library can only appear on one Fibre Channel port, so if you select multiple ports for the library robotics controller then the drives are automatically distributed evenly across the ports to ensure best performance and failover. After creating the library, it is possible to change the drive assignments using the edit function on the Interface Information tab for the selected library. See Interface Information tab on page 29. VTL Libraries page Click VTL Libraries in the Navigator panel to display existing libraries. The top half of the Libraries page shows all libraries configured for the appliance or couplet. Click on a library to display its details in the lower half of the page. Users with an administrator login may edit these settings and delete or create libraries. 20 To edit Fibre Channel settings

21 The service set is shown in the right-hand column. The lower half of the Libraries page contains tabs that display information relevant to the selected library. Working with the libraries list (top half of page) The Libraries list in the top half of the page provides overview information organized in columns of details. To sort the list according to a column, click on the column heading and select Sort Ascending or Sort Descending. To hide or show columns, click on any column heading, select Columns and uncheck or check the preferred columns. Users with an administrator login may also create libraries. Click Create. See Creating a library (administrators only) on page 26 for more information. Users with an administrator login may edit details on some of the tabs for individual libraries (not all tabs have editable information). The relevant GUI buttons are on the tab. For example, each Edit button triggers the edit mode only for the current tab. When in edit mode, each tab has its own Update and Cancel buttons. If you change tabs while in edit mode, a warning dialog advises that any changes they have made will be lost. The Delete button is on the Device Details tab only and will delete the entire library. VTL libraries parameters (top half of page) Table 8: Libraries parameters (top half of page) Parameter Name Replication Role Status Description Identifies the selected device (library). Hewlett Packard Enterprise recommends using a name that identifies the host or backup job with which it is associated. The role of the library, which may be non-replicating, replication source or replication target. The status of the library, which may be online, offline, not started, failed to start, stopping, creating, port not present, or deleting. Connection Indicates whether the library is connected. Possible values are: Connected A client device is connected to any device (robotics or drive) within this library. Not Connected No device is connected to this library. Device Type Cartridges/Slots The emulation type used by the backup software. It is selected when you create a device. The number of cartridges or slots available on the device, which is determined by the Emulation Type selected when the device was created; see Emulation types for tape devices on page 28. You can reduce the number of slots in the Device Details tab for a library selected on this page, but this reduction only removes the highest empty slots. Once it reaches a slot number that contains data, you cannot reduce the number further on this page, even if earlier slots are blank. First use the Cartridges tab to make the slot empty. Table Continued Working with the libraries list (top half of page) 21

22 Parameter Port User Data Stored Size On Disk Dedupe Ratio Service Set Description Identifies the port to which the host is connected for backup and restore. The number of ports available in the drop-down menu depends upon the interfaces that your model supports and your network configuration. The amount of user data stored on the library. The actual size used on disk (after deduplication). The deduplication ratio achieved on the data on the library. If deduplication is disabled, the column displays Dedupe Disabled. The service set to which the library belongs. Device Details tab This tab displays device-specific information for the selected library. Users with an administrator login may perform the following tasks from this tab: Creating a library (administrators only) Editing library details (administrators only) Deleting a library (administrators only) Make Replication Target libraries visible to the host Table 9: Device Details tab Field Description Basic Details Library Name Creation Time Media Changer Port Deduplication Encryption Enabled The name used to identify a particular library. Enter a name that identifies the host or backup job with which it is associated. The date the library was created is generated automatically. Identifies the port type (for example, Fibre Channel). Enables deduplication if the check box is selected (default); unselect to create a non-deduplication library. Deduplication cannot be enabled or disabled once the library is created. Enables encryption of data stored in the library. This feature requires a StoreOnce Security Pack license before encryption can be enabled. Encryption cannot be enabled or disabled once a library is created; it can only be enabled at library creation. If enabled, encryption is performed before writing data to disk for this library. Table Continued 22 Device Details tab

23 Field Secure Erase Mode Physical Data Size Quota Description Enables Secure Erase. This feature requires a StoreOnce Security pack license before it can be enabled. To enable, select the number of preferred Overwrite Passes for deleted data (1, 3, 5, or 7 The default selection of None disables secure erase). You cannot select Secure Erase while creating a library, but after the library is created, you can activate this feature if you have a Security pack license. See Security features for information about the Secure Erase feature. This quota is for the amount of data written to disk after deduplication. The minimum quota size is 50 GB. If the quota is enabled and the quota limit is reached, backups will fail to prevent the quota from being exceeded. The quota allows you to partition the physical capacity of the appliance between various users. If capacity management is required, Hewlett Packard Enterprise recommends configuring backup applications with quotas to reroute to another device or to postpone backups to prevent backups from failing unexpectedly. When a library reaches its quota, the status of the library will change to Critical. Restores from that library are permitted but new backups will fail. When the quota is no longer met, either by increasing the quota or by expiring backups, the library status returns to the OK state. Logical Data Size Quota This quota is for the amount of data a user sends to the device before deduplication. The minimum quota size is 50 GB. If the quota is enabled and the quota limit is reached, backups will fail in order to prevent the quota from being exceeded. This allows you to provide a service to back up a particular amount of user data. For example, set this quota when you charge customers per TB of user data protected. If capacity management is required, Hewlett Packard Enterprise recommends configuring backup applications with quotas to reroute to another device or to postpone backups to prevent backups from failing unexpectedly. When a library reaches its quota, the status of the library will change to Critical. Restores from that library are permitted but new backups will fail. When the quota is no longer met, either by increasing the quota or by expiring backups, the library status returns to the OK state. Emulation The StoreOnce appliance supports HPE and IBM Library and drive emulations. Table Continued VTL (Virtual Tape Libraries) 23

24 Field Library Emulation Default Drive Emulation Number of Cartridge Slots Number of Drives Cartridge Size Description The emulation type of the library. The StoreOnce System supports a number of emulation types. See also Emulation types for tape devices on page 28. The emulation type determines the available embedded drives and cartridge slots. For example, if you select MSL G3 Series (2x24), the device emulates an MSL 2024 Library with two embedded tape drives and a possible total of 24 cartridge slots. Consult your backup application technical support information for information about device types they support. The drive emulation type, LTO 2, 3, 4, 5 or 6, determines the default capacity of the newly created cartridges within the library device. Tape cartridge capacities can be changed individually at any time but cannot be reduced to smaller than the current used size. If you selected D2DBS Generic for the Library Emulation, Ultrium VT is an option for drive emulation. This is a generic Ultrium device which is clearly identifiable as virtual. Where supported by the backup application, Hewlett Packard Enterprise recommends that D2DBS Generic and Ultrium VT are used in preference to the other emulation types. All drives on a library configured with the IBM-TS3500 emulation type will use the IBM-LTO3 drive emulation type. Drives on a library configured with IBM-TS3500 IBMi will use the IBM-LTO5 drive emulation type. If the library is then changed to a different emulation type, the drives will change to the default drive emulation type of LTO4. If you edit this field, the new setting applies only to the next drives that are created within the library, it is not retrospectively applied to existing drives. Define the number of cartridge slots in the library. The number of slots available depends upon the Emulation Type selected. Each slot is automatically populated with a new cartridge upon creation. The cartridge capacity corresponds to the Drive Emulation type. The default number of drives is determined by the Emulation Type selected. If increasing the number of drives, DO NOT exceed the maximum number of libraries and drives that a host can physically access. The number of drives can only be edited during library creation from this field. After library creation, there is a separate button to add and remove drives. See Key Parameters on page 220 for detailed specifications. The size of the cartridge in GB. This field is only available during creation of the cartridge. See Key Parameters on page 220 for detailed specifications. Table Continued 24 VTL (Virtual Tape Libraries)

25 Field Number of Barcode Characters Barcode Template Enabled Description Enables the barcodes for the library to display six or eight characters. The StoreOnce System generates barcodes automatically for cartridges. When entering a barcode manually, eight characters are required. If the 6 character barcode is selected, the StoreOnce System will truncate to six characters, removing two characters of an 8 character barcode. For example, barcode 1ABCDEFG will truncate to BCDEFG. The barcode is displayed with the truncated characters in brackets on the Cartridges tab, (1A)BCDEFG. Enables configuration of the barcodes. A barcode is an 8 or 6 character, alpha-numeric, unique identifier for a cartridge within the StoreOnce System. The backup application will normally track cartridges using barcodes but may also alias the cartridge with another name in its database. (IBM emulations only support 8 character barcodes.) By default, barcodes are generated automatically but may be determined by a barcode template created when the library is created. If using barcode templates, the barcode template: Must be unique and must not start with the letters CLN or DG because these combinations are reserved designations for cleaning and diagnostic cartridges. Can have a prefix of up to three alpha-numeric characters, a start value, and a suffix of up to two alpha-numeric characters. Any unspecified prefix or suffix characters will increase the length of the variable field of the barcode. Should be a minimum of 6 characters. Valid ASCII characters are A-Z, a-z, 0 9. Barcodes are always displayed as eight characters with letters in capitals on the StoreOnce Management GUI and CLI (padded with space characters) regardless of the size selected. However, if the number of barcode characters is set to 6, only the rightmost six characters will be visible to the backup software, that is, barcode 1ABCDEFG will truncate to BCDEFG. (Truncated barcode characters are shown in brackets in the Cartridges tab.) You can modify the barcode template after library creation by clicking Modify Barcode Template on the Device Details tab. iscsi Information This section only applies to iscsi libraries. Fibre Channel Information This section applies to all products that support optional Fibre Channel cards. PCI-E Slot # Lists the PCI Slots Table Continued VTL (Virtual Tape Libraries) 25

26 Field Slot configuration, availability Description Shows slot configuration or availability. Status can be: Optional slot: The PCI-E slot is open. With a Fibre Channel Controller expansion license, you can add an additional Fibre Channel Controller card to this slot. Not available: The PCI-E slot is not available to use for an optional Fibre Channel card For licensed and activated Fibre Channel cards, shows the Fibre Channel ports and checkboxes for each port. For example, if you have installed a Fibre Channel card in PCI-E Slot 6, you will see HBA-6 Port2 (#2) and HBA-6 Port1 (#). Use the checkboxes to select which ports you want to use depending on your system configuration. Library Usage (all models) Backup Application Backup Data Type The backup application primarily used to back up to this library. This optional, but recommended, field is provided to assist with support troubleshooting and has no impact on performance or deduplication efficiency. The type of data being protected by the backups to this library. This optional, but recommended, field is provided to assist with support troubleshooting and has no impact on performance or deduplication efficiency. Creating a library (administrators only) HPE recommends the following to avoid complication when configuring the backup application, and also to avoid creating additional Fibre Channel SAN traffic: Only configure the libraries that you need. Only configure the number of cartridges that you are likely to need. You can add cartridge slots at a later date to expand the system and remove individual blank cartridges from a library without deleting the whole library. The maximum number of virtual devices supported varies according to the product and this number is split across VTL, NAS, and StoreOnce Catalyst devices. See Key Parameters for more information. 1. Click Create in the upper left corner of the screen. 2. Select a service set for the new library and click OK. The information on the service set identifies how many libraries are still available. 3. Enter the appropriate information; see Device Details tab. To enable Data at Rest or Data in Flight Encryption for the new library, configure it at this time by checking the Encryption Enabled box. This feature requires a license. If the license is not installed, an information message is displayed next to the check box stating Not Licensed. See Security features and License management for more information. 26 Creating a library (administrators only)

27 4. Click Create. The Replication Wizard does not allow creation of an encrypted target library. If a replication target library needs encryption enabled, you must create the library on the target appliance before replication mapping to it. The Cartridges tab is only generated after the library is created. The information on the Interface Information tab is generated automatically. Once the library has been created, you can enable Secure Erase. Editing library details (administrators only) It is possible to edit some, but not all, device details after creating a library. Delete cartridges by reducing the number of slots on the Devices page. This will only remove the highest-numbered empty slots. Once the Delete operation reaches a slot number that contains a cartridge, it will not allow further reduction on the Details page, even if previous slots are empty. To open previous slots, first use the Cartridges tab to delete the cartridge from the slot. Changing the cartridge size (by changing the emulation type) on this page will only change newly added cartridges; it does not change the size of cartridges that were already created. You can reduce the number of drives but, if you go to 0, the port setting will change to "No Port". The Number of Drives field can only be edited during library creation. After library creation, there is a separate button to Add/Remove drives. You cannot change the library type to a type that has a smaller set of maximum values (for example, the number of cartridges) than is currently set. You cannot enable or disable deduplication. Once the library is created and the correct license is applied, the Secure Erase Mode box appears on the Device Details tab. The selection box defaults to None, meaning Secure Erase is disabled. To enable Secure Erase, select the preferred number of Overwrite Passes (1, 3, 5, or 7). If enabled, this feature allows you to securely erase confidential data that may have unintentionally been backed up as part of a regular backup job. See Security features on page 179 and License management on page 170 for more information. Editing library details 1. Select the device in the list to display its details and then click on Edit. CAUTION: Take care if you change the Port configuration because the system does not automatically reassign any drives that may now be configured incorrectly. A Warning is displayed. For example, if you change from a multiple Fibre Channel port configuration to a single Fibre Channel Port, when the status shows ready and restarted, you must manually correct those drives that are connected to the wrong port, using the Interface Information tab. See Interface Information tab on page Amend details as appropriate. 3. Click Update. To add/remove drives Editing library details (administrators only) 27

28 Click Add/Remove drive. The maximum number of drives is shown, below which you can edit the Number of Drives. Click OK. If you provide an invalid value, the text box will be surrounded in a red border. Deleting a library (administrators only) Select the required device and then click Delete on the Device Details tab to delete it. You will be prompted to confirm deletion. WARNING: All data on the device will be deleted. The library's deduplication store is also deleted. It may take some time to delete all the files and free space on the StoreOnce System. If Secure Erase is enabled for this store, this data will be deleted securely. Emulation types for tape devices StoreOnce Systems emulate a range of physical tape devices. Table 10: Emulation types for tape devices Emulation type D2DBS Generic Description If supported by your backup application, this is the preferred emulation type because it does not emulate any physical library types in existence and is, therefore, clearly identifiable as a StoreOnce device. It is the most flexible emulation type available; however, backup application support varies by software vendor. If you have selected D2DBS Generic for the Library Emulation Type, you will be able to select Ultrium VT for the drive emulation. This is a generic Ultrium device which is clearly identifiable as virtual. Backup application support for Ultrium VT is common, but not as complete as the D2DBS library type, so it is not possible to use it with all backup software. VERITAS prefers their customers use this emulation type with BackupExec and Netbackup. See Key Parameters on page 220 for detailed specifications. EML E Series ESL E Series An enterprise tape library solution that allows you to configure drives per node and cartridges per library. See Key Parameters on page 220 for detailed specifications. An enterprise tape library solution that allows you to configure drives per node and cartridges per library. See Key Parameters on page 220 for detailed specifications. Table Continued 28 Deleting a library (administrators only)

29 Emulation type IBM-TS3500 IBM-TS3500 IBMi MSL G3 Series (2x24) MSL G3 Series (4x48) MSL G3 Series (8x96) Description A tape library device that appears as a native IBM TS3500 device in a TSM environment to allow use of standard IBM drivers. The emulation type is configured at the library level. Therefore, all drives on a library configured with the IBM-TS3500 emulation type will use the IBM-LTO3 drive emulation type. If the library is then changed to a different emulation type, the drives will change to the new emulation type. The IBM-TS3500 IBMi is a tape library device that appears as a native IBM TS3500 IBMi device in a TSM environment to allow the use of standard IBM drivers. The emulation type is configured at the library level. All drives configured with the IBM-TS3500 IBMi emulation type will use the IBM-LTO5 drive emulation type. If the library is then changed to a different emulation type, the drives will change to the new emulation type. A tape library device with a maximum of two embedded Ultrium tape drives and 24 cartridge slots. Used when implementing rotation schemes which involve simultaneous backup jobs to two devices. This emulation type is widely supported by backup applications. A tape library device with a maximum of four embedded Ultrium tape drives and 48 cartridge slots. Used when implementing rotation schemes which involve simultaneous backup jobs to more than two devices or those that use a large number of cartridges devices. This emulation type is widely supported by backup applications. A tape library device with a maximum of eight embedded Ultrium tape drives and 96 cartridge slots. Flexible emulation The ESL, EML and D2DBS emulations are flexible because they allow you to configure a large number of drives per library. The main benefits are that a large number of drives allows: More concurrent streams on backups which are throttled due to host application throughput, such as multi-streamed backups from a database. A single library (and therefore deduplication store) to contain similar data from backups that must run in parallel to increase deduplication ratio. If using these flexible emulation types, consider the following factors: An important consideration when configuring VTL devices is that the library and each drive that you configure for it counts as a separate device. There are practical limitations on the number of devices that each host and Fibre Channel switch or HBA can access. See Key Parameters on page 220 for detailed specifications. The total device value also applies to NAS shares and StoreOnce Catalyst stores. If you configure the full value as VTL devices, you will not be able to configure any NAS shares or StoreOnce Catalyst stores for that appliance or service set. Interface Information tab This tab shows interface information for the media changer and drives on the selected library. The information for the Interface Information tab is generated automatically and manual configuration is discouraged. Fibre Channel interface Interface Information tab 29

30 The following information is provided for a device that is configured to use the Fibre Channel interface. Some models do not support Fibre Channel. You may use this tab to adjust the Fibre Channel port to which a drive has been assigned; see To change a drive assignment on Fibre Channel ports on page 30. Table 11: Fibre Channel Interface Information Field Device Name Status Port Device Serial Number FC Address World Wide Node Name World Wide Port Name Number of Logins Description Lists all of the devices for the specific Library. There are entries for the Media Changer and for each of the drives configured. The device status (not the state of the connection): Offline, starting, stopping, online Defines the Fibre Channel port to which each media changer or drive is connected. See also To change a drive assignment on Fibre Channel ports on page 30. A unique serial number for the device. It is generated automatically by the StoreOnce System and cannot be edited. The Fibre Channel addresses of the device. This will show an address for each FC Port for which the device is configured, or "Down" if the port is not connected. Provided when the device is created and is globally unique. You can change this, if necessary, but not to any names used by libraries or drives on the local appliance. Generated automatically by the StoreOnce System and used for Fibre Channel zoning for Fibre Channel devices. You can change this, if necessary, but not to any names used by libraries or drives on the local appliance. Libraries split across multiple ports have multiple entries in this field. Fibre Channel libraries show the number of logins for each device in the library. Libraries split across multiple ports have multiple entries in this field. To change a drive assignment on Fibre Channel ports This information applies only to units with Fibre Channel cards installed. When creating a library, drives are automatically assigned based upon the specified port configuration. If you select a pair of ports, the drives are distributed equally across both ports. To change a drive assignment: 1. Click Edit. 2. For each configured drive, select the required port from the drop-down list. 3. Click Update. 30 To change a drive assignment on Fibre Channel ports

31 Cartridges tab This tab shows cartridge information for the selected library. Users with an administrator login can perform the following tasks from this tab: To create a cartridge (administrators only) on page 32 Deleting a cartridge (administrators only) on page 32 To write protect a cartridge (administrators only) on page 33 Editing the maximum cartridge size (administrators only) on page 33 Moving or unloading cartridges on page 33 Editing barcodes in bulk on page 34 Table 12: Cartridge tab parameters Field Location Barcode Mapped Slot Used Size Max Size Write Protected Last Written Description Identifies each element of the library available to hold a cartridge. The types of elements are: Mail slot: a dedicated slot used to hold a cartridge that is ready for exporting to or importing from physical tape. The Mail slot is not used with StoreOnce models. Tape drive: populated when there is activity on a cartridge. You can move a cartridge into a tape drive by using the Move Cartridge dropdown menu in Edit mode. Slot n: one of the standard library slots. A barcode is an 8 or 6 character, alphanumeric, unique identifier for a cartridge within the StoreOnce System. See Device Details tab for barcode information. Check box indicates whether the slot is included in a replication mapping configuration. It cannot be edited from this page. The actual used capacity in MB or GB. Defaults to the appropriate capacity for the drive emulation type selected on the Devices tab. This value may be changed if the Used Size is Blank. The maximum value allowed is 3200 GB. Check box that enables (checked) and disables (unchecked) write protection, see To write protect a cartridge (administrators only) on page 33. Identifies when the cartridge was last written to and is useful when identifying data for copying or exporting. Additional columns appear when function buttons are selected below, such as Create, Move, and Delete. Empty slots Empty slots are slots containing no cartridges and all the fields are empty. Cartridges tab 31

32 Tape drive row: A library consists of two devices: a tape drive and changer device. This location refers to the tape drive element of the library and is normally only populated when the backup application on the host is writing to or reading from the library. Mail slot row: This location is the slot used for importing and exporting cartridges from a library. It is provided by StoreOnce virtual libraries for compatibility with backup applications but is not used. Numbered slot row: This slot is empty after a Delete operation or after the backup application has moved data to the mail slot for export. Once a numbered slot is empty, the Create button may be used to create a new blank cartridge; see To create a cartridge (administrators only). To create a cartridge (administrators only) You can only create a cartridge in an empty slot. 1. Click the Create button. In the Add Cartridge column, empty slots are checked. 2. Select individual slots by clicking the appropriate check boxes. After selecting the slots where cartridges will be added, click Create. 3. Alternatively, click Create all to create a blank cartridge of the size/emulation type selected when the library was first configured in all empty slots. a. If you create a cartridge in an empty slot, the backup application must inventory it (add it to its database or catalog) before the backup application can access the cartridge. b. If you create a cartridge in an empty mail slot, use the backup application to move the blank new cartridge to an empty cartridge slot without requiring an inventory. This saves processing time. 4. Restart the backup application services to see the new cartridges. Deleting a cartridge (administrators only) Things to know before you delete a cartridge: You cannot delete cartridges that are currently in drives, that are mapped for replication, or that are in the delete pending, erase pending, or creating state. You can also delete cartridges by reducing the number of slots on the Devices page, but this only removes the highest slots with no or blank cartridges. Once the Delete operation reaches a slot number that contains a cartridge with data, it will not reduce the number further on the Details page even if earlier slots are blank. First, use the Cartridges tab to reconfigure the slots to a blank state. 1. In the Navigator, select VTL Libraries, and click on the Cartridges tab. 2. Click the Delete button in the bottom right corner of the page. The Delete Cartridge column will appear. 3. To delete individual cartridges, select individual slots by clicking the appropriate check boxes in the Delete Cartridge column. 4. Click Delete. 32 To create a cartridge (administrators only)

33 A dialog is displayed, warning that all data will be lost and asking you to confirm the Delete action. If you click Cancel, the cartridges will not be deleted and you remain in delete mode. Click Delete to continue and the selected cartridges will be deleted. The GUI does not differentiate between cartridges with data and blank cartridges. To delete all or a range of cartridges (administrators only) You cannot delete cartridges that are currently in drives, that are mapped for replication, or that are in the delete pending, erase pending, or create state. 1. In the Navigator, select VTL Libraries, and click on the Cartridges tab. 2. To delete all the cartridges in the library at once, click Delete All. 3. In the window that appears, choose from the following options: a. Delete Remove cartridges (default): completely deletes the cartridges b. Erase Erase cartridge data: deletes the data but leaves the cartridge configurations intact 4. You can also determine which cartridges to delete or erase: a. All Cartridges b. Range: enter the first and last slot to be included in the delete or erase. 5. Finally, if you select the Delete cartridges with data check box, cartridges containing data will be deleted. If unselected, only blank cartridges are deleted. After all of the options are selected, click OK. A confirmation box appears; click OK. To write protect a cartridge (administrators only) 1. Click Edit for the selected library. 2. Check the Write Protected check box for the appropriate cartridges. 3. Click Update. Your backup application will not be able to write any more data to the cartridges. Editing the maximum cartridge size (administrators only) The Max Size defaults to the appropriate capacity for the drive emulation type selected on the Devices tab, but this value is editable. The maximum value allowed is 3200 GB. The maximum size indicates the maximum amount of user data that can be written to that cartridge, assuming uncompressed data; it will only be committed when data is written to it. Changing the maximum space does not affect actual disk usage or save disk space but may be useful if you know you will be moving data to a physical tape with a smaller cartridge capacity. 1. Click Edit for the selected library. 2. Select a value from the drop-down menu, and click Update. Moving or unloading cartridges The move and unload options may be useful to re-align the library configuration against the backup application. For example, if the backup application has crashed or if the backup application does not support the Move Medium command, the library and the backup application can become out of sync. To delete all or a range of cartridges (administrators only) 33

34 You can move cartridges, but only to an empty Location (tape drive or numbered slot). You cannot move or unload cartridges that are in the delete pending, erase pending, or create state. 1. Click the Move button. The Move Cartridge drop-down menu lists available empty slots. (Empty numbered slots are created when a cartridge is deleted.) 2. Use the Unload all Cartridges button to return all cartridges to default slots. Editing barcodes in bulk After a library is created, the Edit Barcodes button appears at the bottom of the cartridges tab for that library. This feature allows the barcodes of a batch of cartridges within the library to be changed according to a user-defined template which may contain a fixed prefix and/or suffix value and a variable portion. Barcode parameters to note: All characters within the barcode must be alpha-numeric (A-Z, 0 9). All alphabetic characters will be capitalized upon application (regardless of how they are entered). A barcode template cannot be applied to a range of slots with one or more empty slots. A duplicate barcode detected within the service set prevents the barcodes from being updated. The check stops at the first duplicate barcode rather than continuing to search for additional duplicates. A barcode template results in restricted barcode prefixes of CLN or DG being created. 1. Click Edit Barcodes. 2. In the Batch Update Barcodes dialog box, configure the following: First Slot: Defines the number of the first slot in the library that will be with the batch. Last Slot: Defines the number of the last slot in the library that will be updated with the batch. Prefix: Defines the first letter or numerical value for the barcodes. Accepts up the three characters. Start Value: Defines the numerical value of the first barcode variable field. Suffix: Defines the suffix letter or numerical value for the barcodes. Accepts up to two characters. IMPORTANT: The values chosen for prefix, suffix, and starting value will limit how many barcodes can be generated. For example, if you enter a 3 character prefix and 2 character suffix, you are limited to 3 alpha-numeric characters for the variable portion which limits the total number of barcodes to barcodes if the starting value for the variable portion is 000. Note that if 6 character barcodes are selected, the leading characters of the barcode will not be reported to the backup application; these may be part of the barcode prefix specified. After configuring the barcode fields, if red outlines appear on the Prefix, Start Value, or Suffix boxes, then an error occurred. Change the values inside the indicated box or boxes. Mouse over a red outlined box and a note pops up explaining the error. Clicking OK without clearing the indicated errors prompts a pop-up window that references validation errors in the form, and the barcode update is not applied. 3. Once all fields are correctly configured, click OK. The new barcodes are applied to the cartridge slots that were chosen for update. 34 Editing barcodes in bulk

35 Make Replication Target libraries visible to the host See Replication functions on page 51 for more details on replication configuration. Replication Target libraries are not normally visible to the host, but you can configure devices to make them visible to backup applications. This allows the backup application to: Move cartridges from storage slots to drives in the library. Perform read and verify operations on the cartridge (but not write). Perform load/unload operations on the tape device. WARNING: Use with care. If the backup application can see both source and target libraries, the application cannot distinguish between the source library and the target library because the barcodes are duplicated in the two locations. Why make target libraries visible? It may be useful to make a target library visible to the backup application on the host to: Confirm that replication is working correctly and check the integrity of the replicated backup by doing a test restore. Perform manual tape copy jobs (sometimes called tape offload) to any tape device on the network using the backup application. IMPORTANT: You cannot change data on a Target library cartridge; you may only load it temporarily into a physical tape device to read it. Best practices for using this feature WARNING: Failure to follow best practices may cause instability and damage to your backup system and data. Cartridges can be marked as unusable or the backup application can attempt to write to target cartridges. 1. Verify that no replication jobs to the selected target cartridge are in progress. 2. Verify that no backup jobs to the mapped source cartridges are scheduled. 3. Verify that the backup application media server instance to be used is not within the same cell/domain that can access the source cartridge. 4. Import the data on the target cartridge into the backup application (this operation must be repeated after each replicate operation to the cartridge). 5. Perform the desired operation on the cartridge, which may be: a. Verify the cartridge using the backup application either with a verify command or by performing a restore. b. Copy the cartridge to a physical tape device connected to the media server. Making a target device visible Make Replication Target libraries visible to the host 35

36 Create the replication mapping as normal. See Running the replication wizard (virtual tape devices) on page 62, as appropriate. From the host that has access to the target library on the VTL Libraries page, select the target library in the Libraries list. Click Edit. The Port defaults to None. Select the appropriate Fibre Channel, depending on your system model and configuration. Click Update. Make the target library visible from other hosts. Configure the Fibre Channel fabric to make the host visible. Target visibility persists even if the power fails or if the replication mapping is removed. To remove target visibility, reset the Port to None. 36 VTL (Virtual Tape Libraries)

37 NAS functions NAS licensing requirements No licensing is required for NAS emulations unless using the supported security features, Secure Erase and Encryption of Data at Rest. If NAS replication is used, a license on the remote target appliance is required. Self-replication does not require a license. NAS server configuration page and service sets Select NAS from the StoreOnce menu to display the NAS configuration page. Every registered node (service set) to the cluster will be listed. Two tabs allow configuration of a CIFS server or an NFS server for the shares. Only users with an Administrator role can change the NAS server configuration. These tabs appear once the service set has been selected. CIFS server tab on page 37 The CIFS Server provides CIFS interface shares that provide backup targets to Windows servers. The authentication mode (None, User or Active Directory [AD]) for the CIFS Server can be configured on this tab. NFS server tab on page 43 NFS Shares are provided as backups targets for UNIX and Linux servers. The host list that will be authorized to access the NFS server and corresponding shares can be added on this tab. CIFS server settings CIFS server settings are applied couplet-wide rather than for the whole cluster (for example, Service Sets 1 & 2 = Couplet 1, Service Sets 3 & 4 = Couplet 2, etc). The user may edit the CIFS server settings on either of the Service Sets in the couplet and the setting will be applied to the other Service Set. If using Active Directory authentication, use the same Active Directory Domain across all couplets in the cluster rather than a unique Active Directory Domain for each couplet. This is recommended when granting access to the management GUI and StoreOnce CLI for external users or groups. When configuring the CIFS or NFS server with other parameters, for example, local CIFS users or NFS Host Lists, the configuration applies to the selected service set. CIFS server tab To use the NAS CIFS shares, there are three configuration stages when creating a backup target share that Windows users can access. 1. Configure the authentication mode for the StoreOnce CIFS server using the StoreOnce Management GUI. These settings will apply to all NAS CIFS shares created on the server. To configure authentication mode, see: a. Configuring None authentication mode on page 38 b. Configuring User authentication mode on page 38 c. Using AD authentication mode on page 39 NAS functions 37

38 IMPORTANT: When the server authentication mode is changed, the adjoining pair service set authentication mode will be updated as per the new selection. For example, when service set 1 is changed to User Authentication, service set 2 will be updated to the appropriate mode required for failover (which in this case would be the User Authentication mode). 2. Create NAS CIFS shares on the StoreOnce System using the StoreOnce Management GUI or the StoreOnce CLI: a. To use the StoreOnce System Management GUI: See Creating CIFS shares on page 47. b. To use the StoreOnce System CLI: See the StoreOnce System CLI Reference Guide. 3. Define access rights to the NAS CIFS share. Do one of the following: a. Set up local user accounts on the StoreOnce appliance and give them access rights to the share. b. Give active directory users access to a share using Microsoft Management Console in Windows. Configuring None authentication mode None authentication mode provides a simple CIFS server configuration that allows for the creation of shares with no authentication. Any user or computer can mount and access the shares created on the StoreOnce System with this setting. This is the default authentication mode for the CIFS server where all the Shares configured have its Permission disabled. Because this mode is the default, there is no user action required to activate this mode. Configuring User authentication mode User authentication mode provides a method of securing the CIFS shares to be accessed only by specified users with local account credentials configured on the StoreOnce appliance. Once the CIFS server is configured to User mode, it is possible to create new local users by selecting Create User. IMPORTANT: When switching authentication modes, the user must log out and the log back in to the Windows client before the new authentication settings will work. 1. Select NAS in the Navigator. 2. Select the service set for which the authentication mode needs modification 3. On the CIFS Server tab, click Edit to modify the authentication settings. 4. Select User authentication mode. 5. Click Update. A pop-up window will advise that If you update the CIFS server settings, any backup or restore jobs in progress for it will fail. Are you sure? 6. After reading the advisory, click Continue (or Cancel). 7. The system is now configured to use CIFS NAS shares with specified local users. Create a local user on the StoreOnce CIFS server On the CIFS server tab, select Create User. Provide a user name and password. Click Update. Your user will be added to the list of users in the lower pane of the CIFS server tab. Navigate to StoreOnce NAS Shares to provide individual users access to specific shares. User name and password recommendations The user name can be a maximum length of 64 characters. The password: 38 Configuring None authentication mode

39 Must be at least 8 characters long. Can use special characters. The password can comply with the Windows strong password requirement to include uppercase letters (A,B,C) or lowercase letters (a,b,c) or numbers (0,1,2,3,4,5,6,7,8,9) or symbols (` # $ % ^ & * ( ) _ - + = { } [ ] \ : ; " ' < >,.? / ). Change a local user password from the StoreOnce CIFS server On the CIFS server tab, select the user. The user name will be highlighted. Click Edit. Enter the local user new password and click Update to save the new password. Delete a local user from the StoreOnce CIFS server Navigate to the CIFS server tab. Select the service set where the user is configured. Select the user to be deleted (the name will be highlighted), and click Delete. A prompt to confirm the deletion of the local user will pop up. Click OK (or Cancel). When you click OK, the user is removed from the system. Using AD authentication mode Prerequisites Domain Name Domain Controller running: Windows server 2003 Windows server 2003 R2 Windows server 2008 Windows server 2008 R2 Windows server 2012 Windows server 2012 R2 To join an AD domain with IPv6, the Domain Controller must be configured using IPv6 only. If the Domain Controller is configured with both IPv4 and IPv6 addresses, the StoreOnce appliance will default to IPv4 to join the AD domain. A user account on the Domain Controller, which is the Domain Administrator or delegated user with Domain Administrative rights A user account on the server running DNS to add entries The system time on the StoreOnce System must be correct and in sync with that of the domain controller. Use the StoreOnce CLI time commands on the StoreOnce System to synchronize with a time server to ensure accurate time keeping. See the StoreOnce System CLI Reference Guide for details. AD authentication mode provides a method of securing the CIFS shares to be accessed only by specified users or groups within an Active Directory domain to the CIFS Server. Using AD authentication mode 39

40 IMPORTANT: In order to allow Active Directory users to log into the Appliance GUI or CLI to perform management tasks, you must first configure the CIFS server settings to AD. To use external Active Directory users or groups on the StoreOnce System (using the GUI or CLI function) to perform management tasks, use the NAS CIFS server tab to set the Authentication mode to AD, join an AD domain, and assign any required delegated users or groups. This is required even when not using NAS shares as target devices. The external users and groups are created in the Active Directory domain controller. When granting access to external user or groups to the management GUI and CLI, it is advisable to use the same Active Directory domain server across all couplets in the cluster rather than a unique Active Directory domain server for each couplet. Configuring AD authentication mode Process overview: 1. Add the StoreOnce appliance to an Active Directory domain 2. Grant AD domain uses access to NAS shares using the Windows Computer Management tool 3. Assign AD users as administrators for the CIFS server 4. Add AD groups as administrators for the StoreOnce server Add the StoreOnce appliance to an Active Directory domain IMPORTANT: Joining or leaving the domain will result in the failure of any backup or restore operations that are running. Do not perform this procedure if you have active backup or restore operations running. 1. Select NAS on the StoreOnce Management GUI. 2. Select the service set that needs to join the Active Directory domain. 3. Select the CIFS server tab. This tab displays the CIFS authentication configuration. 4. Click Edit IMPORTANT: You must manually create an entry for the StoreOnce appliance in the DNS server so the appliance can be resolved using its domain qualified appliance name. The StoreOnce appliance will not automatically add itself to the DNS server configuration (given) during the network configuration process. Do this important step first before joining the domain. 5. Select AD authentication mode. 6. Enter the domain name to which you want the CIFS server to join. 7. Click Update. A pop-up window will advise that If you update the CIFS server settings, any backup or restore jobs in progress for it will fail. Are you sure? 8. Click Continue. An Active Directory Registration window will pop up and request the credentials of a user with permission to join the domain. 9. Provide the credentials (<Domain Username> and <Password>) of the domain user with the appropriate permission level to add a computer (for example, the StoreOnce appliance). 40 NAS functions

41 The user is typically the Domain Administrator or a delegated user with Domain Administrative rights. 10. Click Register. After a short delay (the time is dependent on the topology and size of the AD Domain), the computer (appliance) will become a member of the domain and a Success dialog box is displayed. 11. Click OK. You will be presented with the CIFS server AD status page. Local Administrators are domain users that can be delegated to manage the CIFS Server of the StoreOnce appliance. See "Assigning AD users as administrators for the StoreOnce CIFS server." 12. From a Windows server that is used to perform domain configuration, launch the Active Directory Users and Computers management tool (type dsa.msc in Windows Run command. Or, from a PC with the Microsoft "Remote Server Administration Tools" installed, launch from Administrative Tools) and verify that there is an entry for the StoreOnce device CIFS server. Assign AD users as administrators for the CIFS server After adding the StoreOnce device to the AD domain, a new Local Administrators section appears on the lower half of the CIFS server tab. This allows the addition of domain users or groups with administrative privileges to the CIFS server. This section provides a way of implementing Delegated Administration, which is not available for the StoreOnce device from the Active Directory Management tool. IMPORTANT: When adding AD domain users as local administrators through the CIFS server tab, the users are automatically created as Local Administrators whether or not they are Administrator users on the AD domain. 1. On the CIFS server tab, to add a user, click Add User or Group. 2. Under Members, enter the Domain User who will manage the StoreOnce CIFS server as an Administrator. 3. Click Update. NAS functions 41

42 IMPORTANT: The user is added using the AD logon name. This is available from the user account information. Right-click the domain user from the domain controller, select Properties, and check the domain user account information. The following example shows the AD logon name of cifssuperadminuser1. Both user logon formats are accepted (for example, or <domain \domain_user>). The user will be resolved against the domain controller database. If a user is not configured, or has already been added to the list, an error will be given. Add AD groups as administrators for the StoreOnce server 1. On the CIFS server tab, to add a group, click Add User or Group. 2. Enter the credentials of the Domain group who will manage the StoreOnce CIFS server as administrators and click Update. Removing AD users or groups as administrators from the StoreOnce CIFS server 1. Select the user or group that requires deletion from the list of Local Administrators. The user or group will be highlighted. 2. Click Delete. A confirmation window opens. 3. Click OK. 42 NAS functions

43 The user or group is deleted from the list. Leaving the AD domain You may want to leave an AD domain in order to: Temporarily leave, then rejoin the same domain. Join a different AD domain. Put the StoreOnce System into either No Authentication or Local User Authentication mode. 1. Navigate to NAS CIFS Server 2. Click Leave AD. You can then rejoin the same domain. If joining a different AD domain or changing modes, click the Edit button on the page and select the new domain or mode. NFS server tab To use the NAS NFS shares, there are two configuration stages when creating a backup target share that UNIX and Linux servers can access: Configure NFS server hosts that can mount the NFS shares using the NFS server tab. See Configuring NFS server hosts on page 43. Create NAS NFS shares on the StoreOnce System: Using the StoreOnce Management GUI: See Create NFS shares on page 49. Using the StoreOnce CLI: See the StoreOnce System CLI Reference Guide. You can also use the NFS server tab to enable or disable NFS Browsability; see Enabling and disabling NFS Browsability on page 43. Enabling and disabling NFS Browsability Enabling NFS Browsability allows all NFS clients to view all of the NFS shares. Disabling it prevents NFS clients from viewing the NFS shares. The NFS Browsability setting applies to all nodes in the cluster. 1. Navigate to the NFS Server tab. A check in the NFS Browsability box indicates that Browsability is enabled. 2. Click Edit. 3. Check or uncheck the NFS Browsability box. 4. Click Update. The change takes effect immediately. Configuring NFS server hosts 1. Log on to the StoreOnce Management GUI for the appliance. 2. Select NAS. 3. Select the service set for which the NFS server needs modification. 4. Select the NFS server tab. 5. Click Add. 6. Provide a Host Name (required) and Description (optional). NFS server tab 43

44 Host name: Limited to 99 characters Description field: Limited to 83 characters A host with the * wildcard, added by default, allows any host to access a share. You can have a maximum of 1000 hosts on the NFS server (including the wildcard). 7. Click Update. The new server host is added to the Host List. NAS share configuration page The NAS share configuration page is used to view and manage all NAS target devices (shares) for both CIFS and NFS servers. IMPORTANT: It is important to understand that the StoreOnce network share is intended to be used ONLY by backup applications that back up to disk. Do not use the NAS target device as a drag-and-drop general file store. The one exception to this rule is when using the NAS share to seed an appliance for replication. List of shares The top pane of the Shares page displays all configured shares (both CIFS and NAS) and provides a summary of the different constants of the shares. Table 13: Share information details Item Name Replication Role Status Access Protocol User Data Stored Size on Disk Dedupe Ratio Created Last Modified Service Set Description The name that is used to identify the share configured The role of the share, which may be non-replicating, replication source, or replication target The status of the share, which may be online, offline, not started, failed to start, stopping, creating, or deleting CIFS or NFS The amount of user data stored on the share The actual size used on disk after deduplication The deduplication ratio achieved on the data on the share. If deduplication is disabled, the column displays Dedupe Disabled. Date/Time the share was created The last time the share has been modified This is the service set on which the share is configured 44 NAS share configuration page

45 Create NAS shares Users with an administrator login can create NAS shares. The process varies slightly depending upon whether a user is creating a CIFS or an NFS share. To create CIFS shares: See Creating CIFS shares on page 47 To create NFS shares: See Create NFS shares on page 49 Table 14: NAS share configuration Item Name Description Access Protocol Share Version Network Path Number of Files Number of Directories Write Protection Deduplication Enabled Encryption Enabled Description The name that will be used to identify the share in Windows A text description of the share (optional) CIFS or NFS Shares can be configured as version 2 (default) or version 1. The primary difference is in the maximum number of items (where an item is a file or a directory) per share permitted: 25,000 for version 1 shares and 1,000,000 for version 2 shares. In addition, version 2 shares have been optimized to improve performance with Commvault backup software. Configuring a version 1 share is only recommended for replication compatibility with another appliance on an older software version that only supports version 1 shares. Once configured, you can change the share version from 1 to 2 but you cannot change from 2 to 1. The maximum number of shares depends upon the product model and the number of other devices (including VTL libraries and StoreOnce Catalyst stores) already created. See Key Parameters on page 220 for detailed specifications. The network path to access the configured share The number of files on the share. This information is also available as a column at the top of the Shares page but is hidden by default. Click any column heading to configure which columns display. The number of directories on the share. This information is also available as a column at the top of the Shares page but is hidden by default. Click any column heading to configure which columns display. Used to prevent further backup to the share. If enabled, any backup jobs currently using that share will fail. Indicates if deduplication is enabled. Indicates if encryption is enabled. This feature requires the Security License. See License management on page 170. Table Continued Create NAS shares 45

46 Item Physical Data Size Quota Description This quota is for the amount of data actually written to disk after deduplication. If the quota is enabled and the quota limit is reached, backups will fail in order to prevent the quota from being exceeded. The quota allows you to partition the physical capacity of the appliance between various users (and users with a better deduplication ratio can store more data). If capacity management is required, Hewlett Packard Enterprise recommends configuring backup applications with quotas to reroute to another device or to postpone backups to prevent backups from failing unexpectedly. When a NAS share reaches its quota, the status of the share will change to Critical. Restores from that share are permitted but new backups will fail. When the quota is no longer met, either by increasing the quota or by expiring backups, the share status returns to the OK state. If you use this feature in conjunction with Client- Permissions to control a client s access to the share, you can effectively define how much space a particular user is allowed to use on the StoreOnce System. With many users using the same system, this allows you to control how much disk space is available to individual users. Logical Data Size Quota This quota is for the amount of data a user sends to the device before deduplication. If the quota is enabled and the quota limit is reached, backups will fail in order to prevent the quota from being exceeded. This allows you to provide a service to back up a particular amount of user data. For example, set this when you charge customers per TB of user data protected. If capacity management is required, Hewlett Packard Enterprise recommends configuring backup applications with quotas to reroute to another device or to postpone backups to prevent backups from failing unexpectedly. When a NAS share reaches its quota, the status of the share will change to Critical. Restores from that share are permitted but new backups will fail. When the quota is no longer met, either by increasing the quota or by expiring backups, the share status returns to the OK state. If you use this feature in conjunction with Client- Permissions to control a client s access to the share, you can effectively define how much space a particular user is allowed to use on the. With many users using the same system, this allows you to control how much disk space is available to individual users. Secure Erase Mode Indicates if Secure Erase is enabled. This feature requires the Security license. See License management on page 170. Table Continued 46 NAS functions

47 Item Backup Application Backup Data Type Description The backup application used on the system. This optional field is provided to assist with support troubleshooting and has no impact on performance or deduplication efficiency. The type of data being protected by the backups. This optional field is provided to assist with support troubleshooting and has no impact on performance or deduplication efficiency. Creating CIFS shares Each share has a Permissions tab. The options available on this tab depend on the type of Authentication mode selected when the CIFS Server is configured. If None (No Authentication) was selected, the Permissions tab will have no CIFS authentication entries. If User Authentication was selected, there will be a list of users. Set the access permissions for that share for each user in the list to Access or No Access (default). See Configuring User authentication mode on page 38. If AD Authentication was selected, share permissions are managed from the AD Domain. See Using AD authentication mode on page 39. To create a CIFS share using the GUI 1. Navigate to the StoreOnce NAS Shares page and click Create. 2. Select the service set on which the share needs to be created and click OK. 3. Provide the share details. 4. Click Create (the Create button on the New Share tab, not at the top of the page) to proceed with share creation. It may take a few minutes for the new share to appear and its status to report Online. Once the share is configured, the status will be Online. The shares need to be unique across a pair of service sets. An error will occur if the same share name across service set pair is created. To create a CIFS share using the StoreOnce CLI See the StoreOnce System CLI Reference Guide. Configure CIFS share with None authentication mode For None authentication, there is no further configuration required. Proceed to mounting the share on your Windows client. Configure CIFS share with User authentication mode If the CIFS server has been configured for User authentication, select the share in the Shares list to display the Permissions tab and see the list of users available on the server who can be assigned access to NAS target devices. You can amend permissions for individual NAS target devices. Select the NAS share for which permission needs to be altered and select the Permissions tab and click Edit. Assign Access or No Access for each of the local users for the share by selecting the respective button and click Update. A pop-up window will advise that If you update the Share settings, any backup or restore jobs in progress for it will fail. Are you sure? Click Yes. After a few minutes, the share will be updated with the new access permissions. Creating CIFS shares 47

48 Configure and Manage StoreOnce CIFS share access within an AD domain Now that the StoreOnce System is part of a domain and can be managed it is possible to grant access permission to the shares for domain account users or groups. Access to CIFS shares is granted by the AD server, not the StoreOnce user management. See "Adding the StoreOnce appliance to an Active Directory (AD) domain" in Configuring AD authentication mode for more information. There are two ways for AD domain users to be granted access permissions to the NAS shares on the CIFS server: As remote users configured through the Windows Computer Management tool: Run MMC and install the computer management plug-in (management console). Once remote users are configured through the windows computer management tool (which must be run through the Microsoft Management Console), permissions can be applied per share using the StoreOnce Management GUI. As local users with delegated Administrator permissions configured through the StoreOnce Management GUI. These users have Administrator rights to all shares created on the NAS CIFS server. See User Management on page 153. The StoreOnce appliance only supports the Shared Folders utility within the Windows Computer Management. Any other Windows Computer Management utilities are not supported. Grant AD domain uses access to NAS shares using the Windows Computer Management tool 1. From the Windows client, open the Microsoft Management Console (MMC) through Start > Run > mmc. 2. From the menu, browse through FileAdd/Remove Snap-in. 3. The Add/Remove Snap-ins screen is opened. Browse through the list of Available Snap-ins and search for Shared Folders. 4. Select the Shared Folders snap-in. 5. Click Add to move the snap-in to Selected snap-ins, and click OK. The Shared Folders screen will open. 6. Select the Another Computer button and enter the fully qualified domain name of the StoreOnce appliance. This can also be done by clicking Browse and searching for the appliance. 7. In the View section of the screen, select the Shares button. Complete the snap-in configuration by clicking Finish. 8. Click OK to complete the snap-in addition. The snap-in is now added to the MMC console. This can be saved for future management of the StoreOnce appliance configured shares. 9. Expand the Shares list to see the shares configured on the StoreOnce appliance. 10. Select the share you want to assign domain users or groups to access. Right-click on the share and select Properties. The Share Properties screen will open. A new share created will have no users or groups assigned to it. 11. Select the Share Permissions tab and click Add. 12. Enter the domain user name to be added. Verify by the domain user name by clicking Check Names. Once the user is verified, click OK. 13. Assign the permission you want the domain user to have for this share. 14. Click OK to confirm the changes. 48 NAS functions

49 It is now possible to access the newly created share from any Windows server on the domain using the credentials of anyone who has permission to access the share. If a permitted user is logged into Windows, access to the share is granted automatically with those permissions. IMPORTANT: When switching from None or User authentication mode to AD authentication mode, Hewlett Packard Enterprise recommends logging out and then back into the Windows client where the share is mounted. This ensures the new authentication settings of the CIFS server are enforced. The StoreOnce System does not support creating shares from Windows Computer Management Consoles. Shares must be created from the StoreOnce GUI or CLI. Create NFS shares To create NFS shares using the GUI 1. Navigate to the StoreOnce NAS Shares page and click Create. 2. Select the service set on which the share needs to be created. 3. Provide the share details as described in the table in Create NAS shares. 4. For NFS shares, you will need to change the access protocol from CIFS to NFS. 5. Click Create. It may take a few minutes for the new share to appear and its status to report Online. Once the share is configured, the status will be Online. To create NFS shares using the StoreOnce CLI See the StoreOnce System CLI Reference Guide. Assign hosts permissions for shares Select the NFS share for which permission needs to be altered. Select the Permissions tab and click Edit. Assign the hosts(s) that are to access the NFS share the appropriate access level, No Access, Read- Only Access, or Read-Write Access. An access level needs to be assigned for every host accordingly as required for the share by selecting the respective radio buttons. Click Update. A screen will pop up, advising that, If you update the Share settings, any backup or restore jobs in progress for it will fail. Are you sure? Click Yes. After a few minutes, the share is available. The respective hosts now have their assigned access level to the configured NFS share. Root Squash and Secure Ports configuration for hosts At this time, when editing Permissions, you also have the option to disable two additional items: Root Squash: By default, root_squash is enabled when NAS NFS shares are created. This squashes the root permissions for the client so that it is not possible to access or create files on the NFS server as root; the client always has non-root user permission. Users can disable NFS root_squash after an NFS share has been created and gives a client permission to access or create files on the NFS share as root user. Create NFS shares 49

50 IMPORTANT: Unless root permission is required, do not disable root_squash (by unticking the checkbox), as it can make the system insecure. Secure Ports: By default, secure ports are enabled when NAS NFS shares are created. By default you can connect on the port below 1024 for NFS (Privileged ports). Disabling Secure Ports allows connection to the ports higher than 1024 for NFS. IMPORTANT: Unless required to connect to ports higher than 1024, do not disable Secure Ports. Editing NAS share details Some items to note about editing NAS share details: Users with an administrator login may edit the Description, Share Version, Write Protection, and Secure Erase settings for existing NAS shares. Write protection prevents access initially or protects data after it has been backed up for compliance purposes. Data at Rest Encryption cannot be edited; this feature is only enabled or disabled at the time of share creation. If the correct license was applied, you will be able to enable Secure Erase by selecting the number of Overwrite Passes from the Secure Erase Mode drop-down box. This field does not appear until after the share is created. You can change a share from version 1 to version 2, but you cannot change from version 2 to version 1. In addition, you cannot change from version 1 to version 2 if there is a replication mapping in place; you must first remove the replication mapping, ensure both the source and target devices are on StoreOnce software version or higher (upgrade if necessary), change the source and target shares to version 2, and then reapply the replication mapping. You cannot change the share name after it is created. If a share is converted from Read/Write to Read Only, any open items will be forced closed, which may result in inconsistencies if they are being written to by a backup application. The user will be warned that this could occur before the change is made. The Network Path tab is not available for when you select Edit. However, if you display the Network Paths tab, you can copy the share path if required. If your StoreOnce System is configured on a Virtual LAN, this tab will display all the VLAN IP addresses available for that share. Delete NAS shares Users with an Administrator login may delete a share. Select the share in the list and click Delete at the bottom of the page. 50 Editing NAS share details

51 Replication functions Select Replication from the StoreOnce menu item to display all aspects and tasks associated with replication. There are four tabs on the main Replication page and two further Navigator options for configuring VT mappings and NAS mappings. The Status tab is the default. Users with an administrator login can create mappings and configure replication. Operators can use this page to view replication settings. Replication settings Status tab on page 52 Partner Appliances (Replication) on page 53 Local Settings (Replication) tab on page 57 Event History (Replication) tab on page 59 Replication mappings VT Mappings (Replication) on page 60 NAS Mappings (Replication) on page 65 Replication actions are applied and monitored at appliance level. For StoreOnce 6500 and 6600 Systems, this is the Service Set. For a definition of an appliance, see What is an appliance? on page 51. A license is required for replication on the target appliance or service set. What is an appliance? Replication can take place between different models of StoreOnce Systems. The GUI refers to both Replication Targets and Sources as appliances, so it is important to understand the different meanings of appliance across the product models. In a StoreOnce 2xxx 5xxx, the appliance is the physical device or server that contains the data to be replicated. All mapping is done using the physical IP addresses of the target and source StoreOnce Systems. In a StoreOnce 6500 and 6600, the appliance is the Service Set that contains the data to be replicated. This means that each StoreOnce 6500 and 6600 System has at least two Service Sets that can be selected as appliances. (A fully expanded StoreOnce 6500 and 6600 System would have eight Service Sets.) All mapping is done using the virtual IP addresses of the target and source Service Sets. Identifying the appliance Data VIF IP address When configuring replication between different models of StoreOnce Systems, be aware that: Replication targets on a StoreOnce 2xxx 5xxx System require the IP address of the appliance. Replication targets on a StoreOnce 6500 and 6600 System require identification of the Data VIF IP address of the appropriate Service Sets (also referred to as a node). Each StoreOnce 6500 and 6600 System may have up to eight Service Sets (the minimum is two Service Sets). Replication functions 51

52 Service Set Data VIF IP addresses are used for data traffic and are not the same as the Cluster Management IP address used to log onto the StoreOnce Management Console. You cannot configure the replication targets using the IP address used to log on to the StoreOnce Management Console. 1. Open the StoreOnce Management GUI. The GUI opens on the appliance landing page. 2. Select the Service Set in the list on the StoreOnce page. 3. Locate its Data VIF IP at the bottom of the System Information. Status tab The default tab when you select Replication in the Navigator is the Status tab. The top part of the Replication page shows the available Service Sets. The following table describes the information provided for each Service Set. Select the required Service Set to display associated information in the tabs below. Table 15: Replication Service Set details Name Current Node Main Node Failover Node Replication Status The name of the Service Set. The serial number of the node that is currently hosting the service set. This is normally the same as the serial number of the Main Node, unless the backup system is in a failover state and the Service Set is unavailable. The serial number of the node that normally hosts the service set. The serial number of the node that will host the service set if failover occurs. If the Failover node and the Current Node are the same, one of the nodes on the system is in an automatic failover state and the Service Set associated with it is from the surviving node. Replication will continue on the failover Service Set until the problem that caused failover is resolved. There may be some deterioration in performance, but all replication data is safe. The replication status which may be: Running A target Service Set is offline A mapped share (NAS) or slot pair (VTL) is not synchronized, or out of sync for a certain number of days (hours), depending upon the settings for warning/critical out of sync hours Status tab The top half of the Status tab contains information about replication throughput and active sessions. Replication Throughput Totals: These tables show an average throughput over a period of time, so they will not produce accurate data right away. Active Sessions: This identifies the number of source and target jobs that are running, and the number of source appliances that are connected. This information is useful when monitoring performance. 52 Status tab

53 The bottom half of the Status tab contains a list of Active Jobs. Click and highlight any of the status details to display more information about the job. Partner Appliances (Replication) The Partner Appliances tab displays the replication status of all Target and Sources configured for use with this StoreOnce System. There are three tabs: Target Appliances tab on page 53 Source Appliances tab on page 55 Source Appliance Permissions tab on page 56 The bottom half of the page displays information about any blackout windows that apply to the selected appliance. Target Appliances tab This tab allows you to view the details of all target appliances. Users with an administrator login can use the tab to: Add a target appliance (administrators only) Edit or remove a Target Appliance (administrators only) Run Traceroute Although administrators can add Target Appliances on this page, it is not necessary to do so before mapping configurations because this option is also available when running the Replication wizard. Summary appliance details and target appliance parameters The following status details are shown for both Target and Source appliances. Table 16: Summary Appliance details Appliance Name Appliance Status Appliance Address Serial Number Free Space Online Protocol Version The name of the appliance. The health of the appliance; this shows you whether the appliance is running or not. The virtual address of the service set. The serial number of the appliance. The amount of free space on the appliance. Whether or not the appliance is online. The protocol of the appliance software. Click on an appliance to view more detailed status information in the bottom half of the screen, as described in the following table. Partner Appliances (Replication) 53

54 Table 17: Target appliance parameters Target Appliance tab (some fields are editable). Appliance Name Product Class Appliance Address Serial Number Command Protocol Port Number Data Protocol Port Number Available Replication Protocol User Data Stored Capacity Free Space Software Version System Time Blackout Window Active Blackout Windows The name that is used to identify the Target Appliance. You specify it on the Local Appliance tab of the partner appliance. The product class of the appliance. The virtual address of the service set. You specify it when you add the Target Appliance and can edit it later. The serial number of the Target Appliance; it cannot be edited. The port number that will be used for command protocol. The port number that will be used for data protocol. Indicates whether the Target Appliance is available or not. Identifies the replication protocol in use. The amount of user data stored on the Target Appliance. Shows the capacity of the Target Appliance. Shows the amount of free space on the Target Appliance. Shows the software version of the Target Appliance. Shows the current system time. Shows whether a blackout window is currently active or not. This means that no replication will occur. Any blackout windows that have been specified will be reflected in this weekly calendar. During these times, the selected Target Appliance is not available for replication. Administrators may edit and delete blackout windows from here or from the Local Settings tab. If you set an End of Restriction blackout window to 23.59, the blackout window will last until the end of the day (meaning, the window will end at ). To add a target appliance (administrators only) Click Add Target Appliance. Enter the Target Appliance Address. 54 Replication functions

55 If the Target Appliance is on a 6500 and 6600 System, enter the Data VIF IP address of the required Service Set. See Identifying the appliance Data VIF IP address. The default values for the Command and Data Protocol Port Numbers cannot be changed. If replication needs to take place through a firewall, the network administrator must open (TCP) ports 9387 (Command Protocol) and 9388 (Data Protocol). Click Add Target Appliance. To edit or remove a Target Appliance (administrators only) Select the appliance and click Edit to edit the Appliance Name, IP address, and protocol port details of the target appliance. Select the appliance and click Delete to remove an appliance from the list of Target Appliances available to that source. Run Traceroute Click Run Traceroute to verify the local appliance can communicate with the target appliance and identify the number of hops and latency in the routing. Source Appliances tab This tab displays the details of all source appliances. If the StoreOnce System also has Replication Target libraries, there may be multiple Source Appliances. Source Appliances are appliances that have added the local appliance or Service Set as a Target Appliance. Only Source Appliances currently connected to the Target Appliance are listed. The Source Appliances tab is not editable. Table 18: Source appliance parameters Source Appliance tab (no fields are editable). Appliance Name The name of the Source Appliance. Product Class The product class of the appliance, such as Appliance Address Serial Number Available User Data Stored Capacity Free Space Software Version The virtual address of the service set. The serial number of the Source Appliance. Indicates whether the Source Appliance is available or not. The amount of data stored on the Source Appliance. Shows the capacity of the Source Appliance. Shows the amount of free space on the Source Appliance. Shows the software version of the Source Appliance. Table Continued Source Appliances tab 55

56 System Time Blackout Windows Throttling (Kbps) The day of the week and local time (in 24 hour time) of the system. The system time is set using the CLI time commands; see the StoreOnce System CLI Reference Guide for details. Any blackout windows that have been specified will be reflected in this weekly calendar. During these times, the selected Source Appliance is not available for replication. The throttling (bandwidth limiting) setting. See Bandwidth Limiting tab on page 58 for details. Source Appliance Permissions tab Source Appliance Permissions are disabled by default. In this state, there is no control over mapping between share and library devices on the Target and the Source Appliances. This tab contains an Enabled check box that, when selected, allows administrators to lock the ability to create share and library mappings. When the Replication wizard is run and mappings are configured, the Target will only have access to a list of sources that are allowed to replicate to it. The tab also incorporates a wizard that becomes active when an administrator adds a new source appliance to list, as described in the procedure below. To configure access permissions to source appliances (administrators only) 1. Click Edit and check the Enabled box. 2. Click Update. 3. A wildcard entry in the Source Appliances list allows configuration of permissions across all source appliances. However, this does not set permissions for individual appliances. 4. Click Add. A wizard prompts the necessary steps to add a new source appliance to the list. Provide the serial number of the appliance and specify initial access permissions for all libraries and all shares on that appliance. 5. Once the appliance is added to the list of Source Appliances, permissions can be configured for it. Table 19: Source Appliances parameters Serial Number Appliance Name Appliance Status Appliance Address Configured Mappings The serial number for the required Service Set. This information can be found on the top-level StoreOnce page. Select the appropriate Service Set. The name of the appliance for which you have specified the serial number and cannot be altered. The status of the appliance for which you have specified the serial number and cannot be altered. The address of the appliance for which you have specified the serial number and cannot be altered. Indicates whether any mappings have been configured on the source appliance. This is important because any mappings that already exist will be retained regardless of any access permissions you subsequently set up for libraries and shares on that appliance. 56 Source Appliance Permissions tab

57 To configure permissions (administrators only) Select the source appliance in the list. There are two tabs; one for Libraries, and one for Shares. Click Edit. Check the Access box for those shares and libraries to which access will be granted. These are the shares and libraries that will be displayed when the mapping configuration step is run in the Replication wizard. It will not be possible to create a new share or library from the wizard. Click Update to apply the permissions. Local Settings (Replication) tab This tab contains three additional tabs that show the settings for the local StoreOnce System: General Settings tab on page 57 Bandwidth Limiting tab on page 58 Blackout Windows tab on page 59 General Settings tab Users with an administrator login may edit and maintain these settings. Other users may only view them. 1. Select the General Settings tab. 2. Click Edit to make the fields editable. 3. Edit the fields as needed. Table 20: General Settings (Replication) Appliance Maximum Jobs The name of the appliance, its current status, and the product class. You can only edit the appliance name. The default name is the network host name of the appliance (as configured at installation). You can change this to something more user-friendly and easier to identify the appliance on the Management Console of the local and partner appliances. The name can be anything meaningful to the user, such as the geographical location of the appliance. The Appliance Supported Protocol Version shows which versions of replication protocol are supported, so in the unlikely event of incompatible versions it will be visible to the user. Replication auto negotiates to the lowest supported protocol on either end. The maximum number of source and target jobs that can run concurrently. If running backups at the same time as replication, the default value of target jobs can be reduced to avoid using too much WAN bandwidth and overloading the target appliance and reserve appliance performance. Table Continued Local Settings (Replication) tab 57

58 Synchronization Progress Logging Out of Sync Notification Settings Configure Replication Ports An event is generated each time a mapping goes out of sync and goes back into sync. This field applies to periodic sync progress updates while the mapping remains out of sync resulting in s (if s are configured) but not SNMP traps. Use these fields to enable progress logging for Library and Share synchronization and to specify the logging interval. While the library or share is out of sync, s are sent periodically indicating how many slots or entries are still out of sync. This information is also logged to the user Event Log. One is sent for each log entry made for each library or share that is out of sync. Use these fields to specify the amount of time a mapping needs to be out of sync before a sync issue is shown in the Issue tab. When an event is generated it results in an entry in the user Event Log and an and/or an SNMP trap if the appliance is configured to send these. These notifications are in addition to a standard notification sent whenever a mapping first becomes unsynchronized and another when synchronization is achieved. Only change replication ports if replication is blocked by a router on the WAN. The ports must be the same on both source and target appliances. If in doubt, do NOT change the port configuration. 4. Click Apply to apply the settings. IMPORTANT: If replication takes place through a firewall, the network administrator must open (TCP) ports 9387 (Command protocol) and 9388 (Data protocol) to allow the replication traffic to pass to and from the StoreOnce System. Bandwidth Limiting tab This tab allows users with an administrator login to apply a general bandwidth setting and configure bandwidth limiting windows. Bandwidth limiting can be used to avoid saturating the WAN with low bandwidth replication to free up bandwidth for other processes and applications. A minimum of 2Mb/s per concurrent job is recommended. At least 512Kbps per concurrent job is required for reliable operation. These limits apply to all outbound replication jobs from this local appliance. 1. Click the Bandwidth Limiting tab. 2. In the General Bandwidth Limit section, check the General Limit Enabled box. 3. Determine the recommended general bandwidth limit, which is a simple calculation of: (Max WAN Speed) x (Max Desired WAN Usage%). 4. Use the Bandwidth Limit Calculator on this tab to work out limit values. Set the desired WAN speed and Desired Maximum WAN usage, and the Recommended Bandwidth Limit field will show the desired bandwidth value. 5. In the General Bandwidth Limit section, click Edit. Enter the value calculated in the Bandwidth Limit Calculator in the General Bandwidth Limit field. 6. Click Edit. 7. Configure up to two windows for each day. Use the spinners to select the Start Of Restriction and End Of Restriction times. Enter the appropriate Bandwidth Limit in each required window. (If you use the Bandwidth Limit Calculator, enter the value from the Recommended Limit field.) 58 Bandwidth Limiting tab

59 8. Check the appropriate Apply First/Second Restriction check boxes. This ensures the specified times are enabled. If it is not checked, the times are ignored. 9. Click Apply. All settings are applied to the StoreOnce System, not for individual jobs. The Bandwidth Limit windows override the General Limit when the time specified for the window is active. Outside of Bandwidth Limit windows the General Limit applies. Blackout Windows tab This option allows users with an administrator login to specify times when replication will not occur, for example during planned maintenance or heavy network traffic. You can configure multiple blackout windows. This setting relates to the local appliance in its role as a source or target device. No replication jobs will start if the Source or Target Appliance for a mapping is in blackout, and any running jobs for the mapping will be paused. 1. Select the Blackout Windows tab. 2. Click Edit. 3. Check the box next to the required day of the week. 4. The time boxes become editable. Use the spinner menus to select the appropriate hours. If you set an End of Restriction window to 23.59, the blackout window will last until the end of the day (meaning, the window will end at ). 5. Set up as many blackout windows as required. 6. Verify the Apply First Time Restriction box is checked. This ensures the specified times are enabled. If not checked, the times are ignored. 7. To enable a second blackout window, ensure the Apply Second Time Restriction box is checked. The second blackout window for each day must occur after the first blackout window for that day. 8. Click Apply. On the Appliance tab, the calendar for the Source and Target Appliances reflects the changes. Pause replication jobs The Pause Replication Jobs button on the Blackout Windows tab places all replication jobs on hold immediately. Click a second time to resume replication jobs. Event History (Replication) tab This page shows the log of all completed replication events on the appliance. 1. Select the Event History tab. 2. This page presents a time and date stamped list of significant replication events with severity status and associated messages. It displays source and target details for the replication event, and identifies the source and target slots. The most recent information is at the top of the list. Blackout Windows tab 59

60 3. In the Items per page drop-down, select the number of items you want to view on one page. 4. Select an event in the list to view its details in the lower pane. 5. The history will be maintained if the StoreOnce System is power cycled. The Clear Event History button may be used to clear the list. Searching the event history The top of the tab displays a Filter field and two drop-down menus. Use the right-hand drop-down menu to filter for Severity, for example, to display all Error messages. Use the middle drop-down menu to select a column (or All) and then type a search string into the Filter box. VT Mappings (Replication) This page displays details of all replication mappings between source and target libraries. Administrator users may use the two wizards on this page to configure replication mappings and recover mappings after a disaster. (NAS share mappings are managed on a separate page.) If a non-replicating library is selected, no mappings are configured and the screen displays the Replication and Recovery Wizards. Use this page to: View source and target library mappings (all users), see Source and target library mappings on page 60. Administrator users may also remove slot mappings and edit slot mappings. Run the Replication Wizard to create new mappings (administrator users only), see Running the replication wizard (virtual tape devices) on page 62. Run the Recovery Wizard to restore mappings (administrator users only), see Recovering a Source Appliance (Virtual Tape devices) on page 64. Only administrators can manage mappings. You can only map and replicate libraries of the same version. Source and target library mappings The top part of the VT Mappings page contains a list of all available local libraries. Local libraries are the libraries configured on this StoreOnce System. Non Replicating: a library on this StoreOnce System with slots not yet mapped for replication. Replication and Recovery Wizards are available only with non-replicating libraries. Replication Source: a library on this StoreOnce System with cartridges mapped for replication. You do not have to map all cartridges in a Replication-Source Library, and the Replication-Target Library need not contain the same number of cartridges as the Replication-Source Library. Replication Target: a library on this StoreOnce System with slots that hold cartridges replicated from a Replication-Source library. The option is available to recover individual cartridges from Replication- Target libraries. 60 VT Mappings (Replication)

61 When selecting a non-replicating library, you can run the Replication or Recovering wizard. Use the Replication wizard to create slot mappings for the non-replicating library to make the library a Source library. See Running the replication wizard (virtual tape devices) on page 62 for more information. Use the Recovery wizard to recover cartridges from a Target Library. See Recovering a Source Appliance (Virtual Tape devices) on page 64 for more information. Table 21: Replication library parameters Name Replication Role Status User Data Stored Size On Disk Mapped/Total Slots Device Type Longest Time Out Of Sync Library Version Replication status Service Set The name of the library, defined when the library device was created. The role, which may be Non Replicating, Replication-Source, or Replication-Target. All library devices are initially Non Replicating until slots have been configured using this page. The status of the local library (such as online). The amount of user data stored. The amount of space used on the disk. The number of slots that have been mapped out of the total number of slots configured on the library device. The emulation type configured for that library. The longest time out of sync. The version number of the library. Replication status, which may be Synchronised, Synchronising, or Pending Synchronisation. The Service Set on which the library is configured. Slot mappings Select a local library to display slot mappings for that library. Users with an administrator login may also remove a slot mapping by clicking the Remove button. Table 22: Slot mapping parameters Replication-Source or Replication-Target library selected Slot Mapping Name The slot mapping name. It is created when you run the wizard to define the grouping of slots that you select. Table Continued Replication functions 61

62 Source/Target Appliance Name Source/Target Appliance Address Source/Target Appliance Online Source/Target Appliance Serial Number Source/Target Library Name Source/Target Library Status Blackout Window Active Time Out Of Sync Replication Status The name of the Target Appliance to which cartridges will be replicated. The virtual IP address of the service set. Indicates whether a replication link is established with the partner appliance. The serial number of the Target Appliance to which cartridges will be replicated. The name of the library to which cartridges will be replicated on the Target Appliance. The status of the partner library (such as online). Relates to the local appliance in its role as a source or target appliance. No replication jobs will be started if the source or target appliance for a mapping is in blackout, and any running jobs for the mapping will be paused. Time in hours that replication has been out of sync. Shows whether the mapping is synchronized or not. Slot mapping details The tabs at the bottom of this page show more detailed mapping information for the selected library and slot mapping. Mapping details tab This tab details mapping details between source and target libraries. If a source library is selected, it will indicate if Recovery is in process. If a target library is selected, it will indicate if the target library is visible to the host. All other information is identical for both source and target libraries. For example, use this tab to determine: The number of mapped slots and replication status. The average throughput of data. Multiple VTL library source appliances can replicate into a single VTL library target appliance offering consolidation benefits. This process is known as Fan-in. Users with an administrator login may edit the Mapping Name on this tab. Slot details This tab displays details for each mapped slot in the selected slot mapping. It includes average throughput data for each slot. When selecting a source library, users with an administrator login can: Edit the Target Slot to which a Source Slot is mapped. Enable the Recover First checkbox, which enables a user to request that a mapped slot be recovered from Target to Source, if required (this is sometimes known as reverse replication). Running the replication wizard (virtual tape devices) When selecting a non-replicating library, you can run the Replication or Recovery Wizard. 62 Running the replication wizard (virtual tape devices)

63 The Replication Wizard is used to create new mappings between non-replicating libraries (which become Replication Source Libraries) and either existing or new Target Libraries. IMPORTANT: The Replication Wizard does not allow creation of an encrypted target library. To replicate from an encrypted Source library, first create the Target library and enable encryption so the Target library is also encrypted. 1. Create a non-replicating library on the Source Appliance. 2. Create a backup rotation scheme and allow the first full backup to run. 3. Decide how to seed the first full backup on the Target Appliance. Are you seeding across the WAN or can you colocate the Target Appliance on the same LAN as the Source Appliance? 4. Go to the Replication VT Mappings page and select a non-replicating library to be converted to a Replication Source Library. 5. Click Start Replication Wizard. At the Welcome screen, click Next. TIP: Click show/hide details box to check how many target appliances are permitted and the number of target appliances currently configured. 6. Select a Target Appliance from the list and click Next. To select an appliance not yet on the list, click Add Target Appliance. Enter the Target Appliance IP Address or fully qualified domain name. The default values for the Command and Data Protocol Port Numbers cannot be edited. (If replication takes place through a firewall, the network administrator must open (TCP) ports 9387 (Command protocol) and 9388 (Data protocol) to allow the replication traffic to pass to and from the StoreOnce Systems.) Click Add Target Appliance. 7. The wizard then moves to the Select Target Library step. Select a library on the target appliance and click Next. To create a new library on the target appliance, click Create New Target Library. Configure details as done with creating a new library device. When creating libraries on a target device it is possible to create libraries with 0 (zero) drives. Attempting to create a library with more drives than those available on the target will fail with a suggestion that there may be too many drives already in use on the target. You cannot create a new target library if Source Appliance Permissions is enabled on the selected target appliance. Instead, the library must first be created on the target before mapping from the source. The Replication Wizard does not allow creation of an encrypted target library. To replicate from an encrypted Source library, first create the Target library and enable encryption so that the Target library is also encrypted. 8. At the Edit Slot Mapping step, enter a Slot Mapping Name. The slot number and barcodes of all source cartridges are displayed. A new barcode is generated on the target library (these barcodes will be overwritten with those of the source when replication starts). By default, all slots on the Source are selected for mapping and mapped to available slots on the Target library. To deselect Replication functions 63

64 cartridges from this slot mapping configuration, select Unmapped from the Target Slot Name dropdown menu. 9. Click Next to display a summary of the replication configuration that you have created. 10. Click Apply to create the slot mapping configuration. Click OK at the Wizard Complete prompt. 11. Replication of cartridges will start as soon as the libraries have been synchronised. Look at the Replication Status field on the Library Details section of the VT Mappings page. It changes from Pending Synchronisation to Synchronising to Synchronized. If unable to colocate the Target Appliance on the same LAN as the Source Appliance to improve replication performance, relocate the Target Appliance to the target site as soon as the cartridges are synchronized. VTLs configured as non-deduplicating can replicate to both deduplicating and nondeduplicating target libraries. For example, this can be useful to: Replicate data that does not deduplicate, such as compressed files. Replicate a copy of critical data needed for instant recovery. Recovering a Source Appliance (Virtual Tape devices) The Replication Recovery wizard allows administrator users to recover mapping configurations after a disaster. For example: the remote site has lost both the host servers and the StoreOnce System. New hardware was purchased and installed, and the administrator now wants to recover data to the StoreOnce System and then restore to the host server. Before the failure, a mapping existed between a Source Library on the remote site StoreOnce System and a Target Library on the Data Center StoreOnce System. After the failure, the Source Library is missing but the mapping may or may not still exist. CAUTION: If you replace the disks in the source StoreOnce System and keep the original appliance, the source to target mapping will still exist on the repaired StoreOnce System. You MUST BREAK this mapping BEFORE carrying out recovery. If the mapping is left unbroken, the now-blank Source Library (on the replacement disks) will overwrite the data on the Target Library, effectively losing backup data on both Source and Target Libraries. 1. Create a new non-replicating library on the Source Appliance (either by running the Installation wizard or by using the Devices page). 2. Go to the Replication VT Mappings page and select the new non-replicating library. 3. Click Start Recovery Wizard. At the Welcome screen, click Next. 4. At the Select Target Appliance Step, select Add the Target Appliance and provide the IP address of the previous replication target device. 5. Select the existing Target Library, or the non-replicating library that was the Target Library before mapping was broken, from which slots will be recovered. 64 Recovering a Source Appliance (Virtual Tape devices)

65 TIP: Use the Click to show/hide details box to view further information about configured and maximum shares, libraries, and mappings. 6. If the library is an existing Target Library, select the Slot Mapping that was configured and click Next. If the mapping was broken and the source library reverted to non-replicating, you can add a new slot mapping. If the Target Library supports multiple library Fan In, the library may still be a Replication Target if other mappings exist. Recover by adding the mapping back to map the unmapped slots to the new Source Library. 7. All slots in the Target Library are selected by default, but you can deselect any cartridges that you do not want to be recovered to the Source Library by checking the Pending One off Recovery box. 8. Click Next to display the Summary page. 9. Click Apply to run reverse replication. As soon as reverse replication completes for each slot, the data may be recovered to the host using the original backup application. This can take time because ALL the data must reverse replicate over the WAN link. New backups can now run to the Source Appliance and replication will run normally without further configuration. NAS Mappings (Replication) This page displays details of all replication mappings between source and target shares. Administrator users may use the two wizards on this page to configure replication mappings and recover mappings after a disaster. (VT library mappings are managed on a separate page.) If a non-replicating share is selected, no mappings are configured and the screen displays the Replication and Recovery Wizards. Use this page to: View source and target share mappings (all users). See Source and target share details on page 65. Administrator users may also remove share mappings and edit share mappings. Run the Replication Wizard to create new share mappings (administrator users only). See Running the replication wizard (NAS) on page 68. Run the Replication Recovery Wizard to recover share mappings. See Recovering a source appliance (NAS shares) on page 69. Only administrators can manage mappings. You can only map and replicate deduplicating shares and map shares of the same version. Source and target share details The top half of the NAS Mappings page contains a list of all available NAS shares that were configured on this StoreOnce System. Non Replicating: a share on this StoreOnce System that has not yet been mapped for replication. Replication and Recovering Wizards are available only with non-replicating shares. Replication Source: a share on this StoreOnce System that has been mapped for replication. Replication Target: a share on this StoreOnce System that has been replicated from a Replication- Source share. NAS Mappings (Replication) 65

66 When selecting a non-replicating share, you can run the Replication or Recovery Wizard. Use the Replication Wizard to create mappings for the non-replicating share; it becomes a Source share. See Running the replication wizard (NAS) on page 68 for more information. Use the Recovery Wizard to recover files from a Target share. See Recovering a source appliance (NAS shares) on page 69 for more information. Table 23: Local share parameters Field Name Replication Role Status User Data Stored Size On Disk Access Protocol Longest Time Out Of Sync Share Version Replication Status Service Set Description The name of the share, defined when the share was created. The role, which may be Non Replicating, Replication Source, or Replication Target. All shares are initially nonreplicating until mappings have been configured using this page. The status of the local share, such as Online. The amount of user data stored. The amount of space used on the disk. The access protocol that was configured when the NAS share was created: CIFS or NFS. The longest time out of sync. The share version number. Replication status, which may be Synchronised, Synchronising, or Pending Synchronisation. The Service Set on which the library is configured. Share mappings Select a local share to display its mapping. Users with an administrator login may also remove a share mapping by clicking on the Remove button. CAUTION: Do not delete a replication mapping while a backup or restore operation is in progress, because the source device is temporarily taken offline and any backup or restore jobs will fail. 66 Replication functions

67 Table 24: Share mapping parameters Replication-Source or Replication-Target share selected Mapping Name Source/Target Appliance Name Source/Target Appliance Address Source/Target Appliance Online Source/Target Appliance Serial Number Source/Target Share Name Source/Target Share Status Blackout Window Active Time Out Of Sync Replication Status The share mapping name. It is created when you run the wizard to create the share mapping. The name of the Target Appliance to which entries will be replicated. The virtual IP address of the service set. Indicates whether a replication link is established with the partner appliance or not. The serial number of the Target Appliance to which entries will be replicated. The name of the share to which entries will be replicated on the Target Appliance. The status of the partner share, such as Online. Relates to the local appliance in its role as a source or target appliance. No replication jobs will be started if the source or target appliance for a mapping are in blackout, and any running jobs for the mapping will be paused. Shows the amount of time in hours that replication has been out of sync. Shows whether the mapping is synchronized. Share mapping details The two tabs at the bottom of this page show more detailed mapping information for the selected share and share mapping. Mapping Details tab This tab details mapping details between source and target shares. If a source share is selected, it will tell you whether Recovery is in process. All other information is identical for both source and target shares. For example, use this tab to find out: The status of mappings. The average throughput of data. Administrators may edit the Mapping Name on this tab. File Details tab This tab displays mapping details for each directory and files within it including average throughput data for each file. You cannot edit any details on this tab, but you can click on any column heading to sort by that column. Replication functions 67

68 Running the replication wizard (NAS) The Replication Wizard creates new mappings between non-replicating NAS shares (which become Replication Source shares) and existing or new Target shares. (See Recovering a source appliance (NAS shares) on page 69 for information about the Recovery wizard.) NAS replication is a 1:1 relationship from the source to the target. Fan-in, replicating from multiple sources to a single target (available for VTL and StoreOnce Catalyst replication), is not available with NAS replication. 1. Create a non-replicating share on the Source Appliance. 2. Allow the first full backup to run. 3. Decide how to seed the first full backup on the Target Appliance. If seeding across the WAN or can colocate the Target Appliance on the same LAN as the Source Appliance, go to step 4. If seeding using physical media: a. Create the share on the Remote Site share. b. Mount the source NAS share to the host and copy the files from the NAS share to a USB disk. c. Transport the USB disk to the replication target site. d. Pause housekeeping on the replication target site appliance (see Pausing housekeeping on page 112) to prevent the transmission of more data than is necessary. e. Insert the USB disk into a host server on the same sub-net as the Target Appliance. Mount the target NAS share to the host and copy the files across from the USB disk at the source site. f. Resume housekeeping on the replication target site appliance. 4. Go to the NAS Mappings page. 5. Select a non-replicating share to be converted to a Replication Source Share and click Start Replication Wizard. 6. Proceed to the Select Target Appliance step. TIP: Click show/hide details box to check how many target appliances are permitted and the number of target appliances that are currently configured. 7. Select a Target Appliance from the list and click Next. To select an appliance not yet on the list, click Add Target Appliance. Enter the Target Appliance IP Address or fully qualified domain name. The default values for the Command and Data Protocol Port Numbers may not be edited. (If replication needs to take place through a firewall, the network administrator will need to open (TCP) ports 9387 (Command protocol) and 9388 (Data protocol) to allow the replication traffic to pass to and from the StoreOnce Systems.) Click Add Target Appliance. 8. The wizard then moves to the Select Target Share step. Select a share on the target appliance and click Next. 68 Running the replication wizard (NAS)

69 To create a new share on the target appliance, click Create New Target Share. Set up the details as you would normally do when creating a new share. You cannot create a new target share if the appliance to be used as the target has Replication Source Permissions enabled. When creating a new share, a warning indicates that it will take a few seconds for the new share to come online. Click OK. The share version of the source and target NAS shares must be the same. You can change a share from version 1 to version 2, but you cannot change from version 2 to version 1. In addition, you cannot change from version 1 to version 2 if replication mapping is in place; you must first remove the replication mapping, ensure both the source and target devices are on StoreOnce software version or higher (upgrade if necessary), change the source and target shares to version 2, and then reapply the replication mapping. The items in the stores will be synchronized as though you created a new replication mapping but the process is quick. 9. Give the Share Mapping a name and click Next. 10. The Summary screen is displayed. Click Apply to create the share mapping configuration. Replication of files will start immediately. If you can colocate the Target Appliance on the same LAN as the Source Appliance to improve replication performance, relocate the Target Appliance to the target site as soon as the files are synchronized. Recovering a source appliance (NAS shares) There are two ways of recovering NAS shares mappings after a disaster. Reverse replication using the wizard on page 69 Promoting a Target Share over the WAN using NAS on page 70 IMPORTANT: If you replace the disks in the source StoreOnce System and keep the original appliance, the source to target mapping will still exist on the repaired StoreOnce System. You MUST BREAK this mapping BEFORE carrying out recovery. If the mapping is left unbroken, the now blank Source Share (on the replacement disks) will overwrite the data on the Target Share, effectively losing backup data on both Source and Target Shares. Reverse replication using the wizard In this example, the remote site lost both the host servers and the StoreOnce System. New hardware was purchased and installed, and the administrator must recover data to the StoreOnce System and restore to the host server. Before the failure, a mapping existed between a Source Share on the remote site StoreOnce System and a Target Share on the Data Center StoreOnce System. After the failure, the Source Share is missing and the mapping will no longer exist. Recovering a source appliance (NAS shares) 69

70 1. Create a new non-replicating share on the Source Appliance (using the Create button on the NAS Shares page). 2. Reverse seed the first full restore. The simplest way to do this is to use a USB disk, as described below. It is also possible to recover across the WAN, but this may place an unacceptable load on bandwidth or time availability. It is possible to reverse seed the first full restore using a USB disk, as follows: a. Mount the target NAS share to the host and copy the share to a USB disk attached to the host. b. Transport the media to the Replication Source site and attach it to a host. c. Pause housekeeping on the replication source site appliance (see Pausing housekeeping on page 112) to prevent the transmission of more data than is necessary. d. Mount the source NAS share to the host and copy across the data from the USB disk before running the Recovery Wizard. 3. Go to the Replication NAS Mappings page and select the new non-replicating share. 4. Click Start Recovery Wizard. 5. At the Select Target Appliance step, select Add Target Appliance and provide the IP address of the previous replication target device. 6. Select the existing Target. This is the Target NAS share from which files will be recovered. Click Next. An entry will indicate non-replicating share (instead of Replication Target) because the mapping is missing. 7. At the Edit Share Mapping step, create a new mapping and click Next. 8. The Summary screen is displayed. Click Adopt to run reverse replication. 9. As soon as reverse replication completes, the data may be recovered to the host using the original backup application. New backups can now run to the Source Appliance and replication will run normally without further configuration. 10. Resume housekeeping on the replication source site appliance. Promoting a Target Share over the WAN using NAS In this example, the remote source site lost both the host servers and the StoreOnce System. New server hardware was purchased and installed, and the administrator must recover data to the server. The administrator has not installed a new StoreOnce System and is going to recover data directly to the server from the Data Center StoreOnce appliance over the WAN (which will take a long time). The procedure described below retains the ability to back up to the Target Share. If this is not required, an easier solution may be to recover data from the Target Share, which is read-only. Keep in mind that recovering high volumes of data by this method (over the WAN) will take a considerable amount of time. Recovering data at the data centre is much faster and once recovered it can be transported to the remote site. Before the failure, a mapping existed between a Source Share on the remote site StoreOnce System and a Target Share on the Data Center StoreOnce System. After the failure, the mapping still exists but the 70 Promoting a Target Share over the WAN using NAS

71 Source Share is missing. The Target Share on the Data Center StoreOnce System is still in Target Share mode, it has not had its mappings removed. 1. On the Target Appliance in the Data Center, go to the Replication NAS Mappings page, select the Target Share, and remove the mapping between it and the lost Source Share. 2. The Target Share becomes a non-replicating share. 3. Make sure the backup application is targeting the newly non-replicating share at the data centre and recover the data using the backup application at the data center. 4. At this point there is no StoreOnce Source Appliance at the remote site. If one is installed at a later date, reverse recover the data and configure replication as described in Reverse replication using the wizard on page 69. Replication functions 71

72 StoreOnce Catalyst functions The following StoreOnce Catalyst functions are available: Viewing and managing StoreOnce Catalyst settings: StoreOnce Catalyst page on page 73 Viewing and managing StoreOnce Catalyst stores: StoreOnce Catalyst Stores page on page 87 Viewing and managing StoreOnce Catalyst Federated stores: StoreOnce Catalyst Stores page on page 87 For general information about StoreOnce Catalyst, see What is StoreOnce Catalyst?. With the current version of the software there are no equivalent CLI commands available for the tasks described in this section. IMPORTANT: If StoreOnce Catalyst operations pass through a firewall, the network administrator must open (TCP) ports 9387 (Command protocol) and 9388 (Data protocol) to allow the StoreOnce Catalyst traffic to pass to and from the StoreOnce Systems. Licensing requirements StoreOnce Catalyst licensing is per couplet; however, every couplet in the cluster must have a StoreOnce Catalyst license applied in order to create StoreOnce Catalyst stores. Security licensing is per couplet; however, every couplet in the cluster must have a security license. Supported backup applications StoreOnce Catalyst is a backup application-integrated solution. See the HPE Data Availability, Protection and Retention Compatibility Matrix for a list of supported backup applications at daprcompatibility. What is StoreOnce Catalyst? StoreOnce Catalyst is a StoreOnce function that allows backup applications to: Back up data to a target store on the StoreOnce System. Deduplication may occur on the media server, backup/database server, or StoreOnce System. Copy jobs between StoreOnce Systems. Configuration occurs within the backup application, making StoreOnce Catalyst an attractive alternative to using the replication function on the StoreOnce System. Benefits of StoreOnce Catalyst The backup application is in full control of data for the full lifecycle of the backup data. The backup application has full visibility of all items and jobs on the StoreOnce System. Deduplication can occur on either the media server or StoreOnce System which ensures efficient use of the available bandwidth. There is no enforced limit on the number of StoreOnce Catalyst items within a store. Copy jobs are initiated from the application and have none of the complexities of replication mapping. If StoreOnce Catalyst device types are used, space reclamation is more automated and easier to implement from within the backup application. 72 StoreOnce Catalyst functions

73 StoreOnce Catalyst Terminology StoreOnce Catalyst: the name of the StoreOnce interface StoreOnce Catalyst stores: the targets/device types in which backups are stored on the StoreOnce System StoreOnce Catalyst Federated stores: a group of up to eight service sets within the same cluster that share backup jobs as a federation on the StoreOnce System StoreOnce Catalyst items: the backup items stored in the StoreOnce Catalyst stores on the StoreOnce System StoreOnce Catalyst clients: the generic term for applications that connect using the StoreOnce Catalyst interface Data jobs: any backup or restore job StoreOnce Catalyst Optimized Backups: backups performed on the media server or backup server (instead of the StoreOnce System) so only unique data is sent to the StoreOnce System using a low bandwidth transfer protocol. Actual performance varies depending upon the data and disk I/O speeds. Copy jobs: true copies of the data (not mirror images). The backup application specifies the source store (outbound copy job) and destination store (inbound copy job). Once copied, the two versions are independent of each other and either version can be deleted, moved, or added to from the backup application. The backup application initiates copies. Copy jobs are supported over Ethernet and Fibre Channel. StoreOnce Catalyst Optimized Copy: the source and destination stores negotiate so that only unique data is transferred and the copy job is completed in a bandwidth-efficient manner. StoreOnce Catalyst page This page has a number of tabs that provide access to the following StoreOnce Catalyst functions: StoreOnce Catalyst Status tab on page 74 StoreOnce Catalyst Settings tab on page 75 StoreOnce Catalyst Clients tab on page 76 StoreOnce Catalyst Blackout Windows tab on page 78 StoreOnce Catalyst Bandwidth Limiting Windows tab on page 79 Fibre Channel Settings tab on page 80 Select StoreOnce Catalyst from the Navigator to display the StoreOnce Catalyst page and associated tabs. Click + to expand the StoreOnce Catalyst topic in the Navigator and access the StoreOnce Catalyst Stores topic. Select the required Service Set in the top section of the page to display its StoreOnce Catalyst settings in the lower section of the page. For more information about Service Sets, see Select service set. Table 25: StoreOnce Catalyst Service Set fields Field Name Current Node Description The name of the Service Set. The node on which that Service Set is currently running. Table Continued StoreOnce Catalyst Terminology 73

74 Field Main Node Failover Node Catalyst Status Description The main node for the Service Set. This is normally the same as the current node unless failover has occurred. The failover node for the Service Set. The status, which may be Running, Online, Deleting, or Fault. In the unlikely event that the StoreOnce Catalyst Status displays as Fault, contact Hewlett Packard Enterprise support services for further advice. IMPORTANT: When you configure StoreOnce Catalyst, the configuration applies to the selected Service Set. All stores created on that Service Set have the same configuration settings. Each Service Set has a Data VIF IP and a StoreOnce Catalyst over Fibre Channel Identifier associated with it. These values are used when configuring StoreOnce Catalyst stores as backup targets in your backup application. They are not the same as the VIF used to log in to the StoreOnce Management Console. The Data VIF IP for the service set is documented in the GUI for each Service Set on the Navigator StoreOnce page. Select the Service Set, then look to the System Information in the bottom half of the page. Data VIF IP provides this IP address. The StoreOnce Catalyst over Fibre Channel Identifier is shown in the StoreOnce Catalyst Fibre Channel Settings tab. StoreOnce Catalyst Status tab The Status tab displays details about: StoreOnce Catalyst Status and Protocol Versions StoreOnce Catalyst Copy and Data Job Throughput Totals Active Sessions Details refresh every 10 seconds, so this information provides a useful overview of StoreOnce Catalyst activity on the StoreOnce System. The data displayed on this status page is generally for information purposes only; do not make inferences based on the values shown. 74 StoreOnce Catalyst Status tab

75 Table 26: Throughput totals and active sessions Field StoreOnce Catalyst Copy and Data Job Throughput Totals (recent averages) Active Sessions Description The left-hand column shows throughput averages for StoreOnce Catalyst Copy and Data Jobs. Bandwidth indicates the actual physical network bandwidth being used. Throughput indicates the perceived or logical network bandwidth used (it includes the efficiency achieved through deduplication). These are aggregate numbers (per Service Set, for StoreOnce 6500 and 6600). The throughput numbers will correlate with those shown on the graphs on the Activity page. The right-hand column shows the number of jobs of each type that are running. Data Jobs Running shows the number of backup and restore jobs that are running on the appliance or service set. Outbound Copy Jobs Running shows the number of copy jobs running to another appliance or service set. Inbound Copy Jobs Running shows the number of copy jobs coming in from another appliance or service set. See Key Parameters on page 220 for detailed specifications. More about Job types Different backup applications can use different terminology for data transfers. From a StoreOnce Catalyst perspective, if data is being moved between the StoreOnce System and a media or application server, this is a data job. If the transfer is between two StoreOnce Systems, this is a StoreOnce Catalyst Copy job. For Copy jobs, the StoreOnce System is responsible for all data movement (although the process is initiated by the backup application software). For data jobs the backup application is responsible for the data movement. If the copy job numbers are high (close to the maximum), copies will not fail. Copy activities happen under the control of the StoreOnce System and it will optimize the queuing and running of jobs based on the resources available. If the Data job count starts getting high, the StoreOnce System is being loaded quite heavily. You may see jobs failing to start or running slowly (although the aggregate performance across the many jobs will still be high) due to insufficient resources being available. The maximum data jobs value is not guaranteed in all cases. In some situations, such as during failover, or when heavily loaded, the actual maximum may be less (based on resources available to the box at that time). StoreOnce Catalyst Settings tab The StoreOnce Catalyst Settings tab is used to view the settings that apply to StoreOnce Catalyst functions and jobs for all nodes on the StoreOnce System. Users with an administrator login may also edit these settings. StoreOnce Catalyst Settings tab 75

76 IMPORTANT: First enable Client Access Permission Checking on this page to assign permissions when subsequently configuring clients and stores. (If you do not set permissions, all clients have unrestricted access to all stores.) Client access is also enabled in the backup application software. HPE recommends enabling Client Access Permission Checking for increased data security. To edit settings (administrators only) 1. Click Edit. 2. Amend the fields as required. 3. Click Update. Table 27: StoreOnce Catalyst Settings fields Field Client Access Permission Checking Apply to All Service Sets Maximum Concurrent Outbound Copy Jobs Maximum Concurrent Data and Inbound Copy Jobs Description When enabled, the Clients tab is active and the Permissionstab on the Stores page is active. These tabs enable control over which clients (backup applications) can access which stores on the StoreOnce System. If you do not set permissions, all clients will be able to access all stores. This is only available after clicking Edit. When enabled (default), any changes made are applied to all service sets within the cluster. The maximum number of outbound copy jobs that can be processed concurrently. Copy jobs are placed in a queue and processed as soon as volume of jobs and any configured blackout windows or bandwidth limiting allow. The backup application polls the StoreOnce System to identify when copy jobs are complete. It is recommended to limit the maximum number of concurrent outbound copy jobs to 1 per 512 kbps of available bandwidth. The maximum number of data and inbound copy jobs that can be processed concurrently. Blackout windows and bandwidth limiting do not apply to these jobs. IMPORTANT: If StoreOnce Catalyst operations pass through a firewall, the network administrator must open (TCP) ports 9387 (Command protocol) and 9388 (Data protocol) to allow the StoreOnce Catalyst traffic to pass to and from the StoreOnce Systems. StoreOnce Catalyst Clients tab This tab allows setting up a list of clients (backup application client identifiers) that will be displayed on the Permissions tab to restrict client access to a store. 76 StoreOnce Catalyst Clients tab

77 The client backup application must first be configured with a client identifier before you can add details to this tab. See the client backup application documentation for more information about configuring identifiers. To add a client (administrators only) 1. Click Add. 2. Enter the name of the client and a description. The client application must be configured with a client identifier, such as MediaServer1. This identifier is entered in the Client field (no spaces are permitted). 3. Check the features that you desire (if they are supported by the client application): Enter a password and confirm the password. Check Allow Store Creation. Check Manage Server Properties. Check Manage Client Permissions. Only enable features on the Clients tab that are supported by your client application. 4. Click Update. Table 28: StoreOnce Catalyst Clients fields Field Client Description Password Allow Store Creation Description The client identifier is a user-defined string set through the backup application software which can be used on the StoreOnce System to identify a client. For example, there may be multiple media servers sharing the same ID; so, the identifier is not a client machine name or a name generated by the software. Best practice is to ensure that the name created on the backup application is meaningful for use in searches on the StoreOnce System. This is a description that can be included on the StoreOnce System when the administrator adds a client. If the client backup application supports this, you can provide a client password (client passwords are optional and can also be left blank). Once set, any client that connects will need to supply the password along with their client id. Refer to your client application's documentation for further details. If the client application supports it, you may also enable clients to create stores remotely from this tab. Refer to your client application's documentation for further details. Table Continued StoreOnce Catalyst functions 77

78 Field Manage Server Properties Manage Client Permissions Description If the client backup application supports this, you can manage the server from the client backup application rather than the StoreOnce System. When enabled, four settings can be managed through the backup application: Blackout Windows, Throttling Windows, Max number of Data jobs, and Max number of Copy Jobs. Refer to your client application's documentation for further details. If the backup application supports this, you can remotely manage which Client IDs exist in the system and which Client IDs are able to access which stores. Only enable this if the backup software supports this feature. Refer to your client application's documentation for further details. A Client ID must be defined from the GUI and then enabled for this feature before a backup application using that Client ID can connect to the StoreOnce appliance and further manipulate data for other Client IDs. WARNING: When enabled, this feature allows anyone with access to the backup application the ability to change the Client ID settings, thereby giving users on one system control over and full access to all backup targets. Apply to All Service Sets When enabled (default), any client changes made are applied to all service sets within the cluster. To delete a client (administrators only) Select the client to delete. Apply to all Service Sets is enabled by default; this deletes the client across all service sets. Deselect this check box to delete the client from only the service set selected at the top of the page. Hewlett Packard Enterprise recommends using Apply to all Service Sets to maintain configuration consistency. This is especially important when using StoreOnce Federated Catalyst. Click Delete. Click Yes in the confirmation box. StoreOnce Catalyst Blackout Windows tab The fields at the top of this tab show the System Time and whether a Blackout Window is currently active or not. The information below displays the start and stop times of any blackout windows that have been configured for outbound copy jobs. Users with an administrator login may specify times when you do not want outbound copy jobs to occur, for example, during planned maintenance or heavy network traffic. Multiple blackout windows may be configured. Blackout windows override any attempts by backup application software to perform StoreOnce Catalyst Copies. Backup application software will retry continually until a blackout window is finished. 78 StoreOnce Catalyst Blackout Windows tab

79 Blackout windows are available on most StoreOnce functions to ensure all StoreOnce services run efficiently and do not compete for resources. For example, if running backup, restore, replication, and StoreOnce Catalyst Store operations with no break (24 hours a day), housekeeping cannot complete and performance will suffer. To edit StoreOnce Catalyst blackout windows (administrators only) 1. Select the Blackout Windows tab. 2. Click Edit. 3. Check the box next to the required day of the week. 4. The time boxes become editable. Use the spinner menus to select the appropriate hours. If you set an End of Restriction window to 23.59, the blackout window will last until the end of the day (meaning, the window will end at ). 5. Set up as many blackout windows as required. 6. Verify that the Apply First Time Restriction box is checked to ensure that the times that have been specified are enabled. If not checked, the times are ignored. 7. To enable a second blackout window, make sure the Apply Second Time Restriction box is checked. The second blackout window for each day must occur after the first blackout window for that day. 8. If working with Federated stores, check the Apply to All Service Sets box to avoid having to make the same changes to each service set in the team. 9. Click Apply. To pause copy jobs (administrators only) The Pause Copy Jobs button on the Blackout Windows tab places all outbound copy jobs on hold immediately. Click Pause Copy Jobs a second time to resume outbound copy jobs. StoreOnce Catalyst Bandwidth Limiting Windows tab There are four sections to this tab, all of which relate to bandwidth limiting on outbound copy jobs. Status: Details the current bandwidth limit, if any. General bandwidth limit: Administrator users may enable and apply a general bandwidth limit. This is a simple calculation of: (Max WAN Speed) x (Max Desired WAN Usage%) Bandwidth limit calculator: Provided to help work out limit values for the general bandwidth limit and the bandwidth limiting windows. Bandwidth limiting windows: Administrator users may specify certain times when different bandwidth limits may apply. Any bandwidth limit entered will overwrite the general bandwidth limit. Bandwidth limiting can be used to avoid saturating the WAN to free up bandwidth for other processes and applications. A minimum of 2 Mbps per concurrent job is recommended. At least 512 Kbps per concurrent job is required for reliable operation. Bandwidth limiting is performed based on average data transfers, not absolute values. These limits apply to all outbound copy jobs from this Service Set. To edit bandwidth limiting (administrators only) StoreOnce Catalyst Bandwidth Limiting Windows tab 79

80 1. Display the Bandwidth Limiting Windows tab. 2. Check the General Limiting Enabled box and determine the recommended general bandwidth limit, which is a simple calculation of: (Max WAN Speed) x (Max Desired WAN Usage%) Use the bandwidth limit calculator provided on this page to work out limit values, if required. 3. Click Edit to edit the Bandwidth Limiting Windows. Configure up to two windows for each day. Verify the appropriate Apply First/Second Restriction check boxes are checked. This ensures the specified times are enabled. If not checked, the times are ignored. Then manually enter the required Bandwidth Limit in each required window. 4. Click Apply. All settings are applied to the StoreOnce System and not for individual jobs. The Bandwidth Limit windows override the General Limit when the time specified for the window is active. The General Limit applies outside of Bandwidth Limit windows. Fibre Channel Settings tab The Fibre Channel Settings tab is only relevant to certain StoreOnce System models and will only be available if your system supports Fibre Channel. If StoreOnce Catalyst over Fibre Channel is supported on the StoreOnce appliance, the Fibre Channel Settings tab is available. StoreOnce Catalyst over Fibre Channel functions in the same way as standard StoreOnce Catalyst (over Ethernet). The backup application will not perceive a difference. However, some configuration is required to set up the backup and restore connections between the ports on the StoreOnce System and the ports on the client servers. This is done using the Fibre Channel Settings tab. When using StoreOnce Catalyst over Fibre Channel: Backups are supported on StoreOnce Catalyst over Fibre Channel interface and over Ethernet networks. Appliance-to-appliance connectivity via optimized StoreOnce Catalyst copy jobs is supported over both Ethernet and Fibre Channel. Administrator client privileges are required to run StoreOnce Catalyst over Fibre Channel because it accesses OS-specific device files associated with StoreOnce Catalyst over Fibre Channel devices. See Client configurations for more information. Configuring StoreOnce Catalyst over Fibre Channel If using Fibre Channel, consult the HPE Data Availability, Protection and Retention Compatibility Matrix to ensure that client HBAs, switches, Fibre Channel driver, and firmware versions are supported. Before configuring StoreOnce Catalyst over Fibre Channel, ensure that media/database servers can communicate with the StoreOnce appliance over a Fibre Channel network. The storage administrator must ensure that any network segregation, such as zoning, is set up to handle required connectivity between the server and appliance. See Zoning considerations for more information. 80 Fibre Channel Settings tab

81 When using StoreOnce Catalyst over Fibre Channel: Running StoreOnce Catalyst over Fibre Channel requires Administrator privileges to access OSspecific device files associated with StoreOnce Catalyst over Fibre Channel devices. StoreOnce Catalyst over Fibre Channel functions the same way as standard StoreOnce Catalyst (over Ethernet); the backup application will not perceive a difference. However, some configuration is required to set up the backup and restore connections between the ports on the StoreOnce System and the ports on the client servers. Use the Fibre Channel Settings tab (available within the StoreOnce GUI only if StoreOnce Catalyst over Fibre Channel is supported). Fields on the Fibre Channel Settings tab The tab contains three sections: Identifier information, Ports and Devices. There is an Edit button in each section. Table 29: Fibre Channel Settings Field Description Editable Identifier The FC address of the StoreOnce System. No Identifier Alias An alias for the FC address to make it easier to identify the StoreOnce System in the backup application. The alias must begin with the COFC- prefix and cannot contain any special characters except a hyphen (-). Yes Target Ports: There is a row for each FC port on the StoreOnce System Port The port number. No Port Location The PCI-E card slot number and port number (for example, HBA-6 Port1). Status The status of the port and its current speed. No Speed Topology The speed of the port. The default is Auto, which is the recommended option. The speed will be auto-negotiated between the switch and StoreOnce appliance to choose the highest supported speed. For users who wish to fix the speed, other values are available. The default is N_Port, when a single target device creates many virtual devices on a fabric attached port. N_Port requires the switch port to support NPIV (N_Port ID Virtualisation). Yes No Beacon Check this box to beacon the port on the FC card. Yes Devices: Devices are split into Target Devices and Initiator Devices. There is a row for each device on the StoreOnce System. Target Devices: Used for Fibre Channel backup/restore/copy. Table Continued StoreOnce Catalyst functions 81

82 Field Description Editable Device Name The name of the StoreOnce Catalyst over FC port. No Status The status of the StoreOnce Catalyst over FC device. No FC Address World Wide Node Name World Wide Port Name Number of Logins Number of Devices per Login The FC address of the StoreOnce Catalyst over FC device, or "Down" if not connected. Generated automatically by the StoreOnce System and used for Fibre Channel zoning for Fibre Channel target devices. Zone with the Copy Source FC target World Wide Name or the FC client FC port WWN for backup/restore. Generated automatically by the StoreOnce System and used for Fibre Channel zoning for Fibre Channel target devices. Zone with the Copy Source FC target World Wide Name or the FC client FC port WWN for backup/restore. The number of client FC ports zoned with that StoreOnce Catalyst over FC port. The number is accurate as of the last reboot. FC logins do not get removed if a client FC port is unzoned. This value determines the number of backup and restore connections that are allowed for each client login to that port on the StoreOnce System. Increase this value if multiple concurrent backup streams are required. The maximum allowed is 256. See Initial configuration for more information. You must set this value correctly to ensure enough connections are available between the client FC port and the StoreOnce FC port. No No No No Yes Device Login Information (Click the plus sign (+) next to the Device Name to expand and see this information for the device.) After you have zoned StoreOnce Catalyst over FC with your client, open this to confirm that you see the host Fibre Channel address in this list. (This list is only accurate from the last StoreOnce node reboot.) Once zoned, the logged in device will remain in the list of hosts, even if the host is later logged out/ unzoned. Login ID Each login is assigned an incremental login number. No Host FC Address The FC address of the host for the device. No Host World Wide Node Name A unique identifier for the host node. No Host World Wide Port Name Host Emulation A unique identifier for the host port associated with the host node. Automatically set to Default emulation. For AIX clients, change the Default host emulation to AIX in order to enable client logins. After changing the emulation, perform an AIX device file rescan on the client. Initiator Devices: Used for StoreOnce Catalyst Copy over Fibre Channel only Device Name The name of the StoreOnce Catalyst over FC port. No No Yes Table Continued 82 StoreOnce Catalyst functions

83 Field Description Editable Status The status of the StoreOnce Catalyst over FC device. No FC Address World Wide Node Name World Wide Port Name Initial configuration The FC address of the StoreOnce Catalyst over FC device, or "Down" if not connected. Generated automatically by the StoreOnce System and used for Fibre Channel zoning for Fibre Channel initiator devices. Zone with the Copy Destination FC target World Wide Name. Generated automatically by the StoreOnce System and used for Fibre Channel zoning for Fibre Channel initiator devices. Zone with the Copy Destination FC target World Wide Name. No No No 1. Locate the Identifier at the top of the screen. This Identifier is the Fibre Channel address of the StoreOnce System and is used to identify the StoreOnce System in the backup application. It is in the format COFC-<device-id>; you may provide an Identifier Alias to make it easier to identify from the backup application. This Catalyst over Fibre Channel Identifier is provided to the backup application where an Ethernet address would otherwise be provided. 2. In the Target Ports section, the default values are recommended. However, you can edit the speed if necessary. 3. In the Devices section, locate the World Wide Port Name (WWPN) for each port on the StoreOnce System. The WWPN is required to zone the client with the StoreOnce System. Use this information to zone your client Fibre Channel ports with your StoreOnce Fibre Channel ports. When making use of StoreOnce Catalyst Copy over Fibre Channel, both the source/destination initiator and the target devices must also be zoned to communicate with each other over Fibre Channel. See Zoning considerations for more information. 4. Important: Locate the Number of Devices per Initiator Port for each port. This value determines the number of concurrent backup/restore and copy connections allowed from a single client Fibre Channel port to a single StoreOnce Fibre Channel port, or from a source StoreOnce Fibre Channel port to a destination StoreOnce Fibre Channel port. The setting applies to all StoreOnce Catalyst supported client operating systems (Linux, AIX, HPE-UX, Windows, Solaris), and also applies to StoreOnce Catalyst Copy over Fibre Channel. Increase this value if multiple concurrent backup/copy streams are required; the maximum allowed is 256 devices per client Fibre Channel port login. If this value is increased, a device file rescan on the client is needed before the change is recognized. If the number of devices is reduced, client operating systems will not delete StoreOnce Catalyst over Fibre Channel device files after a rescan. Operating systems will only clear outdated device files on a reboot. The number of paths available from one particular client or source StoreOnce node to a destination StoreOnce service set is calculated as: number of a client's ports zoned to a StoreOnce service set * number of StoreOnce service set ports zoned to that client * devices per initiator count StoreOnce Catalyst functions 83

84 Table 30: Example relationships between Device per Initiator Port and Number of Connections Per Client StoreOnce System Devices per Initiator Port Number of concurrent backup/restore/copy sessions 1 1 port zoned to 4 ports ports zoned to 4 ports ports zoned to 2 ports ports zoned to 4 ports Per client Fibre Channel port to StoreOnce port relationship, and source StoreOnce port to destination StoreOnce port for StoreOnce Catalyst copy. 84 StoreOnce Catalyst functions

85 Zoning considerations Important: Non-optimal Fibre Channel SAN zoning can lead to a lack of Fibre Channel connectivity. HPE recommends the following configurations: Every backup/media server should zone at least two Fibre Channel ports with at least two StoreOnce node Fibre Channel ports across different Fibre Channel cards, ideally across different SANs. Multiple connections allow for higher availability. If a connection is broken, StoreOnce Catalyst over Fibre Channel will automatically attempt to connect on a different path without failing the backup. The backup will fail from a lack of connection only if no paths are available from the media/backup server or to the StoreOnce. The same approach should be taken for StoreOnce Catalyst Copy over Fibre Channel zoning of source and destination copy devices. When zoning for StoreOnce Catalyst Copy over Fibre Channel, ensure that the source Initiator WWN is zoned with the destination target WWN, and that the destination Initiator WWN is zoned with the StoreOnce Catalyst functions 85

86 source target WWN. StoreOnce Catalyst Copy is a two way protocol and both the source and destination must be able to communicate with each other over Fibre Channel. Use small Fibre Channel zones limiting the number of Fibre Channel ports in each zone. When using StoreOnce Federated Catalyst, the backup/media server communicates with each Federation member directly. Ensure that at least one port belonging to each Federation member node is zoned with the backup/media server. HPE recommends zoning multiple ports for higher availability and performance. When using StoreOnce Catalyst over Fibre Channel to StoreOnce 6500 and 6600 appliances, ensure that a backup/media server is zoned with both StoreOnce nodes in the couplet. On a failover event, the World Wide Name of the sister node will be used to communicate with both StoreOnce service sets. This is transparent to the backup application because applications connect using the StoreOnce Catalyst over Fibre Channel Identifier or alias. StoreOnce Catalyst over Fibre Channel does not make use of or rely on any external multi-path drivers. Connections are balanced using StoreOnce Catalyst over Fibre Channel internal algorithms. Installed multi-path drivers are ignored by Catalyst over Fibre Channel. Client configurations Once the client has been Fibre Channel zoned with the StoreOnce appliance, there are a number of considerations for each operating system. Windows Clients Administrator permissions are required to run Catalyst over Fibre Channel backups. StoreOnce Catalyst over Fibre Channel presents a device type of Processor. In Windows Device Manager, these devices are shown as Other Devices. After zoning the devices or changing the Number of Devices per Initiator Port, right-click Other Devices and select Scan for hardware changes to detect the new devices. Linux Clients StoreOnce Catalyst over Fibre Channel presents a device type of Processor. On Linux, these devices files are created in /dev/sg*. By default, /dev/sg* devices are accessible by root users only. If backups are run as a non-root user, first grant the backup user permissions to access these device files using a Linux udev rule. To create a udev rule: 1. Create a udev file in the following location on every backup server: /etc/udev/rules.d/70-cofc.rules 2. Add the following rule to the file: KERNEL=="sg[0-9]*", ATTRS{vendor}=="HPE*", ATTRS{model}=="StoreOnce CoFC*", ATTRS{rev}=="CAT1", GROUP="##CORRECT_USER_GROUP##" where ##CORRECT_USER_GROUP## is replaced by the Linux user group that will perform backups and restores. For example, sapsys. This rule is broken into separate lines to fit the confines of the PDF. Enter the rule as a continuous line in the udev file. 3. Rescan for Linux device file changes to update the permissions. The lsscsi --generic command can be used to determine which /dev/sg* device files belong to Catalyst over Fibre Channel. AIX Clients 86 StoreOnce Catalyst functions

87 StoreOnce Catalyst over Fibre Channel presents a device type of Sequential on AIX. These device files are created in /dev/rmt*. After zoning the devices or changing the Number of Devices per Initiator Port, scan for device file changes by executing the cfgmgr command as a root user. By default, /dev/rmt* device files are accessible by root users only. Running backups as a non-root user requires an additional one-time configuration step of running storeonce-cofc-passthroughinstall.sh. This installation script must be run as root and can be found in the backup application installation bin directory. When using Catalyst over Fibre Channel from AIX in StoreOnce version and later, an additional configuration step is required in the StoreOnce GUI. Find the WWPN of the client AIX Fibre Channel port and set the Emulation Mode to AIX on the Fibre Channel settings tab. Scan for device file changes by executing the cfgmgr command as a root user. HPE-UX Clients StoreOnce Catalyst over Fibre Channel presents a device type of Processor. On HPE-UX, these devices files are created in /dev/pt/ptx. After zoning the devices or changing the Number of Devices per Initiator Port, scan for device file changes. Execute the ioscan -fnc /dev/pt command as a root user. By default, /dev/pt/ptx devices are accessible by root users only. If backups are run as a nonroot user, first grant the backup user permissions to access these device files using chmod o +rwx /dev/pt/pt*. For finer grained permissions, determine which /dev/pt/ptx device files relate to Catalyst over Fibre Channel using: /usr/sbin/scsimgr -p get_attr all_lun -a device_file -a dev_type -a pid grep StoreOnce Then use chmod o+rwx on the appropriate devices. Solaris Clients StoreOnce Catalyst over Fibre Channel presents a device type of Processor. On Solaris, these devices files are created in /dev/scsi/processor/*. After zoning the devices or changing the Number of Devices per Initiator Port, scan for device file changes. Execute the following commands as a root user. These operations will not affect Fibre Channel devices already configured on the Solaris system. add_drv -vi scsiclass,03 sgen update_drv -vai scsiclass,03 sgen By default, /dev/scsi/processor/* devices are accessible by root users only. If backups are run as a non-root user, first grant the backup user permissions to access these device files using chmod -R o +rwx /dev/scsi/processor/*. For finer grained permissions, determine which /dev/scsi/processor/* device files relate to Catalyst over Fibre Channel using: for i in /dev/scsi/processor/*; do echo $i; ls $i; luxadm inq $i egrep "Vendor Product"; echo; done Then use chmod -R o+rwx on the appropriate devices. StoreOnce Catalyst Stores page Select StoreOnce Catalyst Stores from the Navigator to display the Stores page and tabs. The top half of the Stores page shows all stores configured for the couplet. The Service Set is shown in the right-hand column. Click on a store to display its details in the lower half of the page. Users with an administrator login may edit these settings or delete stores, and may also create new stores. The lower half of the page has the following tabs: StoreOnce Catalyst Stores page 87

88 Store details tab on page 88, includes functions for creating and managing stores Permissions tab (administrators only) on page 94 Item summary tab on page 94 Data jobs tab on page 95 Outbound copy jobs tab on page 99 Inbound copy jobs tab on page 103 See also: System information messages on page 106 Table 31: Store fields Field Name Version Status Created Number of Catalyst Items User Data Stored Size On Disk Dedupe Ratio Service Set Description The name of the store. This may be created manually through the StoreOnce System or generated by the backup application. On a Federated store, you can use the expand icon to list the members of the Federation. However, it is best to view information on the Federation as a whole rather than viewing information on an individual member. The version of the store. The status of the store. When you create a store you will see the status change until it becomes Online. The date and time that the store was created. The number of StoreOnce Catalyst items contained within the store. The amount of data stored. This is the amount of data that the user has backed up and reconciles with the logical data recorded on the backup application. The size of the store on the disk. This is the physical disk space consumed; the actual size after deduplication. The dedupe ratio which is the ratio of duplicate data against new data identified in the data job. The Service Set (or Sets, if the store is Federated) on which the store resides. Store details tab The Store Details tab displays the details that were specified when the store was created. Users with an administrator login may create and edit store details and delete stores. 88 Store details tab

89 Table 32: Store details Field Name Description Data Job Retention Period (Days) Inbound Copy Job Log Retention Period (Days) Outbound Copy Job Log Retention Period (Days) Primary (Default) Transfer Policy Secondary Transfer Policy Description The name of the store. This may be created manually through the StoreOnce System or generated by the backup application. A description for the store. The retention period for information about data jobs. This information is displayed on the Data Jobs tab, which provides a log of all data job activity. The default is 90 days. The retention period for information about inbound copy jobs. This information is displayed on the Inbound Copy Jobs tab, which provides a log of all data job activity. The default is 90 days. The retention period for information about outbound copy jobs. This information is displayed on the Outbound Copy Jobs tab, which provides a log of all data job activity. The default is 90 days. For a non-federated store: This may be High or Low. High means all data is sent from the media server and deduplicated on the StoreOnce System. This can also be described as target-side deduplication. Low means that the media server deduplicates the data and sends only unique data. This can also be described as source-side deduplication. The primary transfer policy is the default transfer policy for the server. Each media server may be configured individually to use the most efficient transfer policy. As long as the two transfer policies have different values, the media server will determine which is the most bandwidth efficient transfer policy to use. For a Federated store: The value is set to Low Bandwidth and cannot be changed. For a non-federated store : This may be High or Low (see definitions in row above) and is normally the opposite to the Primary transfer policy so that the media server can choose to use which is most appropriate. However, if you wish to enforce the transfer policy that the media server uses, set both Primary and Secondary transfer policies to the same value. For a Federated store : The value is set to Low Bandwidth and cannot be changed. Table Continued StoreOnce Catalyst functions 89

90 Field Physical Data Size Quota Description This quota is for the amount of data actually written to disk after deduplication. If the quota is enabled and the quota limit is reached, backups will fail in order to prevent the quota from being exceeded. The quota allows you to partition the physical capacity of the appliance between various users (and users with a better deduplication ratio can store more data). If capacity management is required, Hewlett Packard Enterprise recommends configuring backup applications with quotas to reroute to another device or to postpone backups to prevent backups from failing unexpectedly. When a StoreOnce Catalyst store reaches its quota, the status of the StoreOnce Catalyst store will change to Online - Critical. The StoreOnce Catalyst Status will also change to Fault. Restores from that store are permitted but new backups will fail. When the quota is no longer met, either by increasing the quota or by expiring backups, the StoreOnce Catalyst store status and the overall StoreOnce Catalyst status will return to the Running state. If you use this feature in conjunction with Client-Permissions to control a client s access to the StoreOnce Catalyst store, you can effectively define how much space a particular user is allowed to use on the StoreOnce System. With many users using the same system, this allows you to control how much disk space is available to individual users. Table Continued 90 StoreOnce Catalyst functions

91 Field Logical Data Size Quota Description This quota is for the amount of data a user sends to the device before deduplication. If the quota is enabled and the quota limit is reached, backups will fail in order to prevent the quota from being exceeded. This allows you to provide a service to back up a particular amount of user data. For example, set this when you charge customers per TB of user data protected. If capacity management is required, Hewlett Packard Enterprise recommends configuring backup applications with quotas to reroute to another device or to postpone backups to prevent backups from failing unexpectedly. When a StoreOnce Catalyst store reaches its quota, the status of the StoreOnce Catalyst store will change to Online - Critical. The StoreOnce Catalyst Status will also change to Fault. Restores from that store are permitted but new backups will fail. When the quota is no longer met, either by increasing the quota or by expiring backups, the StoreOnce Catalyst store status and the overall StoreOnce Catalyst status will return to the Running state. The logical data size of a StoreOnce Catalyst item is updated at every 1 GB of physical data stored or when a StoreOnce Catalyst item is closed. In backups with high deduplication ratios it is possible for a logical data size quota to be exceeded before the store prevents further backups. This does not affect the physical data size quota which updates more frequently. For example, if a logical data quota size is set to 1 TB and the backup being performed has a deduplication ratio of 10:1, it is possible that the logical data size quota will be exceeded by 10 GB. If you use this feature in conjunction with Client-Permissions to control a client s access to the StoreOnce Catalyst store, you can effectively define how much space a particular user is allowed to use on the StoreOnce System. With many users using the same system, this allows you to control how much disk space is available to individual users. Store Encryption Enabled Secure Erase Mode Store is Federated Check this box to enable data encryption. Encryption cannot be enabled after a store is created; it must be enabled at store creation. Also, encryption cannot be disabled once it has been set for a store. If enabled, encryption will be performed prior to writing data to disk for this store. For a Federated store: Store Encryption must be enabled (if licensed) on all service sets in the team or disabled on all service sets in the team. Once the library is created and the correct license is applied, the Secure Erase Mode box appears on the Catalyst Store Details tab. The selection box defaults to None, meaning Secure Erase is disabled. To enable Secure Erase, select the preferred number of Overwrite Passes (1, 3, 5, or 7). If enabled, this feature allows you to securely erase confidential data that may have unintentionally been backed up as part of a regular backup job. See Security features on page 179 and License management on page 170 for more information. This is checked if the store is Federated (configured at the time of store creation). Table Continued StoreOnce Catalyst functions 91

92 Field Number of Federation Members Federation Member Service Sets Federation Member list Description The number of members (service sets) in the Federation. This only displays if a Federated store is selected. The specific service sets that make up the Federation. This only displays if a Federated store is selected. This lists the members of the Federation. This only displays if a Federated store is selected. For each member it displays: The Status of the service set Whether the service set is Write-Disabled or Write-Enabled. When marked Write-Disabled, no new StoreOnce Catalyst items will be created on the Federation member although you can still restore existing StoreOnce Catalyst items from the member. This is primarily used to expire a Federation member. For example, to remove the data associated with a service set you can configure a member as Write- Disabled, allow or force all StoreOnce Catalyst items to expire, and then remove the member from the Federation. To create a new store (administrators only) This operates the same for stores and Federated stores. 1. Click Create at the top right of the StoreOnce Catalyst Stores page. 2. Select a service set for the new store and click OK. The information on the service set tells you how many stores are still available. To create a Federated store, select multiple service sets. These become the Federation members. 3. Provide the store details. If the proper license was applied, an Encryption Enabled check box is displayed. To enable encryption for the new store, you must do it at this time by checking the Encryption Enabled box. See Security features on page 179 and License management on page 170 for more information. 4. When you have completed the store details, click Create. 5. The store is created and displayed in the Stores list where its status changes from Creating to Online. To enable the Secure Erase feature, edit the store details. To edit store details (administrators only) This operates the same for stores and Federated stores. Select the store in the list to display its details and then click Edit. You cannot edit a Federated store if any of the members are offline. Amend details as appropriate and click Update to apply the changes. 92 StoreOnce Catalyst functions

93 Once the store is created and if the proper license is applied, a Secure Erase Mode box is displayed. If enabled, this feature allows you to securely erase confidential data that may have unintentionally been backed up as part of a regular backup job. See Security features on page 179 and License management on page 170 for more information. To delete a store (administrators only) This operates the same for stores and Federated stores. Select the required store and then click Delete in the Store Details tab to delete it. You will be prompted to confirm the deletion; click Delete to delete the store, or click Cancel to cancel the command. You cannot delete a Federated store if any of the members are offline. To change a StoreOnce Catalyst store to a Federated store (administrators only) Select the StoreOnce Catalyst store from the top of the Stores page. Click Expand. Select the service sets to include in the Federation. The store is now Federated. To add members to a Federated store (administrators only) Select the Federated store from the top of the Stores page. Click Expand. Select the additional service sets to include in the Federation. The new service sets are immediately added to the Federation. To remove members from a Federated store (administrators only) Select the Federated store from the top of the Stores page. Click Contract. Deselect any service sets to remove from the Federation. WARNING: To prevent data loss, ensure the Number of Catalyst Items (at the top of the Stores page) is zero for the service set before removing it. Deleting a Federation member containing items means those backups cannot be restored. Click OK. In the confirmation window, click Remove. If the Federation member contains items, you get a second confirmation window; click Remove. If the Federation member contains items, click Delete in the next two confirmation windows. The service set is immediately removed from the Federation. To forcibly delete a member from a Federated store (administrators only) Select and expand the Federated store from the top of the Stores page. Select the member from the Federation Member list. Click Delete. The service set is immediately removed from the Federation. IMPORTANT: Deleting an individual Federation member will result in data loss. Only use this option if data loss is not a concern. Hewlett Packard Enterprise recommends using the Contract method instead. StoreOnce Catalyst functions 93

94 Permissions tab (administrators only) This tab is only active if the Client Access Permission Checking box has been enabled on the Settings tab. The Client list is only populated with individual clients or client groupings if you configured clients on the Clients tab. You can set the Physical Data Size Quota and Logical Data Size Quota (on the Store Details tab) to use in conjunction with Client-Permissions. This allows you to effectively define how much space a particular user is allowed to use on the StoreOnce System. This may be useful with many users using the same system and you wish to control how much disk space is available to individual users. 1. Click Edit to change the permissions. You cannot edit the permissions of an individual Federation member. 2. The default setting is No Access, which means that the client cannot access the store for data or copy jobs. Click the appropriate Access button for the clients who need access, then click Update. Item summary tab This tab provides summary details of each item in the store. Items will not be displayed for a Federated store if any of the members are offline. Use the filter options to locate the required item(s). By default, 50 items are displayed per page. This can be changed from the Items Per Page dropdown. Use the scroll bar to scroll through all items on the page or use the Prev or Next buttons to display more pages. Once items are displayed, administrator users may use the Delete button to delete a selected item. This is not recommended. It is better to let the backup application remove items to ensure integrity within backup catalog. Only use Delete as a last resort. Items cannot be deleted on a Federated store. All users may use the buttons under the item details to show Related Data Jobs, Outbound Copy Jobs, or Inbound Copy Jobs for the selected item. This tab provides a report; it is not automatically refreshed. 1. If necessary, click + to display the filter options. Check the boxes against the options that you wish to use. Specify as many options as possible to narrow the search results. Wild cards or boolean logic (AND/OR filters) are not supported. The item name is a unique identifier that is always defined on the backup application. Sub-string matches are supported, so the filter will return any item that contains the character string that has been entered. With Item Name you can also specify that it should be an Exact Match. 94 Permissions tab (administrators only)

95 With the Created and Last Modified fields, enter a range of dates. The Tag Lists allow you to filter any tags that the client may have added to the data. You may enter as many tags as required; they should be space separated, with no commas. If you leave All Match unchecked, the filter will retrieve all items that have any of the tags specified. If you check All Match, it will retrieve only those items that have all the tags specified. 2. Click Show Items. A report listing the items is displayed. Table 33: Item summary fields Field Item Name Created Last Modified Tag List Data Size Description The name of the item. This is the name that is generated by the backup application. The date that the item was created. The date that the item was last modified. A list of any tags to include or exclude when searching for the item. The size of the data within the item. 3. Click on an item within a list to display further details about it in the lower part of the page. Table 34: Item summary details Field Item Name Created Tag List Last Modified Data Size Version Meta Data Size Dedupe Block Size Description The name of the item. This is the name that is generated by the backup application. The date that the item was created. A list of any tags that are attached to this item. The date that the item was last modified. The size of the data within the item. The version of the item. The size of the meta data associated with the item. Meta data is created by the backup application. The dedupe block size. This value is only populated if the backup application uses Fixed block StoreOnce Catalyst chunking. Data jobs tab This tab provides a log with details about data jobs for the selected store. Data jobs tab 95

96 Data jobs will not be displayed for a Federated store if any of the members are offline. Use the filter options to locate the required job(s). By default, 50 items are displayed per page. This may be changed from the Items Per Page dropdown. Either use the scroll bar to scroll through all items on the page or use the Prev or Next buttons to display more pages. Values that you set in Settings control how long data jobs are retained for (default is 90 days). This tab provides a report; it is not automatically refreshed. 1. If necessary, click + to display the filter options. Check the boxes against the options that you wish to use. Specify as many options as possible to narrow the search. Wild cards and boolean logic (AND/OR filters) are not supported. The name of the item is a unique identifier that is always defined on the backup application. Similarly, the client name is defined on the backup application. Best practice is to ensure that client names are also meaningful for use in searches on the StoreOnce System. Sub-string matches are supported, so the filter will return any item that contains the character string that has been entered. With Item Name and Client you can also specify that it should be an Exact Match. With the Start Time and End Time fields, enter a range of dates and times. Select a Status which may be Running, Completed or Cancelled. 2. Click Show Jobs. A report listing data jobs is displayed. Use the Sort Results option to sort the results alphabetically. 96 StoreOnce Catalyst functions

97 Table 35: Data job fields Field Item Name Status Description The name of the item within data job. This name is created by the backup application. Each data job may have multiple items. The status of the data job item, which may be: Running: In progress Completed: The item has completed successfully, this does not mean the data job has completed, only the item, and does not reconcile with the backup application job completion status Cancelled: The Status Information provides more details, for example, the data connection has been lost between the StoreOnce System and the media server (this is unlikely to occur) Unexpected error: The StoreOnce System has experienced a problem while processing the item Insufficient disk space: It will be necessary to clear some disk space or add more storage Link failure: IP connectivity has been lost and the backup application must retry the job System shutdown: System has been shut down The backup application must be configured to tidy up any incomplete or orphaned items before retrying the job. Data Written The amount of user data that was written. This reconciles with the information in the backup application's log, but note that a backup job may span multiple items. Write Throughput The write throughput speed, expressed in MB/s, is the logical bandwidth. The % bandwidth saving depends upon whether the store has been configured for source-side deduplication with a low-bandwidth transfer policy, or target-side deduplication with a high-bandwidth transfer policy. See Store details tab on page 88. Data Read Read Throughput Client Identifier Start Time End Time The amount of user data that was read. The read throughput speed. This only has one value because read throughput is always high throughput without any % saving. The client that initiated the data job, as defined on the backup application. The IP address in the brackets is for information and not part of the client name. It is best practice to ensure that a meaningful name is given to the client within the backup application. If no client was defined on the backup application, only the IP address is shown. The time the job started. The time the job ended. 3. Click on an item within a list to display further details about it in the lower part of the page. StoreOnce Catalyst functions 97

98 Table 36: Data job details Field Item Name Status Description The name of the item within data job. This name is created by the backup application. Each data job may have multiple items. The status of the data job item, as described in the previous table. The backup application must be configured to tidy up any incomplete or orphaned items before retrying the job. Status Information Start Time End Time Client Identifier Client Address Application Identifier Deduplication Ratio Data Written Write Duration Write Throughput Data Transferred Bandwidth Utilisation Bandwidth Saving Data Read Status information, which explains the reason for the Status reported. The time the job started. The time the job ended. A name that identifies the client user who created the item. Displays the IP address if the job was over Ethernet or the World Wide Port Name/World Wide Node Name if the job was over Fibre Channel of the server that created the item. The name of the application that created the item. The deduplication ratio. The amount of user data that was written. This reconciles with the information in the backup application's log, but note that a backup job may span multiple items. The length of time that data was written. The write throughput speed, expressed in MB/s, is the logical bandwidth. The amount of data transferred. The bandwidth utilisation in Mb/s. This is the physical bandwidth consumed. The amount of bandwidth saved. The % bandwidth saving depends upon whether the store has been configured for source-side deduplication with a lowbandwidth transfer policy, or target-side deduplication with a high-bandwidth transfer policy. See Store details tab on page 88. The amount of data read. Read Duration The length of time that data was read. Table Continued 98 StoreOnce Catalyst functions

99 Field Read Throughput Transport Protocol Description The read throughput speed. Read throughput is always high throughput without any % saving. Specifies whether the backup/restore was performed using Fibre Channel, TCP- IP or the StoreOnce Internal Network. Outbound copy jobs tab This tab provides a log with details of all outbound copy jobs for the selected store. Copy jobs will not be displayed for a Federated store if any of the members are offline. Use the filter options to locate the required jobs. By default, 50 items are displayed per page. This may be changed from the Items per Page dropdown. Either use the scroll bar to scroll through all items on the page; or use the Prev or Next buttons to display more pages. Values that you set in Settings control how long outbound copy jobs are retained for (default is 90 days). For a Federated store, select which service set is the Source Appliance. This tab provides a report; it is not automatically refreshed. 1. If necessary, click + to display the filter options. Check the boxes against the options that you wish to use. Specify as many options as possible to narrow the search. Wild cards and boolean logic (AND/OR filters) are not supported. The name of the item is a unique identifier that is always defined on the backup application. Similarly, the client name is defined on the backup application. Best practice is to ensure that client names are also meaningful for use in searches on the StoreOnce System. Sub-string matches are supported, so the filter will return any item that contains the character string that has been entered. With Item Name and Client you can also specify that it should be an Exact Match. With the Start Time and End Time fields, enter a range of dates and times. Select a Status which may be Pending, Running, Paused, Completed, or Cancelled. 2. Click Show Jobs. A report listing outbound copy jobs is displayed. Use the Sort Results option to sort the results alphabetically. Outbound copy jobs tab 99

100 Table 37: Outbound copy job fields Field Item Name Status Description The name of the item being copied from the outbound copy job. This name is created by the backup application. The status of the outbound copy job, which may be Queued, Paused, Running, Cancelled, or Completed. If the status information displays, no further information is available. The backup application must be configured to tidy up any incomplete or orphaned items before retrying the job. Data Size Copy Throughput Target Appliance Target Store Target Item Name Client Identifier Queued Time Started Time Stopped Time The amount of data to be copied in the copy job. The copy speed. The address of the target server. The target is the Service Set on the other StoreOnce System to which the job is being copied from the Service Set on this StoreOnce System. All target details are specified by the backup application when the outbound copy job is created. The name of the target store on the StoreOnce System to which the job is being copied. The name of the target item on the StoreOnce System to which the job is being copied. All item names are defined by the backup application. The client that initiated the outbound copy job. The client name is defined in the backup application. The time the job was queued. The time the job started. The time the job ended. 3. Click on an item within a list to display further details about it in the lower part of the page. 100 StoreOnce Catalyst functions

101 Table 38: Outbound copy job fields Field Item Name Status Description The name of the item being copied from the outbound copy job. This name is created by the backup application. The status of the outbound copy job, which may be Queued, Paused, Running, Cancelled, or Completed. If the status information displays, no further information is available. The backup application must be configured to tidy up any incomplete or orphaned items before retrying the job. Status Information Percent Complete Client Identifier Client Address Application Identifier Queued Time Started Time Stopped Time Estimated Completion Time Target Appliance Target Store Target Item Name Status information. This will be a unless the job has been cancelled or paused. See System information messages on page 106 for more information about events that may cause a job to be cancelled or paused. The percentage of the copy job that has been completed. The client that initiated the outbound copy job. The client name is defined in the backup application. Displays the IP address if the job was over Ethernet or the World Wide Port Name/World Wide Node Name if the job was over Fibre Channel of the server that created the item. The name of the application that created the item. The time the copy job was queued. The time the copy job was started. The time the job ended. The estimated completion time, if the copy job is still running. The address of the target server. The target is the Service Set on the other StoreOnce System to which the job is being copied from the Service Set on this StoreOnce System. All target details are specified by the backup application when the outbound copy job is created. The name of the target store on the StoreOnce System to which the job is being copied. The name of the target item on the StoreOnce System to which the job is being copied. All item names are defined by the backup application. Table Continued StoreOnce Catalyst functions 101

102 Field Copy Throughput Source Item Size Source Item Last Modified Source Item Copy Offset Source Item Copy Size Destination Item Copy Offset Copy Duration Data Copied Bandwidth Utilisation Bandwidth Saving Unsuccessful Retry Attempts Next Copy Attempt Time Copy Operation Cancelled Transport Protocol Description The copy speed. The size of the source item to be copied; this may be larger than the data size value (but no smaller). The date that the source item was last modified. This is useful if you need to check whether the source item might have been modified during the copy attempt. An error message is also generated if the source item is modified whilst copying. This identifies where the data to be copied occurs within the source item. This identifies the size of the data to be copied within the source item. This identifies where the data to be copied will be placed within the destination item. The amount of time taken to copy the data. The amount of data copied, which will match the data size. The bandwidth utilization in Mb/s. This is the physical bandwidth consumed. The amount of bandwidth saved. The % bandwidth saving depends upon whether the store has been configured for source-side deduplication with a lowbandwidth transfer policy, or target-side deduplication with a high-bandwidth transfer policy. See Store details tab on page 88. If there are multiple unsuccessful attempts, a network link may be down or a blackout window may be scheduled. This is the time that the next copy will be attempted, if the previous one was unsuccessful. This indicates whether the user has cancelled the copy job or not. Specifies whether the copy was performed using Fibre Channel, TCP-IP or the StoreOnce Internal Network. To cancel a copy job Hewlett Packard Enterprise recommends canceling copy jobs via the backup application and only using the GUI as a last resort. This ensures that the backup application catalog stays in sync with the backup images. Select the job to be cancelled in the outbound copy job list. Click Cancel Job. At the confirmation prompt, click OK. 102 StoreOnce Catalyst functions

103 Inbound copy jobs tab This tab provides a log with details about inbound copy jobs for the selected store. Copy jobs will not be displayed for a Federated store if any of the members are offline. Use the filter options to locate the required jobs. By default, 50 items are displayed per page. This may be changed from the Items per Page dropdown. Either use the scroll bar to scroll through all items on the page; or use the Prev or Next buttons to display more pages. Values that you set in Settings control how long inbound copy jobs are retained for (default is 90 days). For a Federated store, select which service set is the Target Appliance. This tab provides a report; it is not automatically refreshed. 1. If necessary click + to display the filter options. Check the boxes against the options that you wish to use. Specify as many options as possible to narrow the search. Wild cards and boolean logic (AND/OR filters) are not supported. The name of the item is a unique identifier that is always defined on the backup application. Similarly, the client name is defined on the backup application. Best practice is to ensure that names are also meaningful for use in searches on the StoreOnce System. Sub-string matches are supported, so the filter will return any item that contains the character string that has been entered. With Item Name and Client you can also specify that it should be an Exact Match. With the Start Time and End Time fields, enter a range of dates and times. Select a Status which may be Pending, Running, Paused, Completed, or Cancelled. 2. Click Show Jobs. A report listing inbound copy jobs is displayed. Use the Sort Results option to sort the results alphabetically. Table 39: Inbound copy job fields Field Item Name Status Data Size Description The name of the item being copied to the inbound copy job. This name is created by the backup application. The status of the inbound copy job, which may be Queued, Paused, Running, Cancelled, or Completed. The amount of data in the copy job. Copy Throughput The copy speed. Table Continued Inbound copy jobs tab 103

104 Field Source Appliance Source Store Description The address of the source appliance. The source is the Service Set on the StoreOnce System from which the job is being copied to a Service Set on this StoreOnce System. The name of the source store for the inbound copy job. Source Item Name The name of the source item. All item names are defined by the backup application. Client Identifier Queued Time Started Time Stopped Time The client that initiated the inbound copy job. The client name is defined in the backup application. The time the job was queued. The time the job started. The time the job ended. 3. Click on an item within a list to display further details about it in the lower part of the page. Table 40: Inbound copy job fields Field Item Name Status Description The name of the item being copied to the inbound copy job. This name is created by the backup application. The status of the inbound copy job, which may be Queued, Paused, Running, Cancelled, or Completed. If the status information displays, no further information is available. The backup application must be configured to tidy up any incomplete or orphaned items before retrying the job. Status Information Percent Complete Client Identifier Client Address Application Identifier This will be a unless the job has been cancelled or paused. The percentage of the copy job that has been completed. The client that initiated the inbound copy job. The client name is defined in the backup application. Displays the IP address if the job was over Ethernet or the World Wide Port Name/World Wide Node Name if the job was over Fibre Channel of the server that created the item. The name of the application that created the item. Table Continued 104 StoreOnce Catalyst functions

105 Field Queued Time Started Time Stopped Time Estimated Completion Time Source Appliance Source Store Description The time the copy job was queued. The time the copy job was started. The time the job ended. The estimated completion time, if the copy job is still running. The address of the source server. The source is the Service Set on the StoreOnce System from which the job is being copied to a Service Set on this StoreOnce System. The name of the source store on the StoreOnce System from which the job is being copied. Source Item Name The name of the source item on the StoreOnce System from which the job is being copied. All item names are defined by the backup application. Copy Throughput Source Item Size Source Item Last Modified Source Item Copy Offset Source Item Copy Size Destination Item Copy Offset Copy Duration Data Copied Bandwidth Utilisation Bandwidth Saving The copy speed. The size of the source item to be copied; this may be larger than the data size value (but no smaller). The date that the source item was last modified. This is useful if you need to check whether the source item might have been modified during the copy attempt. An error message is also generated if the source item is modified whilst copying. This identifies where the data to be copied occurs within the source item. This identifies the size of the data to be copied within the source item. This identifies where the data to be copied will be placed within the destination item. The amount of time taken to copy the data. The amount of data copied, which will match the data size. The bandwidth utilization in Mb/s. This is the physical bandwidth consumed. The amount of bandwidth saved. The % bandwidth saving depends upon whether the store has been configured for source-side deduplication with a lowbandwidth transfer policy, or target-side deduplication with a high-bandwidth transfer policy. See Store details tab on page 88 Table Continued StoreOnce Catalyst functions 105

106 Field Copy Operation Cancelled Transport Protocol Description This indicates whether the user has cancelled the copy job or not. Specifies whether the copy was performed using Fibre Channel, TCP-IP or the StoreOnce Internal Network. To cancel a copy job Hewlett Packard Enterprise recommends cancelling copy jobs via the backup application and only use the GUI as a last resort. This ensures that the backup application catalog stays in sync with the backup images. If you use the GUI to cancel an inbound copy job, it is recommended to cancel the job in the source outbound copy jobs list first. Select the job to be cancelled in the inbound copy job list. Click Cancel Job. At the confirmation prompt click OK. System information messages A job may have been cancelled for the following reasons that will be shown in the Status Information field: Cancelled By User: the copy job was cancelled either through the backup application or via the StoreOnce Management GUI. Unexpected Error: Contact Hewlett Packard Enterprise Support. Lock Release Request: the destination StoreOnce Catalyst item was opened by another process. Most backup applications prevent this from occurring. Out of Space: There is insufficient disk space. Take one of the following actions: 1. Expire backups that are no longer required and wait for housekeeping to free up space. 2. Purchase additional storage. 3. Perform the copy to a different store that has available free capacity. Not Licensed: The destination store does not have a license in place to accept copies for this backup application. Check the installed licenses and resubmit the copy job once the license is applied. Permission Denied: The client requesting the copy no longer has permission to access the destination store. Check access permissions on the destination appliance then resubmit the copy job. ObjectStore Not Present: The destination store is no longer available. Check the destination appliance and ensure the store exists. This error may occur if a store is deleted whilst copies are still queued. ObjectStore Origin Same As Destination: Backups are being copied within a store. Most backup applications prevent this from occurring. Object Not Present: The copy object is no longer available. Check the backup application setup. Server Incorrect Address Or Protocol: The backup application will validate input. If this message occurs, check the backup application configuration. Object Extent or Offset Invalid: The backup application tried to copy a backup incorrectly. Check the backup application setup. Object Changed Whilst Queued or Paused: Check the backup policy; their backup application is making changes to StoreOnce Catalyst items when it should not. Try the copy again within the backup application. Object Not Ready: Contact Hewlett Packard Enterprise Support. Job State Inconsistency Found: Contact Hewlett Packard Enterprise Support. 106 System information messages

107 A job may have been paused for the following reasons: Link failure: The network between the appliances is down. Check the network connectivity. Once the connection is re-established, the copy will automatically continue. Shutdown: The source or destination appliance was shutdown. Once the appliance is back online, the copy will automatically continue. Blackout window: A blackout window is in effect on the source appliance. Once the blackout window expires, the copy will automatically continue. Server Too Busy: The source or destination appliance is too busy to run the copy job. When resources are available, the copy job will be automatically restarted. System shutdown: The system has been shut down. StoreOnce Catalyst Best Practices Do not delete backup Catalyst items (backups) directly from the StoreOnce GUI. Instead, use the backup application to expire the backup items. Using the backup application ensures application consistency. Target similar data types to dedicated StoreOnce Catalyst stores and avoid mixing datatypes within a StoreOnce Catalyst store. Backups of differing data types, such as two different database types, will deduplicate against each other very little. Separating different data types into separate StoreOnce Catalyst stores reduces the store complexity leading to optimum long-term performance. When performing low bandwidth StoreOnce Catalyst backups, spread the number of backup sessions across multiple media servers where possible. Distributing the streams across multiple media servers reduces the possibility of a media server becoming a performance bottleneck. Where possible, split a backup session into multiple backup streams. Allowing StoreOnce to process multiple backups streams in parallel will increase backup performance. When using ProLiant media servers and database servers for low bandwidth StoreOnce Catalyst, enable HPE Static High Performance Mode via the ProLiant Power Management settings for the best backup performance. This setting is not the default. Enable StoreOnce Catalyst client permission checking on each StoreOnce service set to ensure that client data access is restricted. When using StoreOnce Catalyst over Fibre Channel, ensure the Number of Devices per Login is set appropriately for StoreOnce Catalyst Copy, Windows, Linux, HPE-UX, AIX, and Solaris media servers and database servers. See Initial configuration for details. When using StoreOnce Catalyst over Fibre Channel, ensure that the correct access permissions have been set on the StoreOnce Catalyst over Fibre Channel client device files, if running as a non-root or non-administrator user. See Client configurations for details. To ensure the backup application and the Fibre Channel (if applicable) configuration being used is supported, refer to the HPE Data Availability, Protection and Retention Compatibility Matrix. Ensure StoreOnce Catalyst client log levels are set to the default ERROR log level for optimum performance. When performing backups with StoreOnce Catalyst over Fibre Channel or StoreOnce Catalyst Ethernet backups over LAN, StoreOnce Catalyst compression and checksums can be set to DISABLED via the backup application configuration file. If performing StoreOnce Catalyst Ethernet backups over WAN, Catalyst compression and checksums must be ENABLED (the default) via the backup application (plug-in) configuration file. If using StoreOnce Federated Catalyst, consider that backups to StoreOnce Federated Catalyst stores will capacity balance across the available Federated storage. Therefore, a StoreOnce service set running a VTL or NAS shares as well as a StoreOnce Federated Catalyst store will lead to an imbalanced Federated Catalyst store. Federated Catalyst is most suited to StoreOnce Federated configurations only. When configuring a backup application to use a Fully Qualified Domain Name (FQDN) address for a StoreOnce, ensure that the FQDN is fully registered with a Domain Name Server; do not use local host file entries. This is important when making use of StoreOnce Catalyst Copy jobs because the source StoreOnce appliance will use the FQDN to communicate directly with the target StoreOnce StoreOnce Catalyst Best Practices 107

108 appliance. Using local client host file entries will result in the source StoreOnce appliance not being able to resolve the target FQDN address. 108 StoreOnce Catalyst functions

109 Housekeeping function IMPORTANT: Housekeeping is an important process to maximize the deduplication efficiency of the appliance. You must ensure that the housekeeping process has enough time to complete. Running backup, restore, replication, and StoreOnce Catalyst Store operations with no break (that is, 24 hours a day) can result in housekeeping never completing. The Housekeeping page: Contains tabs that display housekeeping statistics and graphs, see The Housekeeping page on page 109 Allows administrators to configure housekeeping blackout windows, see Configuring blackout windows on page 112 Allows administrators to pause housekeeping, see Pausing housekeeping on page 112 With the current version of the software there are no equivalent StoreOnce CLI commands available for the tasks described in this section. The Housekeeping page Select Housekeeping in the Navigator to display current and historical housekeeping activity. The following tabs display housekeeping statistics and graphs for the backup system or for the selected service set: Overall (default), Libraries, Shares, and StoreOnce Catalyst. Users with an administrator login can also configure blackout windows for housekeeping on the Blackout Windows tab. Housekeeping statistics Use the housekeeping statistics to monitor the current housekeeping activity. At the top of each tab, select a service set to display the statistics. Housekeeping function 109

110 Table 41: Overall tab housekeeping statistics Field Status Last Complete User data pending housekeeping Estimated disk space to reclaim Estimated time to completion Secure Erase data pending reclaim Description Status is one of the following: Running The housekeeping process is active. Starting The housekeeping process is starting up. Stopping The housekeeping process is shutting down. The status will include one of the following: Green check there are no warnings Amber warning the housekeeping queue has not been empty within the last 24 hours but has been empty within the last seven days Red alert the housekeeping queue has not been empty within the last seven days Warnings and alerts require further investigation because backup and replication performance is affected. The date and time that housekeeping last completely emptied the housekeeping queue. Data that has been deleted/overwritten but not yet cleared by housekeeping. The amount of disk space estimated to be reclaimed based on the amount of data to be deleted. This can change as jobs are processed. This field will display if there is not enough history available to make an estimate or if there is no housekeeping to do. The Estimated disk space to reclaim and the Estimated time to completion are based on historical trends. In the early stages of a retention lifecycle where data overwrite has only recently started to occur, or where a large amount of data is suddenly deleted, these estimates will be unrealistic until enough data is processed to improve the accuracy of the estimate. The estimated time until the current outstanding housekeeping will be processed based on the amount of data to be cleared by housekeeping. This field will display if there is not enough history available to make an estimate or if there is no housekeeping to do. Indicates whether there is any outstanding Secure Erase data (yes/no). See Security features for more information. Similar statistics are shown on the individual tabs for the different types of target devices. All tables are updated every five minutes. 110 Housekeeping function

111 Table 42: Libraries, Shares, and StoreOnce Catalyst tabs housekeeping statistics Column Libraries/Shares/ Catalyst Stores Status Secure Erase Mode Outstanding Secure Erase Pending Delete Estimated Reclaim Time to Complete Last Complete Description Identifies the device name See the "Overall tab housekeeping statistics" table. Indicates if the share is enabled for the Secure Erase feature. None means Secure Erase is not enabled. [x] Overwrite Passes means Secure Erase is enabled and indicates the number of times the data will be overwritten (1, 3, 5, or 7) when deleted. Even if a store is currently not in Secure Erase mode, it may be processing Secure Erase jobs that were present before the mode was changed. See Secure Erase data pending reclaim in the "Overall tab housekeeping statistics" table. See User data pending housekeeping in the "Overall tab housekeeping statistics" table. See Estimated disk space to reclaim in the "Overall tab housekeeping statistics" table. See Estimated time to completion in the "Overall tab housekeeping statistics" table. See the "Overall tab housekeeping statistics" table. Housekeeping graphs Use the housekeeping graphs to view historical housekeeping activity. Both graphs are updated every hour. At the top of each tab, select a service set to display the graphs. On all tabs, the graphics can be filtered by: Period Day, with hourly resolution for the last 24 hours Week, with a daily resolution for the last 7 days Month, with a daily resolution for the last 31 days Data All Secure housekeeping only Non-secure housekeeping only The top graph, Deleted User Data Pending Housekeeping, displays information about the data. It represents a snapshot of the size of the housekeeping queue (the amount of data deleted or overwritten but not yet processed) on the hour for the previous hour when viewing the "Day" time period, or at 12:00 midday for the last day when viewing the "Week" or "Month" time period. This graph may not show any data if all housekeeping is processed promptly and does not span over the end of the hour. However, if the amount of data shown is increasing and housekeeping never completes, consider removing or reducing blackout periods or scheduling backups more appropriately to allow housekeeping to complete. Housekeeping function 111

112 The bottom graph, Housekeeping Data Processed, displays information for: User Data Processed how much deleted data was processed as housekeeping since the last sample point Disk Space Reclaimed how much space recovery (secure and insecure) was realized by the processed data since the last sample point After a power cycle, the start of housekeeping is delayed for 15 minutes. The graphs will not recalculate during that time. As housekeeping resumes, the housekeeping queue is recalculated. The queue will show the number of jobs increasing even if new jobs are not being created. If housekeeping is paused (or in blackout), the queue will not display existing jobs until housekeeping is re-enabled. However, new housekeeping jobs will be reported. Configuring blackout windows Scheduling housekeeping blackout windows to cover the period during which backups are occurring can improve backup performance. Housekeeping blackout windows apply across the Service Set. On the Blackout Windows tab, click Edit to make the screen editable. Enter the appropriate Start of Restriction and End of Restriction times for each window. Verify the Apply First Time Restriction box is checked. This ensures the times that are specified are enabled. If it is not checked, the times will be ignored. Configure up to two windows for each day. Settings apply to all devices on the appliance or Service Set. TIP: Ideally, housekeeping blackout windows are set for those times when the StoreOnce System is running backup or replication or StoreOnce Catalyst copy. If you set an End of Restriction blackout window to 23.59, the blackout window will last until the end of the day (meaning, the window will end at ). Pausing housekeeping On the Blackout Windows tab, click Pause Housekeeping to pause the housekeeping process. This setting applies to all devices, libraries, and shares on the StoreOnce System. The pause is not retained if the power fails or the StoreOnce System is powered down. Do not leave housekeeping in the paused state for significant amounts of time; pause only as a maintenance tool. 112 Configuring blackout windows

113 StoreOnce reporting The following reporting options are specific to StoreOnce functions: Activity report on page 113 Reporting page on page 113 For more comprehensive StoreOnce reporting functions, see Reporting Central on page 127. In addition, StoreOnce Enterprise Manager is a standalone software application that provides basic management capabilities in a replication environment and manages multiple devices being replicated across multiple sites. Enterprise Manager also provides comprehensive reporting of StoreOnce performance and disk usage. The software, including documentation, can be downloaded free of charge from softwaredepot. Search for StoreOnce. The search results include StoreOnce System Software for all products, VSA evaluation files, and QR images for all hardware platforms, plus a link to StoreOnce Free Software. Click on StoreOnce Free Software to access the Enterprise Manager downloads. Activity report Select StoreOnce > Activity from the navigation tree to display the following system activity graphs: Backup from hosts to all target devices Replication and StoreOnce Catalyst copy between StoreOnce appliances The graphs represent logical throughput rates, not physical data transfer rates. If Replication or StoreOnce Catalyst bandwidth limiting is in use, these graphs will not peak at the physical bandwidth throttling value. (See Bandwidth Limiting tab on page 58 or StoreOnce Catalyst Bandwidth Limiting Windows tab on page 79, respectively.) These graphs update every five seconds and provide feedback about the activity on the StoreOnce System. Reporting page Select StoreOnce > Reporting in the Navigator to display reports. This page has four storage reporting tabs: Overall, Libraries, Shares, and StoreOnce Catalyst. On each tab, you have the option to export a CSV (comma separated value) file by clicking Export Disk Storage to CSV. The Overall tab CSV file provides information such as appliance serial numbers, type of device, name of device, time stamp, size on disk, and user data stored. On subsequent tabs you can generate a CSV file per store, share, or library. For example, choose any library and get its storage utilization over a specific period of time (week or month). Each tab allows selection of Data and/or the Period from drop-down boxes to specify the axes for the graph. Summary statistics are displayed at the foot of the page. The Data types are: Disk Storage Dedupe Ratio Disk Storage Daily Change Disk Storage Weekly Change The Period may be changed to Week or Month. StoreOnce reporting 113

114 Hardware page The Hardware page is present for all StoreOnce hardware products. This page provides a tree hierarchy which allows the user to monitor the status of installed hardware components. The layout of the Hardware tree varies depending on the StoreOnce model. There are three top-level items; one for the servers, one for the network switches, and one for the storage clusters. To navigate the hardware tree: The + sign indicates there are lower-level elements associated with an item; click to expand the hierarchy. Select an item in the hierarchy to view its details. Use the drop-down lists in each column to control the sort order of the items (ascending or descending alphabetically). Use the Columns item to display what information may be viewed for the item and which columns are currently selected. If any element within the Hardware tree has a warning or an error status, that status will be rolled up through the tree, with the appropriate icon displayed from the top level downwards. This makes it easier to locate the hardware item that is causing the problem. Hardware element fields The top-level Hardware page (Hardware Information) has the fields described in the following table. If a field is not relevant for a particular element, it is left blank. Lower level items in the Hardware hierarchy have a sub-set of these fields. Where appropriate, lower-level items also have a Location field that identifies where the item is located, for example which PCI slot or which disk bay. This field is particularly useful for troubleshooting and storage expansion. Name Dev ID Serial Number UUID Name Type Vendor System Name Status Value The device ID, StoreOnce. The serial number. The unique ID, normally the same as the device ID. The hardware component name for external reference, for example Memory Module. The type, for example DIMM for a Memory Module. The vendor, for example Hewlett Packard Enterprise for the server but unspecified for the temperature sensors within it. The system name, which is only relevant at the top level of Hardware. The Status of the element, useful for troubleshooting to identify elements that are down or degraded. Table Continued 114 Hardware page

115 Name Rolled Up Status Diagnostic Messages Additional Properties Value The worst status of the components in the hierarchy below this item. If there is a fault, drill down into the lower elements in the hierarchy to get further information. If alerting and SNMP have been enabled, messages will be sent to you automatically identifying the source of the problem. Contains any diagnostic messages. Varies according to the hardware element. Monitoring the StoreOnce System server The server hardware structure in the Navigator is not identical for all models. There is a server entry for each node in the StoreOnce System. For example, a single couplet system has two server entries; a four couplet system has eight server entries. The node name is included in the server field to aid identification. There is also a Failback This Server button at the top of the node page that allows you to bring a failed node back into a cluster, once the problem that caused the node to fail has been resolved. The following installed hardware components are included under the tree hierarchy for the server. If the Status or Rolled Up Status is Down or Degraded, look at the Diagnostic Messages for more details. Name CPU Fans HBA (PCI-E Slot x) Description Central processing unit Appliance fans This is the Fibre Channel card and PCI-E slot number where it is installed. Expand to see Ports information for this Fibre Channel card. There is a separate entry for each installed Fibre Channel card. ilo Modules Memory DIMMs NIC 1 NIC N (PCI-E Slot x) Integrated Lights-Out embedded server management Dual In-line memory module These are the 1GbE ports. Expand Ports to map physical ports to eth0, eth1, eth2 and eth3. This is the 10GbE card and the location of the PCI-E slot number where it is installed. Expand to see Ports information for this 10 GbE card. There is a separate entry for each installed 10 GbE card. Network Bonds Shows all available bonds Table Continued Monitoring the StoreOnce System server 115

116 Name Power Management Controllers Power Supplies Server Storage Storage Controller (PCI Slot n) Storage Controller (PCI Slot n) Description The PMCs perform the powering up and powering down of the processor Power supplies for the appliance These are the disks within the head server that contain the operating and file system; for most models, these disks are not used for data storage. Expand to see status information about the disks under Drive Enclosure, RAID information under Pool and Volumes, and the Storage Controller which is the P420 Smart Array on the motherboard. This is the first RAID controller card and the slot location where it is installed. The Name and UUID information is used to map the storage controller to the appropriate drawer/disk enclosure in the Storage Clusters section of the Hardware tree. This entry also contains information about the status of the cache module and super capacitor and the SAS ports on this RAID controller card that connect to the drawer in the disk enclosure. This is the second RAID controller card and the slot location where it is installed. The Name and UUID information is used to map the storage controller to the appropriate disk enclosure in the Storage Clusters section of the Hardware tree. This entry also contains information about the status of the cache module and super capacitor and the SAS ports on this RAID controller card that connect to the drawer in the disk enclosure. Not all models have two RAID controllers. Temperature sensors VLAN Provide temperature monitoring If VLAN subnets have been configured on the system, the VLAN tags that have been used are listed here. Differences between systems The number of NIC and HBA entries will vary depending on the installed optional hardware. VIF appears on StoreOnce 6500 and 6600 systems only: It provides the IP address of virtual interfaces associated with the selected server node Monitoring switches There is an entry for each switch that contains the IP address of the switch. The following installed hardware components are included under the tree hierarchy for each switch: Fan: The status of the two fans within the switch Power supply: The status of the two power supplies for each switch, each has its own entry Temperature sensors: The status of temperature sensors of the switch 116 Monitoring switches

117 Monitoring the storage The storage hardware structure is not identical for all models. The terminology and elements shown on the Storage Cluster section of the Hardware tree may be slightly different depending upon the model that you are using. This section contains a list of storage clusters. The name of the cluster clearly identifies the couplet to which it belongs, such as Couplet 1 Storage Cluster 1. The Storage Controller identifies the Name and Type of Monitoring Host. This relates to the server or node on which the Active Management Console is running. Each storage cluster contains the following items: Drive Enclosures: The following installed hardware components are included under the tree hierarchy for each enclosure: Drive: The physical hard disks. See Drives (enclosure) on page 117. Fan I/O module Power Supply Temperature Sensor Pools: The number of pools shown depends on the base storage and the number of capacity expansion kits installed. Controllers: This confirms the controller information for the controller card associated with the storage cluster. The name of the controller links back to the Storage Controller item in the Server section of the Hardware tree. The following installed hardware components are included under the tree hierarchy for each storage controller: I/O cache module Port Super Capacitor Drives (enclosure) This page provides details about the status of the hard disks within the head unit or enclosure. The status is either OK or Failed. This page also provides buttons to switch the disk's Beacon LED on and off. Table 43: Button functions on hard disk pages Button Turn Beacon LED On Turn Beacon LED Off Description Use this button to turn the Beacon LED of the selected disk on. This makes it easier to identify a failed or failing disk in an enclosure for replacement. Use this button to turn the Beacon LED of the selected disk off. Monitoring the storage 117

118 Storage configuration and reporting The Storage section in the GUI navigation panel provides information about disk utilization and also provides configuration tools to perform physical storage expansion. File System Report tab In the Navigator, select Storage. The File System Report tab opens by default. This tab provides details about the storage space usage at the file system level as well as the file system status. This tab shows free space and used space for a couplet, which added together make up the total storage space. This tab also shows the current node and the couplet to which the Service Set belongs. Couplet Free and Used Space values are redundantly listed for both Service Sets in each couplet. Table 44: Storage report parameters Field Service Set Current Node Couplet File System Total Capacity (on the couplet) File System Free Space (on the couplet) File System Used Space Description The name of the Service Set. The name of the current node serving this Service Set. The name of the couplet within the cluster to which this Service Set belongs. The total available capacity. The amount of free space. This value will decrease as data gets written to the appliance and increase when either housekeeping reclaims space or data is removed from configured stores. The amount of space that has been used. This value increases as data gets written on the file system and provides a true measurement of the amount of space used on the file system. Because some amount of meta data and other overhead is not maintained or calculated by all service sets or subsystems, the used space will not exactly equal the total capacity minus the free space. However, the difference is negligible. File System Status The status of the file system. See the "File system status and recommended actions" table for descriptions and recommended actions. 118 Storage configuration and reporting

119 Table 45: File system status and recommended actions Status Description Recommended Actions Mounted Not Mounted Segments On Backup Space Over The file system is up and running. The file system is not up and running, resulting in the service sets not starting. The file system is in a failed over state and some of the storage is owned by its failover node. Some or all of the storage components have reached 90% capacity utilization. None required. This is expected during upgrades or during the power on sequence. If the file system status is Unmounted at any other time, reboot the appliance or couplet. If this does not resolve issue, contact Hewlett Packard Enterprise Support. This may be as intended or as a result of a failure condition. Check and resolve any issues shown in the Events Log. To failback, run the StoreOnce CLI command system failback [specified service set]. This may be temporary or showing that the specified file system is approaching its capacity. Check the Events Log to see whether the file system is reaching capacity. If so, increase storage capacity or delete data from the file system to prevent backup failure. Segment Unavailable Some or all of the storage components have detected a problem. The file system is set to read-only mode to prevent further problems. This is due to the storage subsystem unexpectedly going offline. Check if the storage subsystem is online and then run the StoreOnce CLI command system recover filesystem. If the issue persists, contact Hewlett Packard Enterprise Support. Table Continued Storage configuration and reporting 119

120 Status Description Recommended Actions Segment Corrupted Usage Stale Some or all of the storage components have detected a problem. The health status has not been updated recently on some or all of the storage components. Contact Hewlett Packard Enterprise Support. This may be temporary and resolve itself. If it does not, reboot the appliance. If rebooting does not resolve the issue, contact Hewlett Packard Enterprise Support. Storage Configuration tab The Storage Configuration tab allows you to: View details about configured and unconfigured storage, and to see the raw storage capacity for your appliance:view storage configuration on page 120 Create volumes, expand the file system, delete storage configurations, and delete alien volumes or invalid RAID volumes:manage storage configuration on page 124 If your StoreOnce product supports capacity expansion, you will use the Storage Configuration tab to scan for the new storage and expand the capacity of your system. See also the Capacity Expansion guide for your product. View storage configuration Scanning for storage on page 120 Storage Configuration page parameters on page 120 Scanning for storage To check for newly attached storage expansions or view the current storage configuration you need to scan the appliance s attached storage. 1. Click Storage in the Navigator pane. Select the Storage Configuration tab. 2. An Information dialog box will appear that tells you to click Scan for Storage. Click OK. 3. Click Scan for Storage. You will see a storage scan in progress message. The scan can take up to 5 minutes. 4. The storage expansion configuration will be shown. 5. If no new storage expansions have been connected, you will receive a Warning dialog box saying that no additional storage devices were found. If this is unexpected, check cables and the power state of attached devices and try the scan again. Storage Configuration page parameters The top section of the Storage Configuration page is the Capacity section. This shows the physical storage configuration for your appliance. 120 Storage Configuration tab

121 Table 46: Capacity parameters Field Configured Raw Storage Licensed Storage Unconfigured Raw Storage Unlicensed Capacity Description The total amount of raw disk storage capacity (in TB) that is currently provisioned for use. The total capacity (in TB) that is licensed. This is the sum of all capacity licenses that have been applied. This also includes the base storage capacity that does not require a license. The amount of storage capacity (in TB) that is physically attached but has not yet been fully provisioned. The storage capacity (in TB) that requires additional licenses. If there is a Capacity License required, a hyperlink, Apply License, and a warning icon will appear alongside the Capacity License Required field. Clicking this link redirects to the License Management page. The Configured Storage table shows the storage hardware expansions that are currently configured. Each unit of expansion is shown separately. There are tabs for each couplet present in the cluster (tabs will only be present for couplets that exist). There are two entry rows in the table for each expansion because the storage is always added symmetrically between the two server nodes. Table 47: Configured and unconfigured storage parameters Field Description Hardware Enclosure Name RAID Cluster UUID Enclosure Serial Number Description The name given to the unit of storage being referenced. This name will either be Base Storage or Storage Expansion: Base disk storage for the product, which may be storage in the head server or in an external enclosure, based on the model Expansion disk storage comprised of a set of 11 disks in a storage enclosure The type of expansion enclosure containing the disks. The name of the specific enclosure. This may be the same as the model. The ID of the RAID cluster that connects to the storage expansion/ subexpansion. The serial number of the enclosure. Table Continued Storage configuration and reporting 121

122 Field Location Capacity Status Description The logical and physical location of the disks that comprise the storage expansion in the format: Port; Box; Bays. Port is the controller port of the primary controller that has access to the storage (for example, Port 1l, 1E, 2E). Box is the incremental number of expansion enclosures or drawers attached to that controller port (for example, 1, 2, 3). Bay is the drive bay(s) that contain the disks. The amount of raw capacity (in TB) included in the sub-expansion (for example, 24 TB, 48 TB). The current status of the storage volume present on the expansion. If the status is Critical/Error, you will not be able to create volumes or expand the file system of any unconfigured storage. Status types for configured storage: Green checkmark/ok: This will be shown when all hardware is good, the RAID volume is present and parity is initialized, and the file system segments on this volume are online and mounted. Amber Exclamation/Warning: Hardware is in a degraded state. This generic message will be provided when there is a degraded state such as a redundant disk failure, a predictive disk failure, a redundant PSU missing or failed, a redundant controller missing or failed, or if there is a firmware upgrade/downgrade required of disks, enclosure hardware, or a RAID controller. Check the event log or hardware tree for details. Amber Exclamation/Warning: Parity initialization is in progress. This will be reported when File System expansion has taken place and completed, but parity initialization is in progress. Amber Exclamation/Warning Filesystem Expansion in progress: This will be reported when file system expansion is in progress. Critical/Error: There is a failure state such as multiple disk failures, inability to connect to the enclosure (for example, cable or power failure), or the volume is not online/mounted. For more detail on unconfigured status types, see the following table. 122 Storage configuration and reporting

123 Table 48: Unconfigured Storage status parameters Name Green tick/ok Blank Green tick/ok Available for Expansion Amber Exclamation/ Warning Parity initialization in progress Amber Exclamation/ Warning Component Firmware Upgrade required Amber Exclamation/ Warning Hardware in degraded state Red Cross/Critical - Error Alien Volume Detected Red Cross/Critical - Error Failed disks detected Red Cross/Critical - Error Power Supply Missing or disconnected Red Cross/Critical - Error Controller Missing, failed Description In this case the attached storage is: A valid StoreOnce configuration The storage belonging to both clusters is OK. Healthy no disk or enclosure component failures. Blank has no pre-existing RAID volumes present. In this case the attached storage is: A valid StoreOnce configuration The storage belonging to both clusters is OK. Healthy no disk or enclosure component failures. Already configured with a valid geometry RAID volume (e.g. Volume creation has already taken place) This will be reported when volume creation has taken place and completed, and parity initialization is in progress. This is reported when one or more storage hardware components in the storage expansion requires an upgrade. This generic message will be provided when there is a degraded state such as a redundant disk failure, a predictive disk failure, a redundant PSU missing or failed, or a redundant controller missing or failed. Check the event log or hardware tree for details. An alien volume is one that has the correct RAID geometry and physical configuration but contains a volume which is not part of the currently running file system. This error is accompanied by a Delete button to enable the specific volume to be deleted. If any failed or predicted failed disks are present in the base storage or expansion set then this error will be reported. This error requires manual intervention to replace the failed disks. This error will be reported for the power supply in the enclosure which houses the expansion set, as such this error could be reported by several expansion sets for the same PSU failure. This error requires manual intervention to correct whatever hardware issue is causing the problem. This error will be reported if the RAID controller or SAS Storage Controller that is connected (or is primary controller) for the storage expansion has an error or is missing. This error requires manual intervention to correct the hardware issue that is causing the problem. Table Continued Storage configuration and reporting 123

124 Name Red Cross/Critical - Error Invalid RAID configuration Red Cross/Critical - Error Incorrect expansion order Red Cross/Critical - Error Missing Expansion Description This error is reported if a RAID volume is detected but it is of the incorrect configuration for use as a StoreOnce storage volume (for example, the wrong size, RAID level, stripe-size). This error is accompanied by a Delete button to enable the specific volume to be deleted. In this case, a valid storage volume has been identified, but the order of storage expansions is incorrect and there is no expansion detected in a lower order expansion location. Appliances where expansions must be added in pairs across both storage clusters the disks/enclosures for one half of the expansion pair is missing. This error requires physical intervention to add the missing expansion, or move storage such that it provides a valid configuration of expansion. Manage storage configuration When you have purchased new storage expansions and have connected or installed the disks, you can use the Storage Configuration tab on the Storage page to provision the storage. To provision your new storage, create RAID volumes, and then expand the file system. Creating RAID volumes The Create Volumes button will be active if the following conditions are present: 1. There is unconfigured storage present 2. All unconfigured storage is in the OK Blank state or there is some unconfigured storage in the OK Blank state and all other unconfigured storage is in the OK Available for Expansion state (this means that the storage already has valid RAID volumes configured). 3. Sufficient capacity expansion licenses have been applied for all storage present. To create RAID volumes: Click Storage in the Navigator pane. Select the Storage Configuration tab. Click Create Volumes. A dialog box will appear that states, Please Wait Volume Creation in progress. Volume creation will take up to 5 minutes to complete and during this time, no other actions on the Storage Configuration tab will be available. Parity initialization will then take place automatically. When the parity initialization process completes, the storage expansion status will change to OK Available for Expansion. IMPORTANT: You should wait for parity initialization to complete before expanding the filesystem as this reduces the overall time required to complete the process. Expanding the file system The Expand File System button will be active if the following conditions are present: There is unconfigured storage present. All unconfigured storage is in the OK Available for Expansion state or the Warning Parity Initialization is in progress state. If the storage is in the Warning Parity Initialization is in progress 124 Manage storage configuration

125 state, you can choose to wait until parity initialization is complete or expand the file system without waiting. All previously configured storage is in a healthy state (meaning it does not show any critical or error states). To expand the file system: 1. Click Storage in the Navigator pane. Select the Storage Configuration tab. 2. Click Expand File System. If you have chosen to expand the file system before parity initialization is complete, a warning dialog box will appear. Select Cancel to stop the operation or click Expand to continue. A dialog box will appear to tell you to wait while the expansion is initializing. While the expansion is initializing, you will not be able to perform any functions on the GUI for about 30 seconds. When the initial part of the expansion is complete, another dialog box that provides information about the expansion will appear. 3. Click OK. The Storage Configuration page will show the newly added storage expansions in the Configured Storage section of the page as soon as the storage expansion starts, and all storage expansions including the base storage will report a warning state to show that expansion is in progress. After expansion has completed, the new capacity will be made available for use. Parity Initialization may still be in progress after expansion completes, if this is the case, then a warning will be shown for each expansion on which parity initialization is still running until it is complete, at which point the status of the storage will change to OK. While a storage expansion is in progress, no other actions on the Storage Configuration page are available. Deleting all storage configurations WARNING: If you delete all storage configurations, you will lose all of your data and you will need to reconfigure your system. The Delete All button will be active if the following conditions are present: 1. An Administrator user is logged in 2. There are no other storage operations in progress, such as a scan for storage, creation of volumes, or expansion of storage The Delete All function is only used to: Remove all configured and alien storage (meaning, to remove all file system configurations and RAID sets) To delete all storage configurations: Click Storage in the Navigator pane. Select the Storage Configuration tab. Click Delete All. A warning dialog box will appear that explains that all storage configuration for the entire cluster will be deleted and all backup data will be lost. Click Delete to continue with the operation, or Cancel to stop the operation. A Please Wait Deleting Storage dialog box will appear and the Management Console will remain greyed out while deletion is in progress. Deleting all storage configurations 125

126 Delete an Alien Volume or delete an invalid RAID Volume The Delete button will be active in the top right corner of the Unconfigured Storage table when the selected row in the table has an Alien Volume error. This only happens if the storage expansion was taken from another appliance or the StoreOnce unit was quick restored to factory default configuration. When rows are selected that contain volumes that do not require deletion, this button will be grey and unavailable. To delete a RAID set that contains an alien volume: 1. Click Storage in the Navigator pane. Select the Storage Configuration tab. 2. In the Unconfigured Storage table, select the row that is reporting an Alien Volume error. 3. Click Delete. 4. A warning dialog box will appear explaining that the volume will be deleted and any storage present on this volume will be lost. 5. Click Delete to continue or Cancel to stop the operation. 126 Delete an Alien Volume or delete an invalid RAID Volume

127 Reporting Central Reporting central allows you to view the status, throughput, and storage details of local and remote StoreOnce appliances. You can create groups of either appliances or virtual devices and then run reports that pull data from these groups. You can also perform system resource monitoring. To use reporting central, you will need to do the following: Register any appliance you want to pull reports for. See Appliance registration on page 127. Configure groups containing registered appliances and their devices. See Group configuration on page 130. Run reports using the configured groups of appliances and virtual devices. See Appliance reports on page 135 and Device reports on page 142. Perform resource monitoring. Resource monitoring includes CPU/Memory, Disk Utilization, Network Utilization, and Fibre Channel Utilization (for units that support Fibre Channel). See System resource reporting on page 147. The Reporting Central page allows you to quickly view a snapshot of the status and capacity usage of registered appliances. Appliances that are in the Unknown state do not contribute to the file system usage total, the bar graphs, or the deduplication ratio shown on this page, even though the appliances are listed as monitored appliances. Appliance registration Appliance refers to a StoreOnce System. You can use your local appliance to monitor and view reports for remote appliances. You first need to register any remote appliance that you want to see data for in Reporting Central. See the following topics for more information: Registering an appliance on page 127 Modifying appliance details on page 129 Unregister an appliance on page 129 Importing certificates on page 129 Registering an appliance Before you can generate reports for an appliance other than the local appliance, you must register that appliance and import the SSL certificate from either the appliance or the certification authority (CA). If you installed an SSL certificate on your StoreOnce appliances that was obtained from a CA, you only need to import the CA certificate (not the SSL certificates) to Reporting Central. If you have not installed an SSL certificate from a CA, you must import the self-signed certificate of each appliance you wish to register and generate reports for in Reporting Central. After completing the steps in this procedure, you must also complete the following procedures to finalize appliance registration: Exporting a certificate on page 128 Importing certificates on page 129 To add your appliance to Reporting Central: Reporting Central 127

128 1. On your local StoreOnce appliance, navigate to the Appliance Registration page, and click Register. 2. Enter the following details to register your StoreOnce appliance. Field name Appliance Address IPv4/IPv6 or FQDN User Name Password Alias Description Enter your appliance s IP address in this required field. Select one, depending on your entry in the IP address field. IPv4/IPv6: Internet Protocol Version 4 or Version 6 FQDN: Fully Qualified Domain name Enter the user name. This must be an account on the remote appliance that can log into the GUI and CLI. The account credentials will be used by Reporting Central to log into the remote appliance and retrieve the information required to generate the reports. Enter the password associated with the user name above. Enter an identifiable name for your appliance. 3. Click OK. 4. To continue appliance registration, go to Exporting a certificate on page 128. Exporting a certificate Export the SSL certificate from your remote appliance for use in completing your appliance registration with your local StoreOnce System. 1. In a new browser, log in to the StoreOnce Management Console (GUI) for the remote appliance you are registering. 2. Navigate to Device Configuration>User Interface>SSL certificate. 3. Click on the Modify tab. 4. In the Create Self-Signed Certificate window, change the name from localhost to the IP of the device. 5. Click Generate. 6. Back on the User Interface page, click Export Certificate. 7. Click Export Certificate. 8. In the Export Certificate dialog box, click Download. A dialog box says the export file called fusion.export.crt has been placed in the SFTP location. 9. Click OK. 10. Open an SFTP session (use your preferred SFTP client) using Administrator user credentials. 11. Enter the IP of the StoreOnce remote appliance you are registering and the Administrator user name and password. 12. Navigate to the /repository folder where you will find the exported certificate (the fusion.export.crt file). 13. Copy the certificate from the StoreOnce appliance to your local drive and close your SFTP session. 14. Rename the file using the IP address and a name for the appliance. Use the same name for this file and the appliance Alias that you entered at registration for easy identification. 128 Exporting a certificate

129 15. The alias name can consist of only a-z, A-Z, 0-9,.(Dot), and -(Hyphen) characters. The minimum allowed length of the alias is two characters and the maximum length is 63 characters. The alias name cannot contain spaces. Example: RemoteApplianceA 16. To complete appliance registration, continue to Importing certificates on page 129. Importing certificates Your local StoreOnce appliance needs a copy of the SSL certificate for any remote appliance you are registering. The SSL certificate allows the local appliance to confirm that the remote appliance it is accessing is indeed a StoreOnce appliance. 1. Open an SFTP session (use your preferred SFTP client) to your local StoreOnce appliance. 2. Copy the renamed certificates from your local drive to the StoreOnce appliance /repository folder using administrator user credentials. 3. Return to your local StoreOnce appliance Management Console. 4. Navigate to Reporting Central Appliance Registration. 5. Click Import Certificate. 6. On the Import Certificate window, enter a certificate alias and then enter the file name of one of the certificates. Your certificate alias should use the same name as the file/your appliance alias. 7. Click OK. 8. Import all other certificates using Import Certificate. Registration is now complete for the remote appliance. Modifying appliance details 1. On the Appliance Registration page, select the appliance you would like to modify. The Alias and IP addresses of all registered appliances appear on this page. 2. Click Modify. The Modify Appliance Details window opens. 3. On the Modify Appliance Details window, update the appliance details as needed. See Registering an appliance on page 127 for more information about the fields in this dialog box. 4. Click OK. Unregister an appliance 1. On the Appliance Registration page, select the appliance you would like to unregister. The Alias and IP addresses of all registered appliances appear on this page. 2. Click Unregister. You will see the IP address of the appliance you have selected. 3. Click OK. All details for this appliance in appliance groups and all virtual devices in virtual device groups are removed. Devices on this appliance that were added to device groups may still appear in the device group list, as Unable to connect. See Removing a device from a device group on page 135 to remove these devices. Importing certificates 129

130 Viewing license information The Licenses page displays sections covering all available license types for your product. Any applied licenses will be listed underneath the appropriate section. You can also view licenses on remote appliances using the Appliance drop-down box. Hardware license fields For StoreOnce hardware products, there will be multiple license fields on the Licenses page: Capacity Expansion Licenses: Required when additional storage is added to StoreOnce Systems Security Licenses: Required for Data at Rest Encryption, Data in Flight Encryption, and Secure Erase. The license is per couplet, but each couplet must have a Security license installed. Catalyst Licenses: Required on each target site (or couplet) where StoreOnce Catalyst is used and each couplet must have a StoreOnce Catalyst license installed Replication Licenses: Required on each target site (or couplet) where Replication is used Fibre Channel Controller Licenses: Required for each Fibre Channel card that is installed in the optional hardware PCI-E slots. Network Controller Licenses: Required for each 10GbE Network card that is installed in the optional hardware PCI-E slots. The fields in the hardware sections on the GUI Licenses page include: Description: Description of the type of license Valid From: The date and time the license was first activated Expires: The date and time the currently applied license will expire Capacity (Capacity Expansion Licenses only): The expansion license capacity Viewing license details 1. On the Licenses page, click on the Description of the license you would like to view details for. 2. The License Details dialog box will appear. Review the license information and click OK to return to the Licenses page. License details fields The License Details dialog box contains the following fields: Name: The license name Description: Description of the type of license Valid From: The date and time the license was first activated Expiration: The date and time the currently applied license will expire Key: The full license key information, including the name of the license (which will be in quotation marks, for example, Hewlett Packard Enterprise StoreOnce 10GbE sfp Network Expansion). License Type: The license type, which can be Fixed Term, Permanent, Evaluation, or Not For Resale Group configuration The Group Configuration page displays a snapshot of configured groups: Appliance Groups: Shows appliance group names and the number of appliances within each group Device Groups: Shows device group names, group descriptions, and the number of libraries, shares, and StoreOnce Catalyst stores in each group 130 Viewing license information

131 To manage appliance and device groups: Appliances on page 131 Virtual devices on page 132 Appliances In the upper pane of the Appliance Groups page, under Group Name, you will see a list of configured appliance groups. Each entry will contain the appliance group name and the number of appliances in that group. To manage appliance groups, see: Creating an appliance group on page 131 Modifying an appliance group on page 132 Deleting an appliance group on page 132 To view more information about a particular group, click the group name in the top pane. The lower pane will display details about all of the appliances included in the group. Lower pane fields Field Appliance address Serial number User data stored Size on disk Free space Capacity Status Description The registered IP address of the appliance. The serial number of the appliance. The amount of user data stored on the appliance in GB. The actual size on disk after deduplication in GB. The amount of free space available on the appliance in GB. The full capacity of the appliance in GB. The status of the appliance: Running: The appliance has some jobs currently running, which could be backup/restore or replication. Online: The appliance has no jobs currently running, and is available for backup/restore or replication. Unknown: Appliance registration for the appliance containing the device has not been completed. Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shut down, network connectivity issues, or invalid credentials. Fault: Appliance is in a fault condition Creating an appliance group Create groups of appliances for use when running reports. 1. On the Appliance Groups page, select Create. 2. In the Create Group window, enter a name for the group. Appliances 131

132 3. Select the appliances you would like to monitor within this group. 4. Click OK. Modifying an appliance group 1. On the Appliance Groups page, under Group Name, select the appliance group you want to modify. 2. Click Modify. 3. In the Modify Group window, modify the group details as needed. You can change the group name, and remove or add appliances. 4. Click OK. Deleting an appliance group 1. On the Appliance Groups page, under Group Name, select the appliance group you want to delete. 2. Click Delete. 3. Verify that the group name listed in the dialog box is the one you want to delete. 4. In the Delete Group window, click OK. Virtual devices This group will no longer be available for use in running reports. Virtual devices refers to any virtual tape libraries, NAS shares, or StoreOnce Catalyst stores that are configured on the StoreOnce appliances you have registered. When you register your appliance, the virtual devices configured on your appliances can be added to device groups in order to run reports that include these devices. The Virtual Devices page displays the list of virtual device groups and the virtual devices within the groups. To view more information about a particular group, click the group name in the top pane. The lower pane will display details about all of the virtual devices included in the group. To manage virtual device groups, see: Creating or modifying a virtual device group on page 133 Deleting a virtual device group on page 135 Removing a device from a device group on page 135 Upper pane fields Field Group name Description Number of libraries Description The name assigned when the virtual device group was created. The description provided when the virtual device group was created. The number of libraries contained in the virtual device group. This number is derived from a combination of all libraries in the group. Table Continued 132 Modifying an appliance group

133 Field Number of shares Number of Catalyst stores Description The number of shares contained in the virtual device group. This number is derived from a combination of all shares in the group. The number of StoreOnce Catalyst stores contained in the virtual device group. This number is derived from a combination of all StoreOnce Catalyst stores in the group. Lower pane fields Field Device name Device type User data stored Size on disk Status Appliance address Service set Description The name of the device. The type of device: StoreOnce Catalyst, NAS share, or VTL The amount of user data stored in GB. The size on disk of the device in GB. The status of the device: Running: The device has some jobs currently running, which could be backup/restore or replication. Online: The device has no jobs currently running, and is available for backup/restore or replication. Unknown: Appliance registration for the appliance containing the device has not been completed. Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shut down, network connectivity issues, or invalid credentials. Failed to start: Device has failed to start replication. Fault: Device has a fault condition. The IP address of the appliance hosting the device. N/A or any number up to 8, depending on how many couplets are represented on the device. Creating or modifying a virtual device group Use the Create or Modify buttons to create or modify a virtual device group. These buttons open a wizard to assist with the process. To continue with the wizard, see: Entering or modifying group details on page 134 Adding or modifying libraries on page 134 Adding or modifying shares on page 134 Adding or modifying StoreOnce Catalyst stores on page 134 Creating or modifying a virtual device group 133

134 Entering or modifying group details 1. At the entry screen for the wizard, click Next. 2. On the Group Details screen, enter a group name and a group description. Create a meaningful name and description so you can easily identify your group. Enter a phone number or address so that if an administrator needs to make changes to your group, they can contact you. 3. Click Next. Adding or modifying libraries The libraries available for adding to your group are a combination of the libraries that were created on all registered appliances. To select the libraries to be included in your virtual group: 1. In the Add Libraries screen of the Create New Group wizard, select the libraries you want to include in your group. You will see the appliance address that is associated with each library. 2. To add a library, click the library and then click > to move the library to the right pane, Selected Libraries. If you want to include all libraries in your reports, click >>. To remove a library, click the specific library and click < to move the library out of the Selected Libraries list. You can also use << to move all items out of the Selected Libraries list. 3. Click Next. Adding or modifying shares To select the shares to be included in your group: 1. In the Add Shares screen of the Create New Group wizard, select the shares you want to include in your group. You will see the appliance name or address that is associated with each share. 2. To add a share, click the share and then click > to move the share to the right pane, Selected Shares. If you want to include all shares in your reports, click >>. To remove a share, click the specific library and click < to move the share out of the Selected Shares list. You can also use << to move all items out of the Selected Shares list. 3. Click Next. Adding or modifying StoreOnce Catalyst stores To select the StoreOnce Catalyst stores to be included in your group: 1. In the Catalyst Stores screen of the Create New Group wizard, select the stores you want to include in your group. You will see the appliance name or address that is associated with each store. 2. For StoreOnce Federated Catalyst stores, you will see two to eight entries (depending on the number of members participating in this Federated Catalyst store), one for each service set. 3. To add a store, click the store and then click > to move the store to the right pane, Selected Catalyst Stores. 134 Reporting Central

135 If you want to include all stores in your reports, click >>. To remove a store, click the specific store and click < to move the store out of the Selected Catalyst Stores list. You can also use << to move all items out of the Selected Catalyst Stores list. 4. Click Finish. You have completed creating or modifying your virtual device group. Deleting a virtual device group 1. On the Device Groups page, in the upper pane, select the group you want to delete. 2. In the Delete Device Group dialog box, verify that you have selected the correct device group. 3. Click OK. This group will no longer be available for use in running reports. Removing a device from a device group After you unregister an appliance, the devices related to that appliance may still appear on the Device Groups page in any device groups they were added to. Their status will display as Unable to connect. In addition, the User Data Stored and Size on Disk columns will display. You must manually remove devices related to an unregistered appliance from configured groups. IMPORTANT: In order to identify the devices that need to be removed, you will need to log in to the remote appliance that you unregistered, and note which devices are related to this appliance. To remove a device from a device group: 1. On the Appliance Groups page, check that the appliance you unregistered is no longer listed. 2. Click Virtual Devices. 3. Click Modify. 4. At the entry screen for the wizard, click Next. 5. In the Modify Libraries screen, select the library you want to remove in the Selected Libraries window. Click < to move the selected library to the other window. Repeat for any additional libraries you need to remove from device groups. 6. In the Modify Shares screen, select the share you want to remove in the Selected Shares window. Click < to move the selected share to the other window. Repeat for any additional shares you need to remove from device groups. 7. In the Catalyst Stores screen, select the store you want to remove in the Selected Catalyst Stores window. Click < to move the selected store to the other window. Repeat for any additional stores you need to remove from device groups. 8. Click Finish. When you complete the wizard, any devices that you removed from the Selected side of the screen will be deleted. Appliance reports Appliance group reports contain data about configured groups of remote StoreOnce Systems. There are four types of appliance reports you can run: Appliance status reports on page 136 Appliance throughput reports on page 138 Stream count reports on page 138 Appliance storage reports on page 139 Deleting a virtual device group 135

136 Appliance status reports Devices and service sets (nodes) in the Unknown state do not contribute to the file system usage total, the bar graphs, or the deduplication ratio shown on this page. Devices in Fault or Failed to Start states do contribute to these reported values. To view the status report for an appliance: 1. On the Reports page, select Appliance. 2. In the Groups menu, you will see all available appliance groups that have been registered for reporting. Select All Appliances, or select an appliance group. 3. In the Appliance menu, select the specific appliance you want a report for. This field is populated with the appliances that are in the appliance group you chose in the previous step. 4. Click the + next to Appliance in the lower portion of the page. You will see a report for the appliance you have selected. Data type Overall Health Status File system usage Deduplication device usage VTL status VTL replication Description Status of appliance health: Running: All services, including background services, are running. Online: System is idle and can be used any time. Unknown: Appliance registration has not been completed. Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shut down, network connectivity issues or invalid credentials. Fault: Appliance is in a fault condition Size on disk (used space) and free space in GB, and a graphic showing each as a percentage of the whole file system Deduplication ratio, size of user data stored, and size on disk Device status can be one of the following: Running: The device has some jobs currently running, which could be backup/restore or replication. Online: The device has no jobs currently running, and is available for backup/restore or replication. Unknown: Remote appliance registration has not been completed Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shutting down, network connectivity issues, or invalid credentials. Failed to start: Device has failed to start replication. Fault: Device has a fault condition. Device replication status consists of both a status and a health level. See Replication status on page 137. Table Continued 136 Appliance status reports

137 Data type NAS status NAS replication CAT status User data stored Size on disk Deduplication ratio Housekeeping Description Device status can be one of the following: Running: The device has some jobs currently running, which could be backup/restore or replication. Online: The device has no jobs currently running, and is available for backup/restore or replication. Unknown: Remote appliance registration has not been completed Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shutting down, network connectivity issues, or invalid credentials. Failed to start: Device has failed to start replication. Fault: Device has a fault condition. Device replication status consists of both a status and a health level. See Replication status on page 137. Device status can be one of the following: Running: The device has some jobs currently running, which could be backup/restore or replication. Online: The device has no jobs currently running, and is available for backup/restore or replication. Unknown: Remote appliance registration has not been completed. Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shutting down, network connectivity issues, or invalid credentials. Size of user data stored in GB Size on disk in GB Deduplication ratio Status of appliance housekeeping activities: Running: The housekeeping process is active. Starting: The housekeeping process is starting up. Stopping: The housekeeping process is shutting down. Icons showing the status of appliance housekeeping activities: Green check: There are no warnings. Blue I (information): Warning: The housekeeping queue has not been empty within the last 24 hours, but has been empty within the last seven days. Red X: Critical: The housekeeping queue has not been empty within the last seven days. Replication status For each VTL and NAS device, the replication status consists of both a status label and an icon next to the device replication status label. Replication status 137

138 Status Status label Icon(s) associated with status Synchronized OK Synchronizing Unknown Non-Replicating Pending synchronization OK Unknown Information needed OK Warning Critical Appliance throughput reports The time zone of the report is shown on the upper right of the screen. When the Appliance/Virtual Device is in the UTC time zone, the custom time period selection will use the browser time zone from where you are accessing Reporting Central. To obtain an appliance throughput report: 1. On the Reports page, select Appliance. 2. In the Groups menu, you will see all available appliance groups that have been registered for reporting. Select All Appliances, or select an appliance group. 3. In the Appliance menu, select the specific appliance you want to run a report for. 4. Select the devices you want to include in the report. The default (if you make no selection) includes all devices. To select up to five specific devices, click Select Device, select the devices you want to include, and click OK. The resulting graphs show data points for the selected time period, with time and date stamps on the x axis, and throughput on the y axis. The upper graph shows throughput for the selected devices. The lower graph shows the throughput for replication sources or targets (VTL or NAS devices) or inbound and outbound copy jobs (StoreOnce Catalyst). To the right of each graph, the selected devices and device names will be shown. The lower graph will also show labels for source, target, inbound, or outbound copy job information. Export Throughput Data allows you to export the displayed report to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. Stream count reports The Stream Count report allows you to view data about the active streams running on your system. You can select a specific device to view stream count data for, or if you do not select a device, the report will show data for all device stream counts by default. 138 Appliance throughput reports

139 1. In the Navigator, select Reporting Central, and then select Reports. 2. Select the Stream Count tab. The Group menu will default to All Appliances (you do not need to change this). 3. In the Appliance menu, select the appliance you want to run a report for. 4. Select the service set you would like to view stream counts for. 5. Click Select Device to choose a specific device to run a report for (the list will show all currently configured devices). If you want to see a report for all devices, do not make a selection using Select Device (the default report shows all devices). 6. In the Period menu, select the time period you want to see the stream count for. If you want to create a custom range: a. Select Custom Range in the Period menu. b. In the Custom Range box, click the calendar icon to the right of each field and select the Start Date and the End Date. c. Click OK. Click Reset if you need to change the dates. The resulting graph shows data points for device stream count during the selected time period, with the date and time stamps on the x axis, and the number of streams on the y axis. If you have selected the default (all devices), all configured devices will be listed to the right of the graph, and will be assigned colors so that you can more clearly see their specific data points on the graph. 7. You can export the Stream Count Data to a.csv file or a.png file. Next to the Period menu, select the report you want to export, and click Export. Select Device button The Select Device button on the Stream Count tab allows you to choose specific devices to see in your stream count data report. The list will be populated with all configured devices on your system. 1. Click Select Device. 2. Check the box next to the device or devices you want a report for. You can select up to five elements to view concurrently running streams on the backup devices. 3. Click OK. Appliance storage reports You can obtain several types of appliance storage reports: Appliance deduplication ratio report on page 139 Appliance capacity usage report on page 140 Appliance capacity forecasting report on page 140 Appliance couplet report on page 141 Any graphs generated for a remote appliance will have the same time and time zone as the remote appliance. Appliance deduplication ratio report To obtain an appliance deduplication ratio report: Select Device button 139

140 1. On the Reports page, select Appliance. 2. In the Groups menu, you will see all available appliance groups that have been registered for reporting. Select All Appliances, or select an appliance group. 3. In the Appliance menu, select the specific appliance you want to run a report for. 4. Select the devices you want to include in the report. The default (if you make no selection) includes all devices. To select up to five specific devices, click Select Device, select the devices you want to include, and click OK. 5. Select the Deduplication Ratio button. 6. In the Period menu, select the amount of time you want to see the deduplication ratio for. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and the deduplication ratio on the y axis. Export Deduplication Ratio Data allows you to export the displayed report to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. Appliance capacity usage report To obtain an appliance capacity usage report: 1. On the Reports page, select Appliance. 2. In the Groups menu, you will see all available appliance groups that have been registered for reporting. Select All Appliances, or select an appliance group. 3. In the Appliance menu, select the specific appliance you want to run a report for. 4. Select the devices you want to include in the report. The default (if you make no selection) includes all devices. To select up to five specific devices, click Select Device, select the devices you want to include, and click OK. 5. Select the Capacity Usage button. 6. In the Period menu, select the amount of time you want to see capacity usage for. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and capacity usage in GB or TB (user data stored and size on disk) on the y axis. Export Capacity Usage Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. Appliance capacity forecasting report To obtain an appliance capacity forecasting report: 1. On the Reports page, select Appliance. 2. In the Groups menu, you will see all available appliance groups that have been registered for reporting. Select All Appliances, or select an appliance group. 3. In the Appliance menu, select the specific appliance you want to run a report for. 4. Select the Capacity Forecasting button. You will see an alert that tells you it will take a few minutes to fetch the data for this report. Click OK. 5. In the For Next menu, select the time frame you want the report to forecast for. 140 Appliance capacity usage report

141 It can take a few minutes to generate the data. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and forecasted storage and disk used on the y axis. If the system is unable to create a forecast, a dialog box displays a message. If this occurs, try changing your report parameters and running the report again. Appliance couplet report To run this report, you must select a StoreOnce 6500 and 6600 appliance. Devices and service sets (nodes) in the Unknown state do not contribute to the file system usage total, the bar graphs, or the deduplication ratio shown on this page. Devices in Fault or Failed to Start states do contribute to these reported values. To view the appliance couplet report: 1. On the Reports page, select Appliance. 2. In the Groups menu, you will see all available appliance groups that have been registered for reporting. Select All Appliances. 3. In the Appliance menu, select the specific appliance that contains a couplet that you want to run a report for. 4. Select the devices you want to include in the report. The default (if you make no selection) includes all devices. To select up to five specific devices, click Select Device, select the devices you want to include, and click OK. 5. Select the Couplet button. 6. The resulting graph shows file system usage and the deduplication ratio for the selected couplet. Capacity Threshold Alerts You can set capacity threshold alerts to receive an when the capacity reaches a designated percentage of physical capacity used. After the initial , you will receive s each time the capacity used increases by 10%. Adding a capacity threshold alert 1. On the Capacity Threshold Alerts page, click Add. 2. On the Capacity Threshold Alerts window, select the appliance (local or registered remote) to monitor. 3. Select the node and couplet to monitor. 4. Select the threshold. 5. This threshold is the percentage of physical capacity used at which you want to receive the first alert. 6. Select the configured alert type. 7. The alert type is the alert type (Info, Warning, Critical) at which you want to receive an alert. The system defines Warning at 85% capacity used and Critical at 95% capacity used. 8. Select the alert frequency. 9. The alert frequency is the frequency at which you want to receive an alert indicating the capacity used. However, if your system reaches the defined threshold before the frequency is reached, you will receive an . For example, if your frequency is every three hours but your Appliance couplet report 141

142 capacity used increases by 10% in two hours, you will receive an alert at two hours instead of three. 10. Enter the address of all who should receive the alerts. 11. Leave Continue to create this alert configuration checked. 12. If your appliance does not have configuration enabled, after the threshold alert is configured you will be directed to Device Configuration > to enable configuration. The threshold alert is not active until you have enabled configuration. 13. Click OK. 14. The alert is displayed on the Capacity Threshold Alerts page. Modifying a capacity threshold alert 1. On the Capacity Threshold Alerts page, select the threshold alert to modify. 2. Click Modify. 3. On the Edit Capacity Threshold Alerts window, edit the information as needed. 4. Click OK. 5. The updated alert is displayed on the Capacity Threshold Alerts page. Deleting a capacity threshold alert 1. On the Capacity Threshold Alerts page, select the threshold alert to delete. 2. Click Delete. 3. On the Delete Capacity Threshold Alerts confirmation window, click Yes. 4. The alert is removed from the Capacity Threshold Alerts page. Device reports Virtual device group reports contain data about the virtual tape libraries, NAS shares, and StoreOnce Catalyst stores that are configured on the remote appliances. There are several types of device reports you can run: Device status reports on page 143 Device throughput reports on page 144 Device storage reports on page 145 Device StoreOnce Federated Catalyst stores reports on page 146 Until you create at least one virtual device group, the Device button will be disabled. Select device (appliance tabs) In the Select Device dialog box, you will see a list of devices. Select the devices you want to include in your report and click OK. 142 Modifying a capacity threshold alert

143 Field Device name Device type Description The name given to the device when it was created The device type: VTL, NAS share, or StoreOnce Catalyst The device type will have the label (Dedupe disabled) if deduplication is not enabled on the device. Select device (device tabs) In the Select Device dialog box, you will see a list of devices. Select the devices you want to include in your report and click OK. Field Device name Appliance address Service set Device type Description The name given to the device when it was created The IP address or domain name of the host appliance for the device The service set the device belongs to The device type: VTL, NAS share, StoreOnce Catalyst The device type will have the label (Dedupe disabled) if deduplication is not enabled on the device. Select device (appliance Federated Stores tab only) In the Select Device dialog box, you will see a list of devices. Select the devices you want to include in your report and click OK. Field Device name Service set Description The name given to the device when it was created The service set the device belongs to Device status reports To obtain a device status report: Select device (device tabs) 143

144 1. On the Reports page, select Device. 2. In the Group menu, select the device group you want to run a report for. The resulting report details data for all devices in the selected group. Devices that are in an Unknown state do not contribute to the user data stored, size on disk, or the deduplication ratio shown in this report. Devices in Fault or Failed to Start states do contribute to these reported values. Data type User data stored Size on disk Device name Device type Status Appliance address Service set Description The amount of user data stored in GB. The size on disk in GB. The name of the device. The type of device: StoreOnce Catalyst, NAS share, or VTL. Device status can be one of the following: Running: The device has some jobs currently running, which could be backup/restore or replication. Online: The device has no jobs currently running, and is available for backup/restore or replication. Unknown: Host appliance registration has not been completed Unable to connect: A connection to the remote appliance cannot be made. This could be due to the remote appliance rebooting or shutting down, network connectivity issues, or invalid credentials. Failed to start: Device has failed to start replication. Fault: Device has a fault condition. The IP address of the appliance hosting the device. N/A or any number up to 8, depending on how many couplets are represented on the device. Device throughput reports The time zone of the report is shown on the upper right of the screen. When the Appliance/Virtual Device is in the UTC time zone, the custom time period selection will use the browser time zone from where you are accessing Reporting Central. To obtain a device throughput report: 1. On the Reports page, select Device. 2. In the Group menu, select the device group you want to run a report for. 144 Device throughput reports

145 3. Click Select Device and select up to five devices. Click OK. 4. In the Period menu, select the time frame you want throughput data for. The resulting graphs show data points for the selected time period, with time and date stamps on the x axis, and throughput on the y axis. The upper graph shows throughput for the selected devices. The lower graph shows the throughput for replication sources or targets (VTL or NAS devices) or inbound and outbound copy jobs (StoreOnce Catalyst). To the right of each graph, the selected devices and device names will be shown. The lower graph will also show labels for source, target, inbound, or outbound copy job information. Export Throughput Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. Device storage reports You can obtain two types of device storage reports: Device deduplication ratio on page 145 Device capacity usage on page 145 Device deduplication ratio To obtain a device deduplication ratio report: 1. On the Reports page, select Device. 2. In the Groups menu, select a device group. 3. Select the Deduplication Ratio button. 4. Click Select Device and select up to five devices. Click OK. 5. In the Period menu, select the amount of time you want to see the deduplication ratio for. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and the deduplication ratio on the y axis. Export Deduplication Ratio Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. Device capacity usage To obtain a device capacity usage report: 1. On the Reports page, select Device. 2. In the Groups menu, select a device group. 3. Select the Capacity Usage button. 4. Click Select Device and select up to five devices. Click OK. 5. In the Period menu, select the amount of time you want to see the capacity usage for. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and capacity usage in GB (user data stored and size on disk) on the y axis. Export Capacity Usage Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will Device storage reports 145

146 immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. Device StoreOnce Federated Catalyst stores reports You can obtain three types of StoreOnce Federated Catalyst stores reports: StoreOnce Federated Catalyst stores deduplication ratio on page 146 StoreOnce Federated Catalyst stores capacity usage on page 146 StoreOnce Federated Catalyst stores throughput on page 146 StoreOnce Federated Catalyst stores deduplication ratio To obtain a StoreOnce Federated Catalyst stores deduplication ratio report: 1. On the Reports page, select Device. 2. Select the Federated Stores tab. 3. In the Groups menu, select a device group. 4. Select the Deduplication Ratio button. 5. In the Select Device menu, select up to five devices, and click OK. 6. In the Period menu, select the amount of time you want to see the deduplication ratio for. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and the deduplication ratio on the y axis. Export Deduplication Ratio Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. StoreOnce Federated Catalyst stores capacity usage To obtain a StoreOnce Federated Catalyst stores capacity usage report: 1. On the Reports page, select Device. 2. Select the Federated Stores tab. 3. In the Groups menu, select a device group. 4. Select the Capacity Usage button. 5. In the Select Device menu, select up to five devices, and click OK. 6. In the Period menu, select the amount of time you want to see capacity usage for. The resulting graph shows data points for the selected time period, with date and time stamps on the x axis, and capacity usage in GB (user data stored and size on disk) on the y axis. Export Capacity Usage Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. StoreOnce Federated Catalyst stores throughput To obtain a StoreOnce Federated Catalyst stores throughput report: 146 Device StoreOnce Federated Catalyst stores reports

147 1. On the Reports page, select Device. 2. Select the Federated Stores tab. 3. In the Group menu, select the device group you want to run a report for. 4. Click Select Device and select up to five devices. Click OK. 5. In the Period menu, select the time frame you want throughput data for. The resulting graph shows data points for the selected time period, with time and date stamps on the x axis, and throughput in MB/s on the y axis. To the right of the graph, the selected devices and device names will be shown. To run another throughput report, repeat these steps. Export Throughput Data allows you to export the report that is showing to.csv or.png. If you select.csv, you will be prompted to open or save the file. If you select.png, the graphic will immediately open in another browser window; you may need to temporarily allow pop-ups in your browser. System resource reporting Resource monitoring allows you to monitor the hardware components on a StoreOnce System. System resource reports contain data about CPU/Memory, disk utilization, network utilization, and Fibre Channel receive and transmit rates (for units that support Fibre Channel). You can select which node in the cluster you want to see a report for (or you can select all nodes at once). There are four types of system resource reports: CPU/Memory reports on page 147 Disk utilization reports on page 148 Network utilization reports on page 148 Fibre Channel utilization reports (for devices that support FC) on page 149 CPU/Memory reports The CPU/Memory reports allow you to view data about the performance of your system. If you consistently see high CPU usage and you are not running any backups, replication, or housekeeping, you may want to check for hardware issues. If you consistently see high CPU usage while running backups, you may want to look at your backup policies to ensure you are not straining system performance due to your backup settings. 1. In the Navigator, select Reporting Central, and then select Reports. 2. Select the CPU/Memory tab. The Group menu will default to All Appliances (you do not need to change this). 3. In the Appliance menu, select the appliance you want to run a report for. 4. You cannot run a report for multiple appliances, but you can run a report for up to 8 nodes in a cluster. 5. In the Node menu, select the node you want to run the report for. Selecting ALL will show a report with data for all nodes in the cluster. 6. In the Period menu, select the time period you want to see CPU/Memory usage for. 7. If you want to create a custom range: a. Select Custom Range in the Period menu. b. In the Custom Range box, click the calendar icon to the right of each field and select the Start Date and the End Date. c. Click OK. System resource reporting 147

148 Click Reset if you need to change the dates. The resulting graphs show data points for CPU and Memory usage for the selected time period, with the date and time stamps on the x axis, and the % utilization of CPU or Memory usage on the y axis. 8. You can export the Memory Data or the CPU Data to a.csv file or a.png file. Next to the Period menu, select the report you want to export, and click Export. Disk utilization reports Disk utilization reports give information about percentage utilization of the disk subsystem, its read throughput, and its write throughput. These reports include all disks attached to the server. 1. In the Navigator, select Reporting Central, and then select Reports. 2. Select the Disk Utilization tab. The Group menu will default to All Appliances (you do not need to change this). 3. In the Appliance menu, select the appliance you want to run a report for. 4. You cannot run a report for multiple appliances, but you can run a report for up to 8 nodes in a cluster. 5. In the Node menu, select the node you want to run the report for. Selecting ALL will show a report with data for all nodes in the cluster. 6. In the Period menu, select the time period you want to see disk utilization for. 7. If you want to create a custom range: a. Select Custom Range in the Period menu. b. In the Custom Range box, click the calendar icon to the right of each field and select the Start Date and the End Date. c. Click OK. Click Reset if you need to change the dates. 8. The resulting graphs show data points for the selected time period. The x axis shows date and time stamps, and the y axis shows either percentage utilization or write or read disk throughput (the disk throughput autoranges from 0 to the highest throughput in the time range, using bytes, KB, or MB, depending on the throughput size). 9. You can export the Disk Utilization, Write Throughput, or Read Throughput data to a.csv file or a.png file. Next to the Period menu, select the report you want to export, and click Export. Network utilization reports Network utilization reports allow you to view data about the receive and transmit rates of the network. If you are running any backup or replication jobs (this does not include VTL over Fibre Channel), the receive rate will be high, and if you are running any restore jobs, the transmit rate will be high. 1. In the Navigator, select Reporting Central, and then select Reports. 2. Select the Network Utilization tab. The Group menu will default to All Appliances (you do not need to change this). 3. In the Appliance menu, select the appliance you want to run a report for. 4. You cannot run a report for multiple appliances, but you can run a report for up to 8 nodes in a cluster. 5. In the Node menu, select the node you want to run the report for. Selecting ALL will show a report with data for all nodes in the cluster. 6. In the Period menu, select the time period you want to see network utilization for. 7. If you want to create a custom range: 148 Disk utilization reports

149 a. Select Custom Range in the Period menu. b. In the Custom Range box, click the calendar icon to the right of each field and select the Start Date and the End Date c. Click OK. Click Reset if you need to change the dates. 8. The resulting graphs show data points for the selected time period. The x axis shows date and time stamps, and the y axis shows bytes, KB, or MB, depending on the maximum value of network receive and transmit utilization during the selected time period. 9. You can export the Network Receive Rate Data or the Network Transmit Rate Data to a.csv file or a.png file. Next to the Period menu, select the report you want to export, and click Export. Fibre Channel utilization reports (for devices that support FC) Fibre Channel utilization reports allow you to view data about the Fibre Channel receive and transmit rates. The reports will show data for up to 8 Fibre Channel ports, depending on how you have your system configured (the reports will show data for as many as you have configured). If you are running any backup or replication jobs (this does not include VTL over Fibre Channel), the receive rate will be high, and if you are running any restore jobs, the transmit rate will be high. 1. In the Navigator, select Reporting Central, and then select Reports. 2. Select the Fibre Channel Utilization tab. The Group menu will default to All Appliances (you do not need to change this). 3. In the Appliance menu, select the appliance you want to run a report for. 4. You cannot run a report for multiple appliances, but you can run a report for up to 8 nodes in a cluster. 5. In the Node menu, select the node you want to run the report for. Selecting ALL will show a report with data for all nodes in the cluster. 6. In the Period menu, select the time period you want to see Fibre Channel utilization for. 7. If you want to create a custom range: a. Select Custom Range in the Period menu. b. In the Custom Range box, click the calendar icon to the right of each field and select the Start Date and the End Date. c. Click OK. Click Reset if you need to change the dates. 8. The resulting graphs show data points for the selected time period. The x axis shows date and time stamps, and the y axis shows bytes, KB, or MB, depending on the maximum value of Fibre Channel receive and transmit utilization during the selected time period. 9. You can export the Fibre Channel Utilization Receive Rate Data or the Fibre Channel Utilization Transmit Rate Data to a.csv file or a.png file. Next to the Period menu, select the report you want to export, and click Export. Report Scheduler The Report Scheduler allows you to receive reports on read/write throughput, replication throughput, and storage capacity at the service set level. You schedule the intervals for receiving the reports. Adding an report 1. Navigate to Reporting Central > Reports > Scheduler. 2. Click Add. Fibre Channel utilization reports (for devices that support FC) 149

150 3. Complete the following information: a. Enter the report name. b. Select the report type. c. Select the time period. d. Select the appliance. e. Select the service set. f. Enter comments (optional). g. Enter the subject line. h. Enter the recipients. i. Select the frequency of the report. j. Select the number of minutes past the hour to run the report. k. Select the starting and ending dates of the report schedule. 4. Click OK. 5. The report schedule is added to the Report Scheduler list. Modifying an report 1. Navigate to Reporting Central > Reports > Scheduler. 2. Select the report to modify. 3. Click Modify. 4. Edit the information as needed. 5. Click OK. 6. The updated report schedule is displayed in the Report Scheduler list. Deleting an report 1. Navigate to Reporting Central > Reports > Scheduler. 2. Select the report to delete. 3. Click Delete. 4. The report schedule is removed from the Report Scheduler list. 150 Modifying an report

151 Access and Device Configuration In this context, Device refers to the StoreOnce System, not the target devices on the system. Device Configuration page On the Device Configuration page, System Information shows summary details for the StoreOnce System that were set up at installation and cannot be modified from the GUI. Table 49: System information Field System ID Description StoreOnce System Description This is system ID assigned at installation. It is referred to as the Cluster ID in the StoreOnce CLI. For information about locating the system serial number, refer to License management on page 170. This text is used to label and identify the StoreOnce System. It is set by the user with the StoreOnce CLI system set description command. Firmware page Select the Firmware page to view the firmware versions for hardware components, and to update firmware versions if required. The Firmware page contains the following tabs: Server: Contains hardware components for the server. Details are displayed for all nodes (servers) in the cluster. Storage: Contains hardware components for all storage elements. Details are displayed for all storage in the cluster. Switch: Contains hardware components for all switches, two in a one-rack system and four in a two rack system. The tabs are empty when the page is first displayed and no information will be present until a scan has been initiated. To view and upgrade firmware 1. In the Navigator, select Firmware. 2. An Information box will tell you that firmware information needs to be updated and that you need to press Scan to initiate the update. Click OK. Access and Device Configuration 151

152 3. Click Scan to perform a check on the currently installed firmware versions for all components associated to the selected node. This will populate the firmware tabs. This may take several minutes to run. 4. You may also select Scan All. If you select Scan All, all of the components, storage, and networking associated with that cluster will be discovered. If you select Scan All, then you can select Update All in the next step to update all components in the cluster at the same time. Use Scan if you replaced one node or component within a node and just want to upgrade that node or component. The scan will fail if a firmware update is in progress. 5. After you have run a scan, components will automatically be flagged for upgrade or downgrade. Look for components that have a Recommended Action of either Upgrade or Downgrade. These components will automatically have their check-box selected after the scan. When the firmware updates are initiated, the backup devices will be taken offline. Before performing this step, check that there are no outstanding backup jobs pending. The upgrade will fail if failover is enabled. A message will be displayed indicating you should disable failover either from the Maintenance page or via the CLI system disable failover command. If there are only one or two components that need to upgrade or downgrade, click in the appropriate check box to select them and click Update Selected. If there are many, click Update All. This will attempt to update all components that are in the state where there is an update recommended; it will not try to update components that do not need an update. If you selected Scan All in the previous step, you may select Update All to update components in both nodes and complete the entire upgrade process for all components in the cluster at the same time. If you selected Scan, the update will be applied ONLY to the particular node in the cluster that is selected in the top pane. 6. In the Update Selected Components or the Update All Components dialog box, confirm that you want to continue with the update by clicking Update. The Status field will show which components are being updated and which updates have been completed. 7. In some cases, when the firmware update has completed, you will need to perform a reboot to complete the firmware update. A pop-up message will appear on your GUI screen after updates are completed if a reboot is required. There are two types of reboot: Reboot: If a software reboot is needed, you will see a message asking if you want to reboot your system now or later. Before you reboot, you will be directed to the Maintenance page. Click Disable Failover. Then click Reboot. Your system will be rebooted. Power cycle required (cold boot): A power cycle, or cold reboot, is a physical power cycle of the appliance. The system must be shut down for at least 60 seconds before you power back on. 152 Access and Device Configuration

153 In the Success notification box, you will see a message asking you to do a power cycle. Select OK. In the Do you want to do power cycle box, select Yes to power cycle immediately. If you select No, the next time you log in to the GUI, you will be asked again if you want to do a power cycle. To power back on, you will need physical access to the appliance or access to the ilo management GUI. Firmware page fields Table 50: Firmware fields Field Checkbox Device Type Active Version Qualified Version Recommended Action Status Description Allows selection of individual components The name of the component The firmware version on the component The firmware version that is qualified for use with the StoreOnce System. If a component has been replaced, this may be earlier than the active version. The recommended action, which may be none, upgrade or downgrade The status, which changes if an update is in progress or further action is required to complete the update process User Management Two user accounts, Admin and Operator, and passwords are created at installation and are always included on this page. Users may use this page to modify the passwords. They may also create, edit, and delete additional users. (See also User types and user roles on page 154.) User accounts and AD IMPORTANT: Before granting access to external users or groups using the User Management tool, you must first: 1. Set the Authentication mode to AD on the NAS CIFS server tab. See CIFS server tab on page Add the StoreOnce device to an AD domain. See "Adding the StoreOnce appliance to an Active Directory (AD) domain" in Configuring AD authentication mode. 3. Add any required users or groups to your active directory to grant access to the AD domain. See "Assigning AD groups as administrators for the StoreOnce CIFS server" and "Assigning AD users as administrators for the StoreOnce CIFS server" in Configuring AD authentication mode. 4. Grant your external users or groups access permissions to the StoreOnce System using the User Management tool. See Using AD authentication mode on page 39. User accounts may also be managed using StoreOnce CLI commands. See the StoreOnce System CLI Reference Guide. Firmware page fields 153

154 An operator screen will only show a Modify button, while an administrator user management summary screen will show additional buttons: Add Group, Add User, and Delete. User types and user roles User roles Two roles define the permissions associated with a user: admin and user. Two default user accounts, one for each role, are created automatically when the system is installed: Administrator: This account allows authorized users to create and edit management and StoreOnce functions via the GUI and CLI. The default login and password are Admin and admin. The permissions role of the administrator is admin. You cannot delete this account, but you can and should modify its password. Note that once the administrator account password has been changed, its password cannot be changed back to admin as this password is not sufficiently complex. The only way to revert that password back to admin is by using the HPresetpassword user account that is only available on the local console of the device. Operator: This account limits access to the GUI and CLI to monitoring and viewing. The default login and password are Operator and operator. The permissions role of the operator is user. User types After installation, an administrator can configure additional user accounts and assign permissions roles (administrator or user) and passwords to these users. There are three types of user accounts: Local User (with an administrator or user permissions role): Local users log in locally and are authenticated using credentials created on the StoreOnce appliance. External User (with an administrator or user permissions role): User logs in as a domain user. External users are authenticated using their domain credentials by an external Microsoft Active Directory Server. External Group (with an administrator or user permissions role): An external user is a Microsoft Active Directory group. Members of the group log in as domain users. If after creating a group you then set up a member of that group as an individual user (external user) and give them an administrator role, that user will be an administrator, even if the group role is set to user. This is because role permissions set through Add User take precedence over role permissions set through Add Group. Any user with an administrator role has the same permissions as the default administrator. Any user with a user role will have the same permissions as the default operator. To add external users or groups, first add the StoreOnce device to an AD domain. Connection to an AD Domain is configured through the NAS CIFS server tab on the StoreOnce System Management GUI. Tip IMPORTANT: If administrator credentials are lost, the administrator password can be reset through the hidden user account HPresetpassword. This account is password protected and is only accessible from the StoreOnce System console and CLI. Hewlett Packard Enterprise recommends changing the HPresetpassword password after installation and store it in an offline password security tool. To identify current user rights view the title bar of the GUI. This shows your user Type, Name, and Role. Adding a local user (administrator only) Local users are created solely on the StoreOnce System. 154 User types and user roles

155 1. Click Add User. 2. Leave the User Type as Local (default). 3. Enter the User Name. 4. Select a User Role of user or admin. 5. Enter a password for the new user and confirm the password. 6. Click OK. Adding an external user (administrator only) External users belongs to a domain to which the StoreOnce System has been joined. When you add an external user who is already a member of an existing group, you have the ability to assign this user to a different role than the group role. No password is required for the external user because that is controlled via the Domain server. 1. Click Add User. 2. Change the User Type to External. 3. Enter the User Name. The user name must be in this format and the user must be part of an existing domain: <DOMAIN_NAME>\<USERNAME>, for example: AdminSys\ghearty 4. Select a User Role of user or admin. 5. Click OK. If the user name is not in the correct format, an error message will appear, and the external user will not be created. Adding a group (administrator only) This option allows you to add a group that has already been set up on the AD domain to which the StoreOnce System has been joined. When adding a group, you must choose a role for the group. All members of this group will have the same role. If, after creating the group, you configure a member of that group as an individual user (external user) with an admin role, that user will then be an Admin even if the group role is set to Operator. (Role permissions set through Add User take precedence over role permissions in Add Group.) 1. Click Add Group. 2. Enter Group Name. This group must already exist in your domain. For example: yourdomain.com\storeonceadmins 3. Select a permissions role of user or admin, then click OK. If the group does not exist in your domain, exists already on the AD domain, or if there is missing information, an error message is displayed Adding an external user (administrator only) 155

156 Modifying a user The administrator user and users created with a user role of admin can modify any local user password or the role of an external user or external group. The operator user and users created with a user role of user may only modify their own password and cannot change the role of a group or any other user. To modify a local user 1. Select the user to change a password for and click Modify. For a local user, you can modify the user role or the user password, or both. 2. Change the role of the user, if required. Enter and confirm the new password. 3. Click OK. At the confirmation of success page, click OK. To modify an external user or external group To modify an external user or group, select the external user or group to modify and click Modify. You will have the option to change the permissions role. Only users with administrator permissions can modify roles of users or groups. Change the permissions role. Click OK. At the confirmation for the role change, click OK. Deleting a user or group (administrator only) IMPORTANT: You cannot delete the two default user accounts: Administrator and Operator. 1. Select the user or group and click Delete. 2. Click OK to confirm deletion of the selected user or group. 3. In the success confirmation box, click OK. User Interface The User Interface page allows you to change the GUI Session Idle Timeout, which is the amount of time (in minutes) the GUI can remain idle until it times out and requires another login. To change this setting: 1. Click Modify to open the User Interface window. 2. Select the number of idle minutes that triggers the timeout. The options are 1, 2, 5, 10, 15 (default), 30, and Click OK. The GUI session idle time will take effect the next time you log in. Your current session will still have the previous idle time. SSL certificates The StoreOnce Management GUI is accessed via the HTTPS protocol which requires the exchange of an SSL (Secure Sockets Layer) certificate to authenticate the connection between web browser and the StoreOnce appliance. The StoreOnce appliance by default will return a generic SSL certificate which is created when the system is manufactured. This generic certificate does not uniquely identify the appliance, and therefore is not considered to be secure by the web browser. 156 Modifying a user

157 The user has the option to change the SSL certificate to provide a better level of authentication. The following options are available: Provide some unique information (comprised of the appliance name and administrator contact details) to generate a certificate on the appliance which will return this data to the web browser in the certificate. This is referred to as a "Self-signed Certificate". Export the Self-signed Certificate to a file called a Certificate Signing Request (CSR). This CSR can then be externally signed by a Certificate Authority, and returned in the form of a certificate file which can be imported to the StoreOnce appliance. This provides an additional level of authentication as the web browser may then be provided with a root certificate of the certificate authority against which it can verify appliance certificates. The Certificate Authority may be an external body, or it may be a server running tools required to generate a certificate internally to an organization. In addition, when using the Reporting Central functionality of the StoreOnce appliance to remotely monitor other StoreOnce appliances, if using self-signed certificates you must download the certificate from the appliance that you want to manage and import that certificate onto the appliance that will be used to perform the Reporting Central function. See Reporting Central on page 127. Generating a self-signed certificate 1. From the Navigator, go to Device Configuration > User Interface > SSL Certificate The Create Self-signed Certificate window opens. 2. Click Modify. 3. Enter the requested information. Field Name State City Organization Organization unit address Country Number of days valid Description Name of the system, in the form of either IP Address, or FQDN State the appliance is located in City the appliance is located in Organization of the certificate requestor Organization unit of the certificate requestor address of the certificate requestor Country the appliance is located in Maximum number of days the certificate will remain valid. Values are 0 to Click Generate. A message is displayed warning that the existing certificate will be overwritten. 5. Click OK. A success message is displayed. The certificate is now stored locally on the system but will not take effect until the StoreOnce appliance is rebooted. Generating a self-signed certificate 157

158 Generating a Certificate Signing Request 1. From the Navigator, go to Device Configuration > User Interface > SSL Certificate 2. Click Generate CSR. 3. In the Generate CSR window, click Download. 4. In the Save HTML document window, navigate to an easily identifiable location and click Save. If your browser does not give you the option to select the location, the file will download to your local system Downloads folder. A certificate authority (CA) can use this CSR file to generate a new SSL certificate and private key that can then be imported to the StoreOnce appliance. Follow the instructions provided by your CA to generate the new SSL certificate and key. Importing a certificate Importing an SSL certificate will install the certificate in the web server of the StoreOnce appliance. This certificate will be used to identify the appliance to clients that connect to the appliance. 1. Copy the certificate file from your local system to the /repository folder on the StoreOnce appliance. Only users with Administrator privileges can copy files to /repository. 2. From the Navigator, go to Device Configuration > User Interface > SSL Certificate 3. Click Import Certificate. 4. Select the preferred certificate from the Certificate list. This list is populated using all available certificate files in the StoreOnce appliance /repository folder. The certificates can be externally generated or generated from the currently installed selfsigned certificate. 5. If you selected an external certificate, select the corresponding key from the Key list. 6. Click Import. 7. Click OK. The newly imported certificate overwrites any previous certificate whether self-signed or signed by a CA. 8. From the Navigator, go to Device Configuration > Maintenance. 9. Click Disable Failover. 10. click Reboot. Exporting a previously installed certificate 1. From the Navigator, go to Device Configuration > User Interface > SSL Certificate 2. Click Export Certificate. 3. In the Export Certificate dialog box, click Generate. A copy of the.crt file is downloaded to the appliance /repository folder. 158 Generating a Certificate Signing Request

159 Event Management The Event Management page allows you to change the Audit Log Retention Period, which is the number of days the system will store the audit logs. After this period, the logs are permanently deleted. To change this setting: 1. Click Modify to open the Event Management window. 2. Enter the number of days (from 15 to 365, default is 30) to retain the Audit event logs. 3. If you shorten the Audit event logs retention period, for example, from 30 days to 15 days, the Audit event logs will be truncated to remove all logs older than 15 days and from that point forward will only keep the last 15 days worth of logs. Audit logs are not immediately purged when you shorten the retention period It may take up to 12 hours to complete the purge. You cannot delete Audit event logs using the Delete button on the Events page. To remove Audit event logs, you must modify the Audit Log Retention Period on this User Interface page. 4. Click OK. The retention period will take effect the next time you log in. Your current session will still have the previous retention period. Log export The Log Export page displays the Log Export recipient list with the following information: ID Host IP address Protocol type Port number Log type Adding a new recipient 1. On the Log Offload page, click Add. 2. In the Add Recipient window, complete the following information: a. Select IPv4 (default), IPv6, or Domain Name. b. Enter the IP address. c. Edit the port number if appropriate (optional). The default is 514. d. Select the protocol type. e. Click OK. Editing a recipient The recipient is added to the Log Export Recipient List. 1. On the Log Export page, select the recipient to edit. 2. Click Edit. 3. In the Edit Recipient window, edit the information as necessary. 4. Click OK. Event Management 159

160 The recipient is updated in the Log Export Recipient List. Deleting a recipient 1. On the Log Export page, select the recipient to delete. 2. Click Delete. 3. In the Delete Recipient confirmation window, click Yes. The recipient is deleted from the Log Export Recipient List. Select from the Device Configuration menu item to display the current setup. The Setup page displays the current configuration for sending out event notifications via . This includes information needed to route the (SMTP server), as well as the association of events with destination addresses. A single event can generate a notification to multiple addresses. Also, different sets of events can generate notifications to different addresses. To configure settings 1. From the Navigator, select Device Configuration > Click Configure. 3. Enter the appropriate information. Table 51: setup parameters Name Notification SMTP Server Mail From Description Indicates whether notification is currently enabled or disabled. When notification is disabled, the association between events and destination addresses remains valid, but the events do not produce . The mail server used to send out the . The address from which the notification originates. Port The port used to send out the . The port range is Reply To An optional address if you want the recipient to reply to an address different from the address where the originated. 4. Click OK. Test 1. From the Navigator, select Device Configuration > Click Test. 3. Enter the destination address and a subject. 4. Click OK. An message is sent only if notification is enabled on the Setup page. 160 Deleting a recipient

161 Events ( ) From the Navigator, select Device Configuration > > Events. The Events topic page lists the event types that may be notified by and the addresses to which the notifications are sent. There are three types of events that generate notifications, listed under the Severity column once they have been setup in Manage Notifications. If the same event generates notifications to multiple addresses, a separate row is used to represent each event/ -address pairing. The fields are: Table 52: Events notified by parameters Name Severity Destination Description Severity of the event (INFO/WARN/ALERT). The destination address. Managing notifications Use this dialog to manage the event/ -address association list. 1. From the Navigator, select Device Configuration > > Events 2. Click Manage Notifications. 3. On the Manage Notifications dialog, do one of the following: a. Choose an existing address from the drop-down menu and click Select to display it in the Update events for addresses field. b. Enter a new address directly into the Update events for addresses field. 4. Select the event groups to be associated with the addresses (Alert, Warn, and/or Info). 5. Click OK. The updated list is displayed almost immediately in the Events Notified by page. SNMP GUI functions The SNMP (Simple Network Management Protocol) GUI page allows you to view and modify SNMP Agent configuration parameters, view common attributes for Registered Trapsinks, and view the Users list. You can also add, modify, and delete both trapsinks and users. When the SNMP feature is enabled, it reports the overall system status via SNMP traps as reflected on the StoreOnce Management interface, as follows: OK System status is good. Warning Something on the system needs attention, but is not critical. Critical Something on the system needs immediate attention. It also reports any software status messages or hardware status messages as reported in the event log, alerts, or the StoreOnce Management Console. Test SNMP Agent Setup Once SNMP has been configured, you can use the SNMP Test function to test that SNMP is set up correctly and that traps can successfully make it to the trapsinks. Events ( ) 161

162 1. In the SNMP Agent Setup pane, click Test. 2. In the Test SNMP event window, click Yes. Modifying the SNMP Agent Setup 1. From the Navigator, select Device Configuration > SNMP. 2. Click Modify. 3. In the Modify SNMP Agent window, modify the configuration of the SNMP Agent as needed. Table 53: SNMP Agent configuration parameters Name System description Description The description for the StoreOnce System configured for the agent. SNMP version The SNMP version of the agent (version 1, 2, or 3). State Port Encrypt Passwords and Communities System Contact The state of the agent (off, on). The port location of the agent. Defines whether encryption for passwords and communities is on or off. The contact information for the system administrator, which may be a name, address, or phone number. A maximum of 20 characters is allowed. System Location The physical location of the StoreOnce appliance. A maximum of 20 characters is allowed. Read Community Write Community System Object ID Defines the SNMP Read Community string. The default is public. To restrict read access, enter a string of up to 20 characters. This string acts as a password for Read access and must be manually configured in the management application so that it can access events. Defines the SNMP Write Community string. To restrict write access, enter a string of up to 20 characters. This string acts as a password for Write access and must be manually configured in the management application so that it can access events. The SNMP agent unique System Object ID. SNMP agents (running on a StoreOnce Device) supporting Hewlett Packard EnterprisehttpManageable-MIB must provide a unique System Object ID. This ID is used by network management entities to determine the monitoring capabilities of a device. Table Continued 162 Modifying the SNMP Agent Setup

163 Name Engine ID Allow non-v3 read requests Description This device-specific parameter can be provided to an SNMP version 3 trap listener device such as Hewlett Packard Enterprise SIM (or any third-party tool) to listen to version 3 traps coming from the device. Optional. This can be provided during version 3 configuration. If the value is yes, versions 1 and 2 are supported along with version 3. If the value is no, only version 3 is supported. If this parameter is not configured, only version 3 will be supported. Optional. 4. Click OK. Viewing SNMP trapsinks list and individual details The SNMP Trapsinks tab in the lower pane of the SNMP Agent Setup page shows a list of configured SNMP trapsinks. 1. From the Navigator, select Device Configuration > SNMP. 2. Select the trapsink from the SNMP Trapsinks list. 3. View additional details about the selected trapsink in the Trapsink Details pane at the bottom of the GUI page. Table 54: SNMP Trapsinks parameters Name Trapsink Address Description The IP address of the host that is to receive SNMP traps. Version The version of the trapsink (1, 2, or 3). Port State The port number of the host. The state of the trapsink (off, on). Table 55: SNMP Trapsink Details parameters Name Trapsink Address Description The IP address of the host to receive SNMP traps. Version The version of the trapsink (1, 2, or 3, default is 1). Port State Community (version 1 and 2 only) The port number of the host. The state of the trapsink (off, on). The community string can be set by the network manager (default is public). Table Continued Viewing SNMP trapsinks list and individual details 163

164 Name User Name (version 3 only) Auth Algorithm (version 3 only) Priv Algorithm (version 3 only) Context Name Description The user name assigned to this trapsink. The user authentication algorithm used to authorize messages sent or received on behalf of the listed user (MD5 or SHA, default is MD5). Optional. The SNMP version 3 privacy algorithm used to encrypt messages sent or received on behalf of this user (DES or AES, default is DES). Optional. The name of the SNMP context. (SNMP context is a collection of management information accessible by an SNMP entity.) Optional. Adding an SNMP trapsink 1. From the Navigator, select Device Configuration > SNMP. 2. On the SNMP Trapsinks tab, click Add. 3. In the Add New Trapsink window, select the protocol (IPv4 or IPv6). 4. Enter the IP address of the host that will receive the SNMP traps. 5. Select the Events that will be sent to the SNMP trap. The default is INFO. 6. Enter the port number of the host. The default is Select the version of the trapsink. The default is 1. SNMP version 1 will incorrectly report the IP address of a trap source when in an IPv6 configuration. HPE recommends using SNMP version 2 or higher when in an IPv6 configuration. 8. If you selected version 3, the window expands to display additional fields. a. Enter the User Name. b. Select the Auth Algorithm. The default is MD5. c. Enter the Auth (user authentication) Password. The default is no password set. Passwords must contain at least eight characters. Optional. d. Select the Priv Alogrithm. The default is DES. e. Enter the Priv (privacy) Password for SNMP version 3 and decryption. The default is no password set. Passwords must contain at least eight characters. Optional. f. Enter the Context Name. Optional. 9. Click OK. 10. In the Success window, click OK. 164 Adding an SNMP trapsink

165 Modifying an SNMP trapsink 1. From the Navigator, select Device Configuration > SNMP. 2. On the SNMP Trapsinks tab, select the trapsink to modify. 3. Click Modify. 4. In the Modify Trapsink window, edit the Events, Port, and Version fields (and others, if the trapsink is version 3) as needed. You cannot modify the IP Address. 5. Click OK. 6. In the Success window, click OK. Deleting an SNMP trapsink 1. From the Navigator, select Device Configuration > SNMP. 2. On the SNMP Trapsinks tab, select the trapsink to delete. 3. In the Delete Trapsink window, click OK. 4. In the Success window, click OK. Viewing the SNMP Users list 1. From the Navigator, select Device Configuration > SNMP. 2. Select the SNMP Users tab. The SNMP Users tab allows you to view information about pre-configured users. Users can be added and configured using the StoreOnce CLI. Table 56: SNMP Users parameters Name User Name Group Name Auth Algorithm Auth Password Description This is the authorized user name. The group name this user belongs to: noauthnopriv messages are not authenticated or encrypted AuthNoPriv messages are authenticated but not encrypted AuthPriv messages are authenticated and encrypted This optional parameter specifies the user authentication algorithm used to authorize messages sent or received on behalf of this user (default is MD5). This optional parameter specifies the user authentication password (default in no password set). Passwords must contain at least eight characters. Table Continued Modifying an SNMP trapsink 165

166 Name Priv Algorithm Priv Password Description This optional parameter identifies the SNMP version 3 privacy algorithm used to encrypt messages sent or received on behalf of this user (default is DES). This optional parameter specifies the privacy password for SNMP version 3 and decryption (default is no password set). Passwords must contain at least eight characters. Adding an SNMP user 1. From the Navigator, select Device Configuration > SNMP. 2. Select the SNMP Users tab. 3. Click Add. 4. Enter the authorized user name. 5. Select the group name this user belongs to. 6. The default is noauthnoprivgroup. 7. If you selected authnoprivgroup or authprivgroup, the window expands to display additional fields. a. Select the Auth Algorithm. The default is MD5. b. Enter the Auth Password. c. Select the Priv Algorithm. The default is DES. d. Enter the Priv Password. 8. Click OK. Modifying an SNMP user 1. From the Navigator, select Device Configuration > SNMP. 2. Select the SNMP Users tab. 3. Select the user to modify. 4. Click Modify. 5. In the Modify User window, edit the Group Name. You cannot modify the User Name. 6. Click OK. Deleting an SNMP user 1. From the Navigator, select Device Configuration > SNMP. 2. Select the SNMP Users tab. 3. Select the user to delete. 4. Click Delete. 5. In the Delete User window, click OK. 166 Adding an SNMP user

167 SNMP Events page The SNMP event page lists the severity level of the destined trapsinks for which it is configured. Table 57: SNMP Events parameters Name Severity Trapsink Destination Description The severity level of the trap (Info, Warning, or Alert)). The severity level reported depends on the way the trapsink was configured: Info receives traps for all levels (Info, Warning, Alert) Warning receives traps for Warning and Alert Alert receives traps for Alert only The destination IP address for the trapsink when an event occurs on the StoreOnce appliance. Support Ticket (administrators only) The Support Ticket page provides information about the Support Ticket configuration. Hewlett Packard Enterprise support will ask customers to upload support tickets to an FTP site to aid diagnosis of issues a customer may be experiencing. Information about support tickets that have been generated is found under the Data Collection topic. See Data collection on page 168. The following support tickets are available: Full support ticket provides a complete set of data for diagnosing problems Basic support ticket provides a subset of the full support ticket information and is generated more quickly. Providing Hewlett Packard Enterprise support with a basic support ticket while the full support ticket is being generated can greatly speed up the overall support process. To modify the Support Ticket configuration Click Modify, make the required changes, and click OK. Table 58: Support ticket parameters Name Automatic data collection enabled Number of data sets to be retained Send system configuration by enabled SMTP server Description Shows whether data collection for a system crash is enabled or not. The retention policy. The number denotes the number of previously collected tar files to be retained in each node. After each data collection, a zip file containing specified StoreOnce and system command outputs representing the system configuration may be sent. This can be enabled or disabled. SMTP server used to send the configuration information. Port The port used to send the configuration information. Table Continued SNMP Events page 167

168 Name From To Description ID from which the configuration will be sent. ID to which configuration will be sent. Data collection This page provides a log of generated data collections called a support ticket. Collect a full or basic support ticket, download it, and delete it from this page. Note that full support tickets can be quite large in size. The Collect, Download, Delete, and Delete All buttons are only available in the GUI to administrators. However, operators can still Collect and Delete support tickets using the CLI. IMPORTANT: Support tickets created for the StoreOnce System are saved locally on the node running the active management service at the time of collection. Hewlett Packard Enterprise recommends downloading that support ticket as soon as possible before doing anything else to the system such as rebooting or changing a node to maintenance. If the active management service moves to another node before the ticket downloads, the ticket cannot be retrieved from the StoreOnce Management GUI. Table 59: Data collection parameters Name Name Description Basic Support Ticket State Full Support Ticket State Date Initiator Basic Support Ticket Size Full Support Ticket Size Description The name assigned to the data collection. Description of the data collection. The state of the basic support ticket data collection. A collection process can be in one of the following states: COLLECTING, COLLECTED, PARTIALLY_COLLECTED, PACKAGING, DELETING, DOWNLOADED, or FAILED. The state of the full support ticket data collection. A collection process can be in one of the following states: COLLECTING, COLLECTED, PARTIALLY_COLLECTED, PACKAGING, DELETING, DOWNLOADED, or FAILED. Timestamp of when the data was collected. The initiator of the data collection. A collection can be invoked manually or automatically during a system crash. The size of the basic support ticket data collection. The size of the full support ticket data collection. 168 Data collection

169 Collect data The Collect operation collects data such as log files and system command output and compiles it into a full support ticket. At the same time, a basic support ticket is created that contains a smaller subset of that data. The data is collected in tar files that are assigned a name. Once collected, use the Download button to get the collected data for the full and basic support tickets. 1. Click Collect. 2. Enter the name of the tar file for the full support ticket. The basic support ticket uses the same name with _basic appended to the end of the name. 3. Click OK. The operation to run a full support ticket may take some time. The equivalent StoreOnce CLI command is support create ticket and is accessible to both administrators and operators. The logs and command outputs collected will be stored in the active StoreOnce Node Manager, ready for Download. Download data collection Use the Download button to download the selected data collection. Select whether you want to download the basic or the full support ticket. Hewlett Packard Enterprise recommends downloading the support tickets as soon as possible before doing anything else to the system such as rebooting or changing a node to maintenance. If the active management service moves to another node before the tickets download, the tickets cannot be retrieved from the StoreOnce Management GUI. IMPORTANT: If using Internet Explorer as the web browser, verify the following Security configuration options are set. If not, the download will not work as expected and there will be no error message. 1. Add Enable download. Other browsers, such as Mozilla Firefox and Google Chrome process the download correctly, without further configuration. Delete data collection Use the Delete button to delete the selected data collections, or Delete All to remove all data collections. This operation removes the tar files on each node from the system. This operation may take some time. The equivalent CLI command is support del ticket and is accessible to both administrators and operators. Maintenance The Maintenance page provides the ability to shut down or reboot the system hardware. Collect data 169

170 This page is also used to enable or disable failover. Enable Failover: Enables failover on all of the nodes within the cluster. This function is the same as using the CLI system enable failovercommand. This button is inactive if failover is already enabled on all nodes. If some nodes are enabled and some are disabled, the Enable Failover button is active and will act to enable failover on all of the nodes. During normal use, failover should always be enabled for all nodes or the cluster is not resilient to hardware failures affecting a node. The status of failover for each service set can be seen on the GUI. If any nodes have failover disabled, use the Enable Failover button to enable failover on those nodes. Disable Failover: Disables failover on all of the nodes within the cluster. This function is the same as using the CLI system disable failover command. This button is inactive if failover is already disabled on all nodes. If some nodes are enabled and some are disabled, the Disable Failover button is active and will disable failover on all of the nodes. Shutdown: Shuts down the StoreOnce appliance. Storage enclosures, switches, and other hardware components are not affected and must be powered off manually after shutting down the StoreOnce server node. This function is the same as using the CLI system shutdown command. This will cause a shutdown of all of the nodes within the cluster. This button is inactive if failover is enabled; disable failover to activate the Shutdown button. Reboot: Reboots the StoreOnce appliance. Storage enclosures, switches, and other hardware components are not affected. This function is the same as using the CLI system reboot command. This will cause a reboot of all of the nodes within the cluster. This button is inactive if failover is enabled; disable failover to activate the Reboot button. License management Instant-on licenses The Instant-on licenses are sometimes called the Demo licenses. The Instant-on licenses are available for all StoreOnce Systems for a period of 90 days. There are two Instant-on licenses: one for StoreOnce Catalyst and one for StoreOnce Replication. These licenses allow you to try out the features in StoreOnce appliances without having to purchase a full license in advance. The licenses must be activated as described in the next section. These licenses does not include capacity expansion, optional hardware, or the Security Pack. To continue using these features, licenses must be purchased for StoreOnce Catalyst and Replication and applied within the Instant-on period. If they are not, data is not lost but: Replication: Replication Target libraries will continue receiving replicated data, however, you will receive notification every 24 hours that your license has expired. StoreOnce Catalyst: Catalyst stores will still be available as target devices for backup, however, you will receive notification every 24 hours that your license has expired. 170 License management

171 Full license entitlement Features that require a license include a license entitlement certificate with the hardware product. This is either an electronic document provided at purchase, such as Replication, StoreOnce Catalyst, Security (Data at Rest Encryption, Data in Flight Encryption, or Secure Erase), or a paper document provided with a capacity upgrade kit or optional hardware. The document contains all information required to obtain a unique License to Use (LTU) key. Obtain the key from the Hewlett Packard Enterprise Licensing site by connecting to the web address specified on the certificate and following the instructions. (Users without Internet access may use the contact numbers provided with the entitlement certificate.) You will be required to enter the product's serial number when requesting an LTU key. This is the Node Lock Serial Number/Cluster ID on the License Management page. Redeeming a license 1. In the Navigator pane, click on License Management. 2. On the License Management page, identify the Node Lock Serial Number/Cluster ID at the top of the page. You will need this number to redeem licenses. a. The serial number will be a 14 character cluster ID (not the ID of any individual node). The first two characters will be hp and are required. Any alphabetic characters in the serial number are upper case. 3. Copy the serial number to a text file. 4. Go to the Hewlett Packard Enterprise Licensing website at redirector/home (select Hewlett Packard Enterprise Software Licenses and Downloads ). 5. Log in using your Hewlett Packard Enterprise Passport user ID and password. 6. Enter your product serial number. 7. Obtain the unique LTU key by saving the license to a.dat file, ing the file to the registered license owner's address, or cutting and pasting to copy the key to a temporary text file. Adding a license by pasting a license string Before you add a license, you must redeem the license. See Redeeming a license on page In the Navigator pane, click on License Management. 2. On the License Management page, click Add License. 3. For the Input Type, select Key String. 4. In the License Key box, type or paste the license string. To enable an instant-on license, type in the word demo. IMPORTANT: You must exclude the license description, for example #HPE StoreOnce 16Gb FC Card LTU, from the beginning of the license string. Otherwise, the license operation will fail. 5. Click OK to apply the license, or Cancel to stop the operation. If the license fails, a dialog box will appear that shows error details. Click OK to return to the License Management page. Adding a license by loading a license file Before you add a license, you must redeem the license. See Redeeming a license on page 171. Full license entitlement 171

172 Loading a license from the StoreOnce System license directory 1. If you saved the LTU as a.dat file, you will need to sftp it into the StoreOnce System's licenses directory. a. Using Linux sftp Admin@<Management_VIF> sftp Admin@<IP_address> cd licenses put <LTU>.DAT exit sftp b. Using a Windows sftp client Ensure the File Protocol is set to SFTP, not SCP. Login to the StoreOnce GUI as Admin. Copy <LTU>.DAT to licenses. 2. In the Navigator pane, click on License Management. 3. On the License Management page, click Add License. 4. For the Input Type, select Load License File. 5. A list of licenses that are available in the repository directory will be displayed. 6. Select the license file you want to apply. Click OK. If the selected license passes validation, a dialog box will appear to report that the license has been applied successfully. If the license fails validation, an error message will appear. 7. Click OK to return to the license page. Loading a license from your local drive In the Navigator pane, click on License Management. On the License Management page, click Add License. Click OK. If the selected license passes validation, a dialog box will appear to report that the license has been applied successfully. If the license fails validation, an error message will appear. Viewing license information on the StoreOnce GUI 1. On the License Management page, you will see sections covering all available license types for your product. Any applied licenses will be listed underneath the appropriate section. Hardware license fields For StoreOnce hardware products, there will be multiple license fields on the License Management page: Capacity Expansion Licenses: Required when additional storage is added to StoreOnce 6500 and 6600 Systems Security Licenses: Required for Data at Rest Encryption, Data in Flight Encryption, and Secure Erase. The license is per couplet, but each couplet must have a Security license installed. 172 Viewing license information on the StoreOnce GUI

173 Catalyst Licenses: Required on each target site (or couplet) where StoreOnce Catalyst is used and each couplet must have a StoreOnce Catalyst license installed Replication Licenses: Required on each target site (or couplet) where Replication is used Fibre Channel Controller Licenses: Required for each Fibre Channel card that is installed in the optional hardware PCI-E slots. Network Controller Licenses: Required for each 10GbE Network card that is installed in the optional hardware PCI-E slots. The fields in the hardware sections on the GUI License Management page include: Description: Description of the type of license Valid From: The date and time the license was first activated Expires: The date and time the currently applied license will expire Capacity (Capacity Expansion Licenses only): The expansion license capacity Viewing license details 1. On the License Management page, click on the Description of the license you would like to view details for. The License Details dialog box will appear. Review the license information. 2. Click OK to return to the License Management page. License details fields The License Details dialog box contains the following fields: Name: The license name Description: Description of the type of license Valid From: The date and time the license was first activated Expiration: The date and time the currently applied license will expire Key: The full license key information, including the name of the license (which will be in quotation marks, for example, Hewlett Packard Enterprise StoreOnce 10GbE sfp Network Expansion). License Type: The license type, which can be Fixed Term, Permanent, Evaluation, or Not For Resale Time and Date GUI page From the Time and Date page, you can view the current date and time, and configure the date, time, time zone, and NTP servers. For more information Viewing current date and time setting Resetting the time zone to the default UTC Changing the time zone Changing the date and time Viewing current date and time setting This page refreshes every 15 seconds. 1. In the Navigator, select Device Configuration > Time and Date. 2. View the read-only information: Viewing license details 173

174 Time, in the format HH:MM:SS Date Time zone, a three character timezone identifier (for example, UTC) Resetting the time zone to the default UTC 1. In the Navigator, select Time and Date. 2. Click Reset Time Zone. 3. In the Reset Date and Time settings window, click Yes. The time and date are reset to UTC (universal time). Changing the time zone 1. In the Navigator, select Time and Date. 2. Click Modify. 3. In the Modify Date and Time window, click OK. (Modify Time Zone Manually is selected by default.) The screen expands to include a Time Zone section. 4. Select your region. 5. Select your country. 6. Select the applicable time zone. 7. Click Apply. 8. In the Apply Time Zone settings window, click Yes. The date and time reflect the new time zone selection. Changing the date and time 1. In the Navigator, select Date and Time. 2. Click Modify. 3. In the Modify Date and Time window, select Manually Modify Date and Time. 4. Click OK. The screen expands to include a Date and Time section. 5. Click the calendar icon and select the date. 6. Select the hour, minute, and seconds. 7. Click Apply. 8. In the Apply Time Zone settings window, click Yes. The date and time reflect the new selection. Adding an NTP server configuration The NTP server configuration provides the option of setting the time and date using one or more NTP servers. When using the NTP server to configure time and date, manual entry of time and date will be disabled. You can add up to two NTP server configurations. 1. In the Navigator, select Time and Date. 2. Click Modify. 174 Resetting the time zone to the default UTC

175 3. In the Modify Date and Time window, select Modify NTP server settings. 4. Click OK. The screen expands to include an NTP Server section. 5. Click Add. 6. In the Add NTP Server window: a. Select the NTP server type: IPv4, IPv6, or Fully Qualified Domain Name. b. Add the chosen NTP server address. 7. Click OK. If the supplied NTP server address is reachable from the StoreOnce appliance, the address will be added to the NTP configuration and NTP time correction will be enabled. There is no check that the NTP server is reachable after it is added to the configuration. 8. In the confirmation dialog box, click OK. If the NTP time is behind the currently configured time on the appliance, you will see a warning dialog box that reminds you to reboot the system using the system reboot command, and that system time will move backward as a result of that command. Deleting or disabling an NTP server configuration 1. Select that row that contains that configuration in the NTP server table. 2. In the title bar, click Delete. 3. In the confirmation dialog, click Yes. 4. To disable the NTP configuration entirely, uncheck the NTP selection enabled box. You can now manually set the date and time from the Time and Date GUI page; see Changing the date and time. Optional hardware You may order a base configuration for your StoreOnce model and then specify additional Network or Fibre channel cards to be installed either in the factory or at a later date in the field. All optional hardware must be licensed and added to the base configuration before it can be used. The Optional Hardware page allows you to view new or existing optional hardware, the status of licenses on your installed optional hardware, and any errors that exist that may prevent license activation. From this GUI page, you can also view details about specific optional hardware licenses, and you can activate your optional hardware licenses. What is Optional Hardware? For 6500 Systems: Optional hardware is not supported on 6500 Systems. However, if adding a StoreOnce 6600 couplet to a 6500 cluster, 2 x 8 Gb Fibre Channel cards must be installed in the Optional Hardware PCI-E slots of each node of the StoreOnce 6600 couplet. For 6600 Systems: Deleting or disabling an NTP server configuration 175

176 Two PCI-E slots (5 & 6) may be configured according to backup environment requirements. Network and Fibre Channel cards must be installed in pairs (two Fibre Channel cards or two network cards). Available options are 10 GbE SFP Network cards, 8 Gb Fibre Channel cards, or 16 GbE Fibre Channel cards. The optional hardware configuration must be the same for all couplets in a cluster. Table 60: Flexible configuration options for StoreOnce Systems Product Name Optional PCI-E slots Card choices StoreOnce 6600 Systems Yes, 2 per node 10 GbE SFP Network 8 Gb Fibre Channel 16 Gb Fibre Channel Validating new licenses and updating controller card status After you have added a new license on the License Management page, you will need to validate your new license on the related hardware from the Optional Hardware page. You can use the Licensing Page link at the top of the Optional Hardware Configuration page if you have new licenses to add before validating the installed hardware configuration. 1. In the Navigator pane, select Optional Hardware. 2. An Information box will notify you that if any licenses have been added, you need to validate them from this page in order to update the controller card status information. Click OK. 3. In the top right corner of the Optional Hardware Configuration page, click Validate. The licenses you have applied using the Licensing Page will be scanned for pairing with the hardware components. Clicking Validate will also re-validate all previously installed and configured current controller cards. 4. In the Validate Configuration box, you will see a list of installed optional hardware. If new controller cards been added and have licenses that are ready to be activated, the Slot Message column will show Ready to License. To proceed with license activation, click Activate. 5. An In Progress message will appear, and then if the licenses have been properly mapped and have been applied to the hardware, a Success message will appear. Click OK. 6. If the licenses do not validate, the hardware cannot be activated. A failure message will appear. Correct the error condition and then return to the Optional Hardware to attempt to re-validate your hardware licenses. The hardware monitoring will restart (and the GUI will be updated), which takes up to five minutes. Viewing details for currently configured licenses 1. In the Navigator pane, select Optional Hardware. 2. An Information box will notify you that if any licenses have been added, you need to validate them from this page in order to update the controller card status information. Click OK. 3. In each controller card entry there is a License column. Cards with currently activated licenses will have a Details hyperlink in the License column. Click Details. 4. View the name, description, valid from date, expiration date, key, and license type. Click OK when you are finished. 176 Validating new licenses and updating controller card status

177 Controller card status fields The StoreOnce 6500 and 6600 System will have multiple tabs containing Controller card status, one for each couplet. You will also see Node, Couplet, and Cluster messages on the Optional Hardware page. Table 61: Controller card status fields Field Slot Controller Status Slot Message License Description Shows the slot where the PCI-E controller card is located. This field is also present in the Validate Configuration dialog box. Describes the type of controller card in the slot. For example, a network expansion card, or a fibre channel expansion card. This field is also present in the Validate Configuration dialog box. Shows the status of the controller card: Green tick/licensed Red X/Unlicensed Red X/Failed Red X/Invalid Describes the hardware licensing status. This field is also present in the Validate Configuration dialog box. See Optional Hardware Configuration page slot messages on page 177 This field provides a Details hyperlink for controller cards with valid licenses. This link takes you to the License Details dialog box. The License Details dialog box contains: Name: The controller card name Description: Description of the card Valid From: The date and time the license was first activated Expiration: The date and time the currently applied license will expire. Key: The full license key information, including the name of the controller card License Type: The license type (permanent licenses only) Optional Hardware Configuration page slot messages The Optional Hardware Configuration page allows you to validate any licenses you have applied for additional controller cards. If there is an issue with the licensing or hardware, you will see a message in the Slot Message field on the Optional Hardware Configuration page and/or the Validate dialog box on that page. Slot messages will be delivered in the order of priority (hardware messages first), and only one message will be displayed per slot. Controller card status fields 177

178 Table 62: Optional Hardware messages Message Description Recommended action No optional hardware fitted No optional hardware fitted Verify that the card has been installed properly. See the StoreOnce System Installation and Configuration guide for your product. Valid hardware with valid license Failed hardware found Unlicensed hardware found Invalid hardware found (license mismatch) Hardware reported as degraded The hardware is valid and licensed There is a valid license but the hardware is in a failed/degraded state The hardware is valid but unlicensed The hardware is valid but does not match the license The hardware is reported as degraded No action required. Contact Hewlett Packard Enterprise Support. Verify that the Optional Hardware has been licensed as described in Validating new licenses and updating controller card status on page 176. Contact Hewlett Packard Enterprise Support. Contact Hewlett Packard Enterprise Support. Hardware missing The hardware is missing Verify that the card has been installed properly. See the installation and configuration guide for your product. Card installed in wrong location The card has not been installed in the correct PCI-E slot. Verify that the cards were installed in the correct order. See the StoreOnce 10GbE Network Card and Fibre Channel Card Installation and Configuration guide. Hardware mismatch Hardware configuration mismatch Verify that the cards were loaded in the correct order. See the StoreOnce 10GbE Network Card and Fibre Channel Card Installation and Configuration guide. Hardware reporting as failed Hardware is in a failed state Contact Hewlett Packard Enterprise Support. Table Continued 178 Access and Device Configuration

179 Message Description Recommended action Unsupported hardware found Hardware in unsupported type/ model Verify that you have installed the appropriate StoreOnce Optional Hardware. Invalid hardware The hardware is invalid Contact Hewlett Packard Enterprise Support. Security features The StoreOnce System offers the security features of Data at Rest Encryption, Data in Flight Encryption, and Secure Erase. They can be applied using a Security license. See License management on page 170 for information on how to apply the Security license for these features. Data at Rest Encryption When enabled, the Data at Rest Encryption security feature protects data at rest on a stolen, discarded, or replaced disk from forensic attack. Creation of a new VTL library, StoreOnce Catalyst store, or NAS share provides the option to enable encryption if the security features license was already applied. Once enabled, encryption will automatically be performed on the data before it is written to disk. Encryption cannot be disabled once it is configured for a VTL library, StoreOnce Catalyst store, or NAS share. Each configured VTL library, StoreOnce Catalyst store, or NAS share uses a different key. The StoreOnce software automatically tracks which key is relevant to which device in the Key Store File. Keys are automatically re-applied to the correct device if the key store file is restored. IMPORTANT: Be very diligent about backing up your key store if you are creating encrypted stores or libraries. See the StoreOnce System CLI Reference Guide for more information about the StoreOnce CLI commands for backing up and restoring key stores. Every time that you expand storage by adding a couplet, you must restore your key store. Installing the additional couplet is an Hewlett Packard Enterprise support task, but you are responsible for ensuring that a Security license is installed for the new couplet and for saving the existing key store. The encryption feature is licensed per couplet. If you have multiple couplets in the StoreOnce System cluster, obtain and apply a Security license for each couplet in the cluster. When mapping replication to target devices on a different StoreOnce System, Hewlett Packard Enterprise recommends that encryption is licensed and enabled on both the source and the target couplet or appliance. Data in Flight Encryption Data in Flight Encryption is intended to be used to secure network links between data centers for StoreOnce VTL or NAS Replication, or for Low Bandwidth Catalyst Copy operations. Using Data In Flight Encryption for direct backup operations to the StoreOnce appliance over a local network is not supported due to the performance impact of the encryption. When enabled, the Data in Flight Encryption security feature protects data that is in transit from forensic attack using the IPsec protocol. The data can be Security features 179

180 moving between two StoreOnce appliances over a WAN or a StoreOnce appliance and a backup server over a LAN or WAN. Data in Flight Encryption encrypts the data traffic to all the stores using that IP connection. Therefore, it may have an impact on performance. IMPORTANT: Data in Flight Encryption is not supported for IPv6 subnets. In the StoreOnce Management Console, you will not see the Encryption Links section if an IPv6 subnet is selected. In the StoreOnce CLI, a configuration command will fail if you attempt to configure Data in Flight Encryption on an IPv6 subnet. Data in Flight Encryption can be configured in two ways: Using the net [add/delete] encryption commands in the StoreOnce CLI. See the StoreOnce System CLI Reference Guide for more information. Using the StoreOnce GUI. See To add encryption to a subnet on page 192 and Encryption guidelines on page 193. Key managers The StoreOnce System can use either a local key manager or an external key manager to manage keys for Data at Rest and Data in Flight Encryption. The local key manager is used unless the system has been configured to use an external key manager. Two external key manager products are supported: Hewlett Packard Enterprise Enterprise Secure Key Manager and SafeNet KeySecure. At any point in time, the StoreOnce System can be configured to use only the local key manager or the external key manager. Both key manager types cannot be used at the same time. When using the local key manager, the local key store contains the encryption keys used either for Data at Rest Encryption or Data in Flight Encryption. Each time a new encrypted VTL library, NAS share or StoreOnce Catalyst store is created or deleted, the key store is updated. The key store is also updated when a data in flight encryption link is created or deleted. Users are advised to back up the local key store, using the StoreOnce CLI commands, and save it securely off site in case the original key store is corrupted. However, only the latest version of the key store must be kept after each creation or deletion of an encrypted VTL library, NAS shares, StoreOnce Catalyst store or data in flight encryption link. When using an external key manager, the local key store contains only the credentials required to authenticate with the external key manager. Users are advised to back up the local key store after the StoreOnce System has been successfully configured to use the external key manager. All the encryption keys used either for Data in Flight Encryption or Data at Rest Encryption are stored and managed by the external key manager. Refer to Enrolling a StoreOnce appliance with an external key manager on page 181 for instructions on how to configure the StoreOnce appliance with an external key manager. Secure Erase Secure Erase can be enabled for all store types. This feature allows secure erasure of data that was backed up as part of a regular backup job. For example, you may have unintentionally backed up confidential data and need to be sure that it has been securely erased. The Secure Erase feature can only be enabled after the VTL library, NAS share, or StoreOnce Catalyst store has been created (edit the share, store, or library to enable Secure Erase). Once Secure Erase is enabled, all data written to disk will be securely erased upon data deletion. The Secure Erase operation involves overwriting the data to be deleted with a sequence of 0, 1 or Pseudo random data depending on the number of overwrite passes. Secure Erase can be configured to overwrite the data to be deleted with either one, three, five, or seven passes. The amount of time required to complete the Secure Erase increases with the number of overwrite passes. It is not advisable to leave Secure Erase turned on permanently as this will have a negative impact on the performance of the system due to increased disk I/O. 180 Access and Device Configuration

181 When Secure Erase is enabled for a VTL library, NAS share, or StoreOnce Catalyst store, any data deletion operation is performed securely. Work with the backup application to trigger the Secure Erase, for example by forcing the format of a VTL cartridge. The backup application sends the request to delete the data and the deletion is carried out as part of the Housekeeping function. Secure Erase can also be triggered by manually deleting a VTL cartridge, StoreOnce Catalyst object, or even a whole VTL Library, NAS Share, or StoreOnce Catalyst store through the StoreOnce web interface or CLI. The Secure Erase process may take some time to complete, depending on the Housekeeping workload. WARNING: To immediately remove data, ensure the backup application is configured correctly. Rotation and retention policies may need to be revisited to ensure that the data is expired. Only data chunks (processed portions of user data) not referenced by any other items can be securely erased. If a data chunk is referenced by another item which is not marked for Secure Erase, then the referenced data chunk will not be erased, securely or otherwise. It is recommended to use the backup application when performing a Secure Erase on StoreOnce Catalyst stores, NAS shares, or VTL libraries that have Secure Erase enabled. Enrolling a StoreOnce appliance with an external key manager Prerequisites A client account must be created on the External Key Manager for the StoreOnce appliance. This account is used in the enrollment process. Ensure that you have the username and password of the client account prior to commencing the enrollment process. The Security Pack license must be purchased and installed on the StoreOnce appliance. Unless the license is installed, you will not be able to create an encrypted VTL, NAS share or StoreOnce Catalyst store or set up a Data in Flight Encryption link. The enrollment is done using StoreOnce CLI commands. For details about the individual commands, refer to the HPE StoreOnce CLI Reference Guide. 1. In an SSH terminal window (for example, Putty), connect to the StoreOnce appliance. 2. Generate a certificate signing request (CSR). 3. Specify the username and password of the client account on the external key manager. You can also optionally specify the DN values for the StoreOnce appliance. Send the following command: keymanager create <username> <password> [dnvalue] Example: keymanager create test_account password123 "/OU=HPSP/O=HP/L=Andover/ST=MA/ C=US" If the command is successful, a certificate request will be generated as output. Example: -----BEGIN CERTIFICATE REQUEST----- MIICvDCCAaQCAQAwdzENMAsGA1UEAwwEbm9lbDESMBAGA1UECwwJSFBTdG9yYWdl Enrolling a StoreOnce appliance with an external key manager 181

182 MSEwHwYDVQQKDBhIZXdsZXR0UGFja2FyZEVudGVycHJpc2UxEDAOBgNVBAcMB0Jy axn0b2wxedaobgnvbagmb0vuz2xhbmqxczajbgnvbaytakdcmiibijanbgkqhkig 9w0BAQEFAAOCAQ8AMIIBCgKCAQEApVzkrDgzcIQ1o0QtkheHX45MGfNVECd+q/v4 i5bz9aajfypukcxarhzjl8qenfl66tn9wtksuv/dhdynvwnkam6wurserlbzo7r9 lmscgujpa9mn7qdf3e6sqn4dgl/2lw66j4h++h0ks5hw1qvde9rto9fnprwrcqbl FiH2PKhbtjN7mreUX407mw9043fVgUr7PgQvX2WD/m4PZ07AbrvGzNMJDfWNBy3Z Gl+ +tvxetd5j8tfdnezqgxm/ye1s75q02s+ra572z1sd9pp+wm4spa7w8m4g1fc+ wfy5nxdohw80amhjfdghdyzbrbcdk6l5hn7uzdfjdt0gy20p6qidaqaboaawdqyj KoZIhvcNAQEFBQADggEBAGQ5AwCAZWaiomcMcb3sCVxsHnxQtK8fs89EuIfr2UuW xtre3bq1l/w3emopbqn2gdku3fxs3lfhwbkrnpvspkewyrmdjaalqhungzc0c1+5 X07mtqnSg3vsK3ZjJ1PBD17ffqvlv0LwggTGbjpYGEyqKkl/loj9/q7CM7PDFlhS 1gOIvqxBRB7NmWhZlw4oduZBUAY79w0J42OO04DA/oIyWyTmhEDrN4m3YtQI8BDv ueoem +HkfEhz6fDjFslzGjQokm8Wtu0rXKI0POmegOHPusYMphT5ZB6kgK2PkOTr I/ 3xjCsMggxxn7pWbvhls6MD6w5Si1CrS61Yg15qvck= -----END CERTIFICATE REQUEST Select and copy the entire CSR. 5. In a browser window, log in to the external key manager web interface. 6. Click the Security tab. 7. In the navigation column, select Local CAs to open the Local Certificate Authority List. 8. Select the appropriate CA which will be used to sign the CSR generated in step Click Download. This will download the CA certificate to your local machine. Note the name of the downloaded certificate and the location where it has been saved. 10. Click Sign Request. This will take you to the Sign Certificate Request page. 11. Select the appropriate certificate authority from the drop-down list. 12. Select the Client radio button as the Certificate Purpose. 13. Set an appropriate value as the Certificate Duration. 14. Paste the certificate signing request from step 3 into the Certificate Request text box. 15. Click Sign Request. The page will refresh and the signed certificate will be displayed. 16. Click Download to save the file to your local machine. Note the name of the downloaded certificate and the location where it has been saved. 17. Open an SFTP session (use your preferred SFTP client) to your StoreOnce appliance. 18. Copy the two certificates from steps 9 and 16 to the StoreOnce appliance /repository folder using administrator credentials. 19. Return to your StoreOnce appliance CLI console. 20. Import the two certificates that were just copied to the /repository folder. You must specify the two certificates and the password of the client account (as in step 3). Example: keymanager import ESKM_CA.crt signed.crt password Enroll the StoreOnce appliance with the external key manager. You will need to specify the username and password of the client account, the IP address of the external key manager, the type of external key manager (ESKM or SafeNet KeySecure) and the CA name (from step 8). Example: keymanager mode external test_account password123 address type hp_eskm ESKM_CA 182 Access and Device Configuration

183 The CA name is only required when enrolling with an ESKM key manager. It is not required when enrolling with the SafeNet KeySecure key manager. 22. To verify that the enrollment is successful, send this command: keymanager mode show You will see Mode:EKM when enrolled with an external key manager. If the enrollment fails, an error message is displayed. Rectify the issue before proceeding. 23. Run the following command: keymanager mode local remove 24. When step 23 is complete, go back and repeat steps 20 and 21. If an incorrect client account was used, run the command in step 23 and then repeat the whole procedure from step 1. To revert back to the local key manager mode at any time, run the following CLI command: keymanager mode local remove Expanding a cluster If you are expanding a 6600 cluster to add a new couplet, then you will need to run the following command after the cluster expansion process has completed: keymanager expand cluster Until this command has been run, the state of the cluster will be reported as Recovery Required when you run the keymanager mode show command. Expanding a cluster 183

184 Network configuration The StoreOnce System supports both IPv4 and IPv6 address protocols. IPv4 is available for all target devices except VTL libraries and for appliance management; IPv6 is supported for StoreOnce Catalyst stores, NFS shares, VTL libraries, and appliance management. IMPORTANT: Active Directory authentication with IPv6 is only supported with Domain Controllers configured using IPv6 exclusively. If the Domain Controller is configured with both IPv4 and IPv6 addresses, the StoreOnce appliance will default to IPv4 to join the AD domain. IMPORTANT: Data in Flight Encryption is not supported for IPv6 subnets. In the StoreOnce Management Console, you will not see the Encryption Links section if an IPv6 subnet is selected. In the StoreOnce CLI, a configuration command will fail if you attempt to configure Data in Flight Encryption on an IPv6 subnet. Data in Flight Encryption is intended to be used to secure network links between data centers for StoreOnce VTL or NAS Replication, or for Low Bandwidth Catalyst Copy operations. Using Data In Flight Encryption for direct backup operations to the StoreOnce appliance over a local network is not supported due to the performance impact of the encryption. Network Configuration List Under StoreOnce Device Configuration, expand Network Configuration by clicking + to expand Network Configuration in the Navigator and access the network configuration list. The network configuration list page shows the name and description of the network configurations that are created. Only one configuration is currently active, this is named current. There will also be a Factory_Default_Configuration and may be up to 14 Custom configurations created by the user. There is a minimum of two entries: Factory_Default_Configuration and current. current is the active network configuration. Factory_Default_Configuration is the default network configuration for hardware products at delivery. The configuration is empty on delivery and after Quick Restore, QR, and the network must be configured. There may be up to 14 custom configurations created by the user. Some systems may have a net_address entry. This configuration is created by running the CLI command net set address. Some systems may have a net_wizard entry. This configuration is created by running the CLI command net set wizard. For all other configurations: the Name field is the name provided by the user when creating or copying a configuration. (Names must always be unique.) The Description field is the description provided by the user when creating or copying a configuration. Current Network Configuration This page shows the current network configuration. This is the active configuration and cannot be edited. However, the current configuration is a copy of the last activated configuration; the original remains (unlinked) and can be modified. 184 Network configuration

185 The current configuration page has two tabs. Configuration shows the settings that have been applied to the configuration by the user. Status shows the actual settings that are reported based upon that configuration. This page contains the following main sections: DNS server details, Port Sets, Subnets, and Encryption Links. There are no actions available from this page and the configuration is always Protected. For a detailed description of all fields, see To add a custom network configuration on page 185. Factory Default Network Configuration This page shows the factory default network configuration. This is the configuration that was on the system when it was initially supplied and it cannot be edited. The page is for information only. If you return the system to factory defaults (by running a quick restore), this configuration will be restored. This page contains the following main sections: DNS server details, Port Sets and Subnets. There are no actions available from this page and the configuration is always Protected. For a detailed description of all fields, see To add a custom network configuration on page 185. Custom Network Configuration List Select the Custom item in the Network Configuration section of the navigation pane to display a list of all custom network configurations that have been created by the user, showing the Name and Description. Select a configuration using the checkbox on the left-hand side and use the buttons at the top of the window to perform these actions: Some actions can be performed on multiple configurations at the same time. Activate:Click this button to activate the selected custom network configuration. If the action is successful, the selected custom network configuration will become the current configuration. It is not possible to activate a new configuration if storage addition is in progress. Delete: Click this button to delete the selected custom network configuration(s). Edit: Click this button to edit the selected custom network configuration. New: Click this button to create a new custom network configuration. If a configuration is Protected, you cannot delete it until you use the Edit function to disable the Protected checkbox. To add a custom network configuration The following steps provide an overview of the process that is valid for both the StoreOnce GUI and StoreOnce CLI. 1. Create the configuration (or copy an existing one) and specify the DNS servers, as required. 2. Create the first Port Set and save the configuration. At this point you may decide to set up Subnets for the Port Set, or to continue to set up all required Port Sets before defining Subnets for each Port Set. 3. Create the required Subnets for each Port Set and save the configuration. Factory Default Network Configuration 185

186 4. Validate the configuration. 5. If validation fails, correct errors. If it passes, either activate immediately at the prompt. Or save the configuration and activate subsequently from the Custom Network Configuration List. TIP: If configuring multiple VLANs, or reconfiguring a complex network, it may take several minutes for the configuration to activate. During this time the Current Configuration page will show the previous configuration and will be updated once activation is complete for the new configuration. Step 1: Create new configuration and define DNS servers On the Custom page, click on the New button. Enter a Config Name. The name must be unique; spaces and special characters are not permitted but underscore is allowed. The Config Description is optional. However, it is good practice to put the configuration name into the description field because the description is copied to the current configuration, when the configuration is activated. Click Create. A new configuration opens for you to edit. If there is an existing configuration that you wish to use as a template, select it from the Copy Existing list. As appropriate, select IPv4 or IPv6 for any DNS servers and enter the required addresses in the appropriate format. Click Save. Table 63: Network Configuration IP protocol and DNS fields Field name Name of the configuration Protected Description This reflects the name of the configuration selected in the list. This checkbox is always greyed out for the Current and Factory Default configurations because they cannot be edited. Custom configurations can be edited and the checkbox is active to indicate their protection status. DNS server details: These settings apply across all other settings. Protocol: IPv4 or IPv6 DNS Address 1/2/3 The radio button selected defines the Internet Protocol for the DNS servers. Up to three IPv4 and/or IPv6 DNS addresses may be defined. The format of the address details is as appropriate for the protocol selected. Step 2: Create Port Sets 186 Network configuration

187 On the Port Set bar click Add to create the first Port Set. Enter a name for the Port Set and select the ports to use. Available ports depend upon the model of StoreOnce System and whether ports have already been assigned. Only those ports that are available are active for selection; others are greyed out if they are already in use. Some hardware products support optional PCI-E cards for 10 Gbit Ethernet. If your system has these cards installed and activated, they are included in the Ports section with the network type clearly indicated. See Optional hardware on page 175 for more information about optional hardware. Click on the Show Port Picture link to display a picture of the rear of the model with ports labeled. If multiple ports are selected, the Bond Mode selection will be active. Select a Type. Multi-node systems must have one, and only one, Port Set that is designated for Management (or both management and data). If required, check the VLAN Tagging Enable box and click OK. VLAN tagging is not supported with Bonding Mode 6. At this point you may choose to define the Subnets for the Port Set or to create additional Port Sets by clicking on Add in the Port set section. For the purposes of this example, we continue to the Subnet configuration. TIP: Save the network configuration at regular intervals. If you save a configuration where there is a PortSet created with no subnets, the data type of that PortSet will revert to "Data." If the intention was that it would be a Management or Management + Data Port Set, you must reset the Type before creating the subnet. For Management or Management + Data Port Sets, you can configure static routing for the management subnet if required as described in To set up static routing. Step 3: Create Subnets Select the Port Set. Click Add in the Subnet section. Select the number of nodes to configure. The default is the current number of nodes in the cluster, the minimum being 2, and the maximum is 8. HPE recommends configuring the network for expansion, in which case select 8. However, any multiple of 2 is supported. If you need to amend the number of nodes in the configuration, see To edit a custom configuration. Provide the Subnet details listed in the "Network Configuration New Subnet fields" table, and click OK. For IPv4 Subnets, select the IPv4 button and provide the relevant details. For IPv6 Subnets, select the IPv6 button and provide the relevant details. Repeat until all the Subnets for the selected Port Set have been defined. Network configuration 187

188 Each physical Port Set may be configured with one Subnet that uses the IPv4 protocol and one Subnet that uses the IPv6 protocol. If the Port Set is VLAN enabled, it is possible to add a total of 128 IPv4 VLAN Subnets and 128 IPv6 VLAN Subnets. These total values apply across the whole network configuration, not per Port Set. Click Save to save all configuration details. If this is a Management subnet, you can configure static routing to networks that are not accessible via the configured gateway, if required. For example, where a Data subnet is configured for access across the WAN and the Management subnet also requires access to a network that is not accessible via the configured default gateway for the Management subnet. This is described in To set up static routing. Step 4 and 5: Validation and Activation Click Validate to validate the network configuration. If there are any errors, the error message will guide you to the parts of the configuration that need correcting. Make the necessary changes, save them and click Validate again. If validation is successful, you have two choices. The StoreOnce System Management GUI will prompt you to activate the new configuration immediately. Or you can save it and activate it separately from the Network Configuration Custom page. It is not possible to activate a new configuration if storage addition is in progress. To set up static routing The Static Routing feature is available for the Management and storage network subnet of the system. It may be required if access to the StoreOnce management interfaces is required from networks that are not accessible via the configured gateway on that network. For example where the AD server is on an isolated management network subnet with routing restrictions. A static route can be configured via a gateway to a specific end device IP address or subnet. A maximum of 10 IPv4 and 10 IPv6 static routes is supported for each StoreOnce System. Static routes may be defined between the StoreOnce System and a specific host or between the StoreOnce System and a subnet. 1. Create the Management subnet as described in Step 3 of To add a custom network configuration and select it. 2. There is an extra section at the bottom of the page that allows you to add static routing. 3. Click Add to define a new static route, which may be IPv4 or IPv6. 4. Enter details for all four fields and click OK. 188 To set up static routing

189 Table 64: Static routing parameters Field Protocol Target IP Address Netmask / Prefix Gateway Address Description This may be IPv4 or IPv6. This defines the IP address of the target, which may be a specific IP address or the subnet on which it is located. The final value(s) in the IP address indicates whether this is a host (specific value) or a subnet (value = 0). For example: xxx.xxx.xxx.0 indicates any target on the specified IPv4 subnet. xxxx:xxxx:xxxx:xxxx:: indicates any target on the specified IPv6 subnet This is the Netmask (IPv4) or Prefix(IPv6) that defines the range of IP addresses that are available in the subnet to which the route is being created. This is the address of the gateway via which traffic will be routed to the target host or subnet, this address must be in the same range as the current subnet. Be aware that the StoreOnce software always converts the netmask to prefix (CIDR) format. Regardless of how you enter the information when you configure the routing, it will display in CIDR format on the Network Configuration-Status tab of the StoreOnce System Management GUI. Also, the netmask/prefix is not used when a specific end device IP address is provided for the Target IP address. That field is blank on the Status tab. 5. You may continue to add up to 10 IPv4 and 10 IPv6 static routes. The number of static routes that may still be added is shown in brackets at the bottom of the screen. To edit or delete a static route Select the required static route by clicking in the adjacent checkbox and click Edit or Delete. If you click Delete, you will be prompted to confirm that the Selected Static Route will be deleted. If the network configuration is changed in a way that affects the management subnet or a new configuration is created and activated, it will be necessary to reconfigure the static routing information. To view a custom configuration To view a custom configuration, select that configuration in Network Configuration under Custom. To edit or delete a static route 189

190 Table 65: Custom Network Configuration fields Field name Description Configuration Information Configuration Name Protected The name given to the configuration when it was created. Indicates protection status. Click in the box to prevent further editing of the configuration. To release the write protection, click in the box to uncheck it. DNS Server DNS Address 1/2/3 Shows up to three DNS addresses that were defined at configuration. The format of the address detail is as appropriate for the protocol selected (IPv4 or IPv6). Port Sets Name Network Ports Management IP Bond Mode Data Type VLAN Frame size The name given to the Port Set when it was created. The ports that were defined for use by this Port Set. The IP address for the Management Console. This is the IP address that is used to log on to the StoreOnce Management GUI or CLI. Any Bond mode that has been defined. Bond modes are only appropriate if there is more than one port in the Port Set. It may be Data, Management or Both. One, and only one, Port Set is defined for Management. Once Management Data Type or Both has been selected for a Port Set, the only option remaining for other Port Sets is Data. Indicates whether VLAN tagging has been enabled for the Port Set. VLANs may only be enabled on Data Port Sets. This defines the amount of data contained in an Ethernet frame, the default is 1500 bytes. Larger size frames, often referred to as "Jumbo" frames, can improve performance of the Port Set. Use this field to increase or decrease the value, which must be an integer between 1280 and IMPORTANT: Other devices on the network (clients and switches) must also be configured to enable Jumbo frames for transfer of frames larger than 1500 bytes to be possible and to avoid packets fragmenting or dropping. Speed Subnet Ports The speed of the Port Set, either 1Gbit or 10Gbit, depending on which ports have been assigned. Table Continued 190 Network configuration

191 Field name Description Configuration Information Name VLAN Gateway IP Network Mask Domain Name Default Subnet Node tab Physical IP address and Virtual IP address on a Node tab The name of the Subnet The VLAN tag ID for the Subnet The IP address of the gateway The network mask The domain name Indicates whether this is the Subnet that contains the default gateway A node tab contains IP address parameters that are specific to the node. There may be up to eight node tabs. The IP address(es): Two IP addresses per node on physical LANs and up to 128 IP addresses for VLANs across all nodes. Encryption Links Client IP address PassPhrase The customer-provided IP address that is being used to add an encryption link configuration to the subnet. The pass phrase added when encryption was set up. To delete an encrypted configuration, you will need this passphrase. Editing a custom configuration You cannot edit the current or the Factory_Default_Configuration. However, you can edit any configuration in the Custom configuration list. If the StoreOnce CLI wizard was used to configure the network at installation, there will be at least one custom configuration in the list, net_wizard. Before activating an edited custom configuration, you may like to create a copy of the current configuration and save it to a different name. Once current is overwritten it cannot be restored. 1. Select the configuration that you wish to edit and click Edit. 2. This displays the same dialog box as for creating a subnet and you may edit the subnet configuration settings. Exceptions are: The subnet name may not be changed. The network protocol (IPv4/IPv6/DHCP) may not be changed if there are Encryption Links present for that subnet. This is because encryption links are not allowed for IPv6 or DHCP subnets. If the user edits a subnet with Encryption links configured, the protocol radio boxes will be greyed out Editing a custom configuration 191

192 with the message (or tool tip) Network Protocol cannot be changed as there are Encryption Links configured for this subnet. 3. Make changes to the editable fields, as appropriate, and click Save. Some examples are described below. To add a VLAN enabled Port Set and VLAN Subnet 1. Select the configuration in the Custom Network Configuration list and click Edit. 2. In the Port set section, click Add. 3. Enter Port Set details, in exactly the same way as when creating a new configuration. a. Select the required 1 Gbit or 10 Gbit ports. Available ports are active for selection; ports already assigned are greyed out. b. If multiple ports have been selected, select a Bond Mode as appropriate. This should be Mode 1 or Mode 4 for VLAN. c. The Type must be set to Data. 4. Be sure to check the VLAN Tagging Enable box and click OK. 5. In the Subnet section, click Add. 6. Enter Subnet details, in exactly the same way as when creating a new configuration, and be sure to add the VLAN tag ID. Click OK. 7. Save and validate the changes. If required, you can also activate the configuration at this point. To add nodes to a network configuration 1. Select the configuration in the Custom Network Configuration list and click Edit. 2. Select a Port Set and Subnet. 3. In the Subnet section, click Edit. 4. In the Number of Nodes box, select the required number and click OK. 5. The StoreOnce System automatically updates all subnets to have the required number of nodes and IP addresses. Check the individual Node tabs for each subnet to make sure the IP address details are correct. Edit, as appropriate, and save the changes. 6. Save and validate the changes. Validation will fail if sufficient IP addresses have not been configured for each Subnet. To add encryption to a subnet Point to Point Data in flight encryption links using IPSec may be configured on a per subnet basis. This can be used to secure the link between backup clients and also between StoreOnce appliances for replication or StoreOnce Catalyst copy traffic. This feature requires a Security Pack license. See also Encryption guidelines on page 193. It is not possible to configure encryption links while creating the subnet. 192 To add a VLAN enabled Port Set and VLAN Subnet

193 IMPORTANT: Data in Flight Encryption is not supported for IPv6 subnets. In the StoreOnce Management Console, you will not see the Encryption Links section if an IPv6 subnet is selected. In the StoreOnce CLI, a configuration command will fail if you attempt to configure Data in Flight Encryption on an IPv6 subnet. Data in Flight Encryption is intended to be used to secure network links between data centers for StoreOnce VTL or NAS Replication, or for Low Bandwidth Catalyst Copy operations. Using Data In Flight Encryption for direct backup operations to the StoreOnce appliance over a local network is not supported due to the performance impact of the encryption. 1. Select the subnet for which encryption links are required. If multiple subnets are selected (using the selection checkboxes) you will not be able to configure encryption links. 2. The Encryption Link section of the Network page shows any previously existing Encryption Links for that subnet or the text No Encryption Links if there are none present. The Encryption Link section on the Network page is not displayed when Port Sets are being used for Management or when the subnet is configured for IPv6. The Encryption Link section of the Network page is not displayed for a subnet that is configured for DHCP or IPv6. 3. Click Add to display the New Encryption Link Configuration dialog for the subnet. Enter the following information: a. Remote IP address: This is the IP address of the remote device, which may be a client if configuring encryption between a client and the StoreOnce appliance, or another StoreOnce appliance when configuring encryption between devices used for replication and StoreOnce Catalyst copy. b. Passphrase: This is the passphrase to be used for the link and must also be configured on the device to which the link is made. The passphrase can be shown in plain text. Or check Show characters to display the passphrase as a series of dots and asterisks. 4. Click OK to add the encryption link details to the subnet configuration and redisplay the Network page. Encryption guidelines Multiple different encrypted links may be set up for each subnet to allow connectivity to multiple client systems. IMPORTANT: Data in Flight Encryption is not supported for IPv6 subnets. Data in Flight Encryption is intended to be used to secure network links between data centers for StoreOnce VTL or NAS Replication, or for Low Bandwidth Catalyst Copy operations. Using Data In Flight Encryption for direct backup operations to the StoreOnce appliance over a local network is not supported due to the performance impact of the encryption. Encryption guidelines 193

194 The user must configure both the StoreOnce appliance(s) and Client computer with an equivalent configuration and use the same Passphrase. A single Encryption Link allows a specific client IP address to have a secure connection with all nodes and IP addresses configured by the subnet. Each Encryption Link applies to: All IP addresses in the Subnet of the specific network addressing mode (IPv4) including both VIF and Physical address, if appropriate. All nodes in the cluster. The following guidelines apply: Encryption links may not be applied to Management only or to Both (Management + Data) Port Sets. They may only be applied to Data subnets. There is no limit to the number of Encryption Links per subnet. If using IPv4, configurations for Encryption Links are possible and auto detected based on the IP address format used for the client-side IP. Encryption Links may not be configured on IPv6 subnets. Encryption Links may be created or deleted, they cannot be modified. If you wish to change the passphrase used for a link, you must delete and re-create that link with the new passphrase. License requirements In order to create encryption links, a security pack license must be present on the StoreOnce appliance. If no license has been applied (or the license has expired), the Network page will show the Encryption Link section with a message and a Warning triangle icon, the text says Security Pack License not installed. The New button is greyed out but the Delete button is still active in order to allow deletion of Encryption links that were created prior to the security pack license expiring. To delete encryption links 1. Select a Subnet and look at the Encryption Link section of the Network page. It shows all existing Encryption Links for that subnet or the text No Encryption Links if none have been configured. 2. Select the row for the Encryption Link to be deleted and click Delete. 3. A Warning dialog is displayed. Check the details for the subnet and the IP address of the remote device to verify that you have selected the correct encryption link to delete. Press OK. 4. The Encryption Link is removed from the StoreOnce subnet configuration. You must also remove the corresponding encryption link configuration from the backup client or other StoreOnce appliance to maintain connectivity. To write protect or un-protect a configuration Select the configuration in the Custom Network Configuration list and click Edit. Click in the Protected checkbox to change its status and click Save. Repeat this process to switch the status back to Un-protected. Deleting a custom configuration You may only delete Custom configurations. You cannot delete the current or the Factory_Default_Configuration. 1. Select the required configuration in the Custom configuration list and click Delete. 194 To delete encryption links

195 You may not delete a subnet if there are encryption links configured for that Subnet. You must first delete the encryption links. See To delete encryption links on page At the prompt click OK to confirm the deletion. TIP: If you delete the custom configuration that has been activated to become the current configuration, you are effectively deleting your backup of the current configuration. This means that if you need to modify the current configuration, you will have no backup of it unless you copy it first. Network configuration 195

196 Remote Support Remote Support monitors your system and allows the system to automatically contact Hewlett Packard Enterprise if issues arise on the system. Remote Support page The Remote Support page allows you to view the level of Remote Support and the proxy settings used to connect to the external network: Remote Support Level The level of support configured. Options are Active, Passive, or No Support. Enterprise Server The Hewlett Packard Enterprise server name (or IP address) that receives event messages. Proxy The IP address of the proxy server that connects to the Internet (if enabled). Protocol The network protocol being used by the proxy server (if enabled). Port The port used by the proxy server (if enabled). Login ID The username used if authentication is enabled. After completing the required fields on both the Remote Support and the Customer Information pages, click Send Test Event to test the connection of the Remote Support configuration. A message appears indicating whether or not the test event was generated; contact Hewlett Packard Enterprise support to determine if it received the test event. Configuring and modifying Remote Support 1. Click Modify on the Remote Support page. 2. Enter or edit the appropriate information. The required fields are indicated with a red asterisk. See the following table for an explanation of the fields. If you select Passive in the Remote Support level field, you must complete the other fields. If you select No Support, you do not have to complete any other fields. 3. Click OK. 4. If you selected No Support as the Remote Support level, select an option in the Remote Support Feedback window and click OK. Table 66: Remote Support fields Field Enterprise Server Enable proxy server Description The Hewlett Packard Enterprise server that receives the event messages. This is automatically populated; do not change unless you have a specific reason to do so. If selected, this option allows the use of a network proxy to access the Internet. It expands to display more fields. Table Continued 196 Remote Support

197 Field Protocol Address Port Enable Authentication Login ID Password Re-enter Password Advanced Remote Support Level Description The protocol used by the proxy server. The address of the proxy server. The port used by the proxy server. If selected, the proxy network requires a username and password. It expands to display more fields. Clear this field if authorization is not required to access the proxy. The user name used to access the proxy server. The password used to access the proxy server. Re-enter the password for initial verification. If selected, it expands to display the Remote Support options. The level of support configured on the StoreOnce System: Active Allows Hewlett Packard Enterprise to control and send commands to the appliance. This level of support will be available in an upcoming release. Passive (default) Allows events to be sent out but does not permit inbound queries. No support No events are sent out and does not permit inbound queries (Remote Support is disabled). If Remote Support is not fully configured, a reminder message is displayed at login. The message appears at every login until the configuration is completed or until no support is selected. Customer Information page The Customer Information page displays the information of the person who will be contacted when Remote Support indicates that a support case is needed. Entering and modifying customer information 1. Click Modify on the Customer Information page. 2. Enter or edit the contact information. The required fields are indicated with a red asterisk and red field outline. 3. Use the Support From menu to select who will provide the support: HPE Direct or HPE Partner. 4. If you select HPE Direct, enter the Hewlett Packard Enterprise Passport ID in the appropriate field. If you select HPE Partner, enter the Partner ID in the appropriate field. 5. Click OK. Customer Information page 197

198 Entitlement page Use the Entitlement page to view the details of the products purchased (Saleable SKU) which includes a Warranty Serial Number (WSN) and a Warranty Product Number (WPN). These numbers are used for communication with Remote Support but are also important to provide when contacting Hewlett Packard Enterprise Support. If you contact HPE Support for assistance and you cannot provide the WSN and WPN for entitlement purposes, technical support for your issue might be delayed. For StoreOnce 6600 systems, WSN and WPN details are read directly from the BIOS and populated automatically. This is true for some 6500 systems while others display missing in the WSN and WPN fields; a number of factors determine if the information is available. There will be one entry for each couplet. If your system displays missing in place of the WSN and WPN, refer to your product s installation and configuration guide for information on locating those numbers on the appliance itself. Then contact HPE Support to request that the WSN and WPN be added to your system s GUI. Table 67: Entitlement fields Field Product Name Type Warranty Serial Number Description Each couplet name is shown in the format HPE StoreOnce <type> Backup Couplet<n> where <type> is the model series and <n> is the couplet number ranging from 1 to 4. There may be up to four couplet names displayed, for example: StoreOnce 6600 Backup Couplet1, StoreOnce 6600 Backup Couplet2, etc. For systems that support storage expansion by adding extra disk packs or storage enclosures, there is a separate entry for each installed storage expansion. This identifies whether the product is a server or disk expansion. This is the HPE serial number of the purchased product. See the following More about warranty serial numbers for more information. The WSN might be populated automatically from the BIOS. There will be up to four warranty serial numbers, one for each couplet. Warranty Product Number This is the product number of the purchased product. The WPN is in a 6- character format that matches one of the StoreOnce product names and might be populated automatically from the BIOS. More about warranty serial numbers These systems have a separate entry for each couplet. The warranty product number depends upon which couplet it is; Couplet 1 and Couplet 3 have different warranty product numbers. Couplets 2 and 4 have the same warranty product number. The warranty serial number is always unique. The warranty serial number for Couplet 1 covers Node 1 and Node 2 servers, base storage, and the switches in Rack 1. The warranty serial number for Couplet 2 covers Node 3 and Node 4 servers and base storage. The warranty serial number for Couplet 3 covers Node 5 and Node 6 servers, base storage, and the switches in Rack Entitlement page

199 The warranty serial number for Couplet 4 covers Node 7 and Node 8 servers and base storage. If additional disk packs have been installed in any couplet, there will be a separate entry for each disk pack that identifies the couplet and expansion number, such as Couplet1Expansion1. This is for information only; disk packs do not carry warranty details (the warranty columns will show Not Applicable). Status page The Status page displays the Remote Support availability status of the proxy and enterprise servers, indicates if the product models and hardware product numbers have been entered, and indicates if the device is registered successfully. An I icon indicates an informational message A yellow triangle! icon indicates a warning message A red circle X icon indicates an alert message. Table 68: Status page information Message type Status level Message Description and suggested action Proxy Server information: Identifies if the proxy server is available. Info Alert Proxy server is reachable Proxy server is not reachable The proxy server must be used if the device needs to connect to the HPE Remote Support Enterprise server. Navigate to the Remote Support configuration page and click Modify. In the Modify box, check the box for Enable proxy server and provide the proxy details. Device Registration: Shows if the device has been registered successfully with HPE Remote Support. Info The device is registered successfully The device has been registered with HPE Remote Support. No action required. Remote Support, support level information: Identifies whether Remote Support has been set up. Alert The Remote Support level is set to No Support. Device is not able to communicate with Enterprise Server If the Remote Support is set to No support then the device will not communicate with HPE Remote Support. This will prevent you from contacting or registering the device with HPE. Navigate to the Remote Support page in the Management Console and click Modify to update support settings. Table Continued Status page 199

200 Message type Status level Message Description and suggested action Hardware monitoring information: Shows the status of hardware monitoring. Alert Issues with Hardware monitoring. Check the logs for details. The services are in restart mode or the hardware is not discovered properly. Navigate to the Events page in the StoreOnce Management Console. Select Custom Search and in the Custom Search for Events dialog, in the Search Text field type hardware. Click OK and view the search results. Enterprise server information: Identifies if the Enterprise server is reachable. Product model information: Shows if Remote Support is supported or not. Info Alert Enterprise Server is reachable Enterprise Server is not reachable The Enterprise Server must be used if you want to register for HPE Remote Support. Info Alert Product model is available Product model is not available Versions of StoreOnce software prior to version 3.11 do not have Remote Support functionality. Customer information: Identifies whether devices are registered or not successfully with HPE Remote Support. Info Warning Alert Customer information is available Customer contact agreement selection has not been made Customer information is not available. Check the Customer information. The customer information has not been properly filled out/ registration has not been completed to enable Remote Support. Navigate to the Remote Support page in the StoreOnce Management Console and click Modify to update support settings. Entitlement information: This is used to identify whether devices are registered successfully or not with HPE Remote Support. Info Warning All Hardware SKU warranties are available One or more Hardware SKU warranties are not available Hardware SKU warranties must be available for the device to register with Remote Support. Navigate to the Entitlement page in the StoreOnce Management Console to see which pieces of hardware are missing warranty serial numbers. Contact HPE Support if needed. Table Continued 200 Remote Support

201 Message type Status level Message Description and suggested action Alert Hardware SKU warranties are not available Axeda registration information: Axeda is a third-party software used for communicating with HPE Remote Support. Alert Issues with Axeda agent configuration. Check the logs for details. Navigate to the Events page in the StoreOnce Management Console. Select Custom Search and in the Custom Search for Events dialog, in the Search Text field type axeda. Click OK and view the search results. Remote Support 201

202 Events Select Events in the Navigator to display each Alert, Warning, Information, and Audit message generated by the Management Server. The Events page contains two tabs, Events and Settings: EventsFunctions available on the tab: To understand parameters on the Events tab: Events tab parameters on page 202 To filter and search through events: Filtering and searching for events on page 203 To acknowledge events in order to hide them from the Events log: Acknowledging events on page 204 To define how long events are kept before being deleted from the log: Deleting events from the log on page 205 To export the Events log to a CSV file: Exporting the events log on page 205 Functions available on the Settings tab: To enable or disable Remote Event Suppression mode: Remote Event Suppression on page 205 Events tab parameters On the Events tab, the following categories of events are displayed: Alerts: Disruptive events that can result in loss of access to data. Warnings: Potentially disruptive conditions in which access is not lost, but if the situation is not addressed, it can escalate to an Alert condition; for example, reaching a very high server CPU utilization or approaching a quota limit. Information: Events occurring under normal or non-threatening conditions that change the system. Audit: Actions taken by users on the system such as logging in, rebooting, adding storage, creating libraries, editing NAS shares, modifying the network, etc. This includes actions taken through the GUI and through CLI. Events are cluster-wide. Table 69: Events log columns Name Level Time Event type Event code Event Description The icon in the Level column displays the severity of the event. (Information and audit events use the same icon.) This column is sortable by severity type. The time that the event originated on the Management Server. Click on the column heading to sort in ascending or descending order. The type of event (Audit or System). The event code is a unique error code assigned to that particular event (for example, all log in events will have the same error code). The text of the event, including details and suggested actions. This column is not sortable. 202 Events

203 The Event Details pane at the bottom of the page provides more specific information about the selected event. Table 70: Event Details Name Severity Sequence ID Event code Message Root Cause Recommended Action Description The level of event severity (Alert, Warning, or Info). The unique ID given to that event. The unique code assigned to the event for support identification. This is the same information as provided in the Event column in the Events log. The initial trigger for the event. This is only shown when the root cause is available. Provides a direct action to take for problem resolution. This is only shown when a recommended action is available. Filtering and searching for events You can scroll through all events pages by using the First, Prev, Next, or Last buttons. To search for a specific type of event: 1. Select an event type by using the drop-down filter at the bottom of the Events log. All Events is the default selection. 2. You can also filter by Alert Only, Warning Only, Info Only, Audit Only, Acknowledged Only, or Custom Search. All selections except for Custom Search will return a list of events categorized by the selected filter. 3. If you select Custom Search, fill out some or all of the parameters in the Custom Search for Events window, and then click OK. a. To search today s events, select today as the start date and do not include an end date. b. To search for one specific day, select that day as the start date and select the next day as the end date; the times default to 00:00:00 and therefore this will only include the start date. c. When editing the time, overwrite each unit of time individually leaving the colons between them intact; do not overwrite the entire time stamp. d. Search Text can only be used for event messages. Filtering and searching for events 203

204 Table 71: Custom Search for Events parameters Name Event Code Filter Search Text Level Event Type Start Date End Date Description Specific event codes are assigned to specific types of events. Enter the code you want to search for. Enter a partial string, for example, IP address. You cannot use * as a wildcard; the search looks for that specific character. This field is not casesensitive. Search text can only be used for event messages. Select the level of event, Alert Only, Warning Only, or Info Only. Select the event type, System or Audit. Use the calendar icon to select a date. The time defaults to 00:00:00 (the beginning of the day) and is editable. Use the calendar icon to select a date. The time defaults to 00:00:00 (the beginning of the day) and is editable. The Custom Search option is for English language GUIs only; the option is disabled in localized GUIs. Acknowledging events Using the Acknowledge events feature, you can hide events in the Events log without having to delete them. You may want to do this to ensure that you are seeing the latest and most relevant messages when you log into the GUI and open the Events page. Once you acknowledge an event, it is hidden from view unless you use the Acknowledged Only events filter when searching for events. For example, if the Events log contains multiple fs is full events, and you know you have attended to this issue, you can acknowledge these events, and when you log to the GUI the next day and you see another fs is full message, you will know that you are seeing the most current event status instead of an outdated message. To acknowledge an event or events: 1. In the Events log, select the checkboxes of any item(s) you would like to acknowledge. You can select multiple checkboxes at once. 2. Click Acknowledge. 3. You will see a warning message asking Are you sure you want to Acknowledge the selected events? 4. Click Yes. To View Acknowledged Events only To view events that you have already acknowledged, use the Acknowledged Only filter when performing an event search. 204 Acknowledging events

205 Deleting events from the log This procedure allows you to delete all event logs except for Audit event logs. To manage Audit event logs, see User Interface on page 156. It is sometimes necessary to reduce the size of the Events log before carrying out a software update. Always refer to the update release notes to check the current recommendation. 1. Click Delete at the top of the Events log. 2. Enter the number of days of events to keep. 3. Click OK. Exporting the events log Click Export at the top of the Events log to save a CSV file locally. The entire Events log is exported regardless of what is currently displayed on the Events page. Remote Event Suppression Enable Remote Event Suppression mode to suppress the automated actions behind Remote Data Collection events. When enabled, Remote Event Suppression flags all outbound event messages to let the Hewlett Packard Enterprise support team that the system is undergoing some form of maintenance that does not require a case to be raised with Hewlett Packard Enterprise support. For example, you would enable Remote Data Collection Event Suppression when reconfiguring your network (in this situation you would not require Remote Data Collection to raise a new case). Remove Event Suppression Mode will be disabled automatically 24 hours after it was enabled or if the entire cluster is restarted (if only part of the cluster is restarted, this mode will remain enabled). To enable Remote Data Collection Event Suppression: 1. From the Events page, click on the Settings tab. 2. In the Remote Event Suppression Mode pane, click Enable. 3. In the Enable Remote Event Suppression window, specify the reason to enable Remote Event Suppression mode. The Reason field can only contain alphanumeric, dash, underscore, period, and spaces. 4. Click OK. 5. Note that Remove Event Suppression Mode will be disabled automatically 24 hours after it was enabled or if the entire cluster is restarted (if only part of the cluster is restarted, this mode will remain enabled). To disable Remote Data Collection Event Suppression: From the Events page, click on the Settings tab. In the Remote Event Suppression Mode pane, click Disable. In the Disable Remote Event Suppression window, click OK. Deleting events from the log 205

206 Configuration save and restore process StoreOnce appliances enable creation of a backup of device configuration settings in the form of a file that can be retrieved from the appliance and stored on the user s PC for possible use in the future. The configuration backup file may be used to quickly configure a replacement or repaired StoreOnce appliance in the unlikely event that the appliance fails and all data and configuration details are lost. The file would be used after a system is repaired or replaced in one of the following cases: A failure of the appliance operating system on both nodes in a couplet has occurred and configuration details and data are lost for the couplet. A failure of the appliance operating system on all nodes in a cluster has occurred and configuration details and data are lost for the cluster. The configuration save and restore process is managed via the StoreOnce CLI and an SFTP client is required to download or upload the saved configuration file. CAUTION: The configuration save and restore process does not include encryption key store data. If using this feature, use separate StoreOnce CLI commands to back up the encryption key store and store it safely in an offline location. Use the original key store to access encrypted key store data after a restore. Configuration file The configuration file consists of two parts: 1. A set of instructions in the form of a text file for the user to manually restore some of the network and device management configuration settings that cannot be automatically restored. 2. A zip file containing StoreOnce device configuration settings that automatically restore configuration settings that have been created for StoreOnce VTL, NAS, StoreOnce Catalyst, Replication and housekeeping functions. IMPORTANT: If settings in the text file need to be restored, perform the manual restore before the automatic restore. When should a configuration file be generated? A configuration file should be generated and copied from the StoreOnce appliance whenever a change in configuration is made to the appliance, in order to ensure that if a recovery is required then the latest StoreOne configuration is available, for example: After changing network settings After creating virtual tape libraries, NAS shares or StoreOnce Catalyst stores After modifying replication settings After updating software IMPORTANT: Configuration files saved on older versions of the software are not usable after the software is updated. 206 Configuration save and restore process

207 Contents of the configuration text file The configuration text file contains information required to reconfigure some appliance settings; it details the commands that need to be sent via the StoreOnce CLI interface or the steps required in the GUI to apply the settings. The text file contains the configuration details for the following settings: User Accounts: The user accounts and account type settings and the StoreOnce CLI command required to create these accounts are provided. Passwords are not provided in the text file for security reasons. Only custom accounts are provided, the default Admin and Operator account settings are not included in the file. Network: StoreOnce CLI command information is provided to allow the user to reapply network settings for 1GbE and 10GbE network configurations. Time and Date: This includes NTP server and timezone settings for the appliance. SNMP Trap: SNMP trap users, trapsink and version configuration settings are provided in the form of StoreOnce CLI commands that must be issued to re-configure the SNMP trap configuration. Alerts: Configuration settings for servers, and registered addresses with their event levels are provided so that these settings can be re-entered via the GUI. Licenses: License keys for capacity expansion, replication and StoreOnce Catalyst are provided in the text file along with the command syntax for re-entering the license keys. Remote Support: The settings established for Remote Support. Customer Information: The contact information of the person contacted when Remote Support indicates that a support case is needed. IMPORTANT: To restore any of the above settings, do so BEFORE performing the automated portion of the restore, otherwise some settings will not be restorable using the automated process. Under each section, a list of CLI commands (if available) or instructions to restore the Device Management settings are listed. Settings restored after automatic recovery The following configuration settings are restored by uploading and applying the configuration zip file through the CLI: Virtual Tape Library: All configuration settings for the virtual tape library device are restored, namely: Emulation type of library Number of cartridge slots Number and emulation type of drives Cartridge size and barcode length Fibre channel settings After recovery cartridges are not created in the cartridge slots, they are created after the library recreation is complete using the Create cartridges function. CIFS shares: All configuration settings and shares are recreated, namely: Authentication type (None, User, AD) Local user accounts (for User authentication) Share name and description Share user access settings Contents of the configuration text file 207

208 NFS shares: All configuration settings and shares are recreated, namely: Host access lists NAS share names Share host access setting Replication: The information recovered is as follows: Replication local appliance settings: Maximum concurrent jobs, Sync progress logging, Out of sync notification settings, Port number settings Replication partner target appliances (IP and Ports) Blackout and throttling window settings Source appliance permissions Replication target share/library mappings Replication source appliance mappings are not restored because this would result in deletion of content on replication target devices after recovery completes. Replication mappings can be recreated after the recovery completes in order to recover replica data to the repaired/replaced appliance. StoreOnce Catalyst: The information recovered is as follows: Store name Access control list Local appliance settings: Port number and Maximum concurrent jobs Blackout and throttling window settings for copy Housekeeping: The information recovered is as follows: Blackout and throttling window settings Performing a configuration save A configuration save operation can be done at any time using the following process: 1. Log into the StoreOnce CLI using the Cluster Management IP address of the Management Console. Use a login account with administrator privileges. 2. Run the command config save devices. This command will complete immediately and return to the prompt, the configuration settings will be created in the background. 3. Run the command config show list. Check that the configuration file has been created; it will only appear in the list once the creation process is complete. 4. To retrieve the configuration file from the appliance, SFTP into the appliance using an SFTP client and a login account of an appliance administrator. 5. From the /config directory copy the configuration zip file and associated text file to a local PC. Prerequisites for a configuration restore Before restoring the configuration verify that: 208 Performing a configuration save

209 All hardware is physically repaired or replaced with no defects (such as failed disks). If recovering an entire cluster or couplet then all nodes must be reconfigured and running before attempting to recover settings. There are no configured devices (VTL, NAS or StoreOnce Catalyst devices) on any nodes in a couplet. All settings in the configuration text file are manually restored. Restoring from the configuration zip file To restore only StoreOnce device settings (VTL, NAS, StoreOnce Catalyst, Replication and Housekeeping), apply the configuration zip file as follows: 1. The saved configuration zip file is in the config folder on the appliance. This assumes that the appliance was not repaired or replaced; no QR was necessary so the configuration file is still on the system. It is advisable to use the CLI config show list command to check for the name of the latest zip file. 2. Run the StoreOnce CLI command: config restore devices <config_filename> This will restore device settings for all of the nodes in the cluster. 3. After configuration, recovery backups can be configured and replication mappings re-established in order to reverse replicate data back to the appliance (see the replication information). To restore network or other device management settings use the procedure described in the following section. It is also the procedure you use after a QR. WARNING: QR is a complete re-image of the device and is only used for catastrophic issues or major software updates where compatibility cannot be maintained. Deleting configuration files from an appliance The saved configuration files remain on the StoreOnce appliance after creation and after a recovery operation. They can be safely left on the appliance or can be identified and deleted using the following StoreOnce CLI commands: config show list config delete <config_filename> Restoring from the configuration zip file 209

210 Basic troubleshooting Password problems Administrator users may reset passwords for operator users. If the administrator credentials are accidentally lost, it is possible to reset the administrator password using the account hpresetpassword. This account is also password protected, and it can only be used from the console. It is recommended that you change this password after installation and store it in an offline Password Security tool. See the StoreOnce System CLI Reference guide for more details. Pulling a Support Ticket A support ticket is a snapshot in time of the StoreOnce System, showing the configuration, status and health of the product, as well as historical events for use with troubleshooting the product. The support ticket also contains lower-level trace logs for the use of Hewlett Packard Enterprise engineers. If a kernel crash occurs, an automatic ticket will be generated. A ticket will be produced with the filename: tkt_<datestamp>_<crashed nodename>.zip Administrators can manually collect a support ticket in two ways from the StoreOnce System: From the StoreOnce GUI. See Support Ticket (administrators only) on page 167. From the StoreOnce CLI. See the StoreOnce System CLI Reference Guide. Licensing problems The Instant-on demo license may be enabled when the system is configured. This license enables StoreOnce Catalyst and Replication for 90 days. To continue using these features, separate licenses must be purchased for StoreOnce Catalyst and Replication and applied within the 90 day period. If they are not, data is not lost but: Replication: Replication Target libraries will continue receiving replicated data, however, you will receive notification every 24 hours that your license has expired. Catalyst: StoreOnce Catalyst stores will still be available as target devices for backup, however, you will receive notification every 24 hours that your license has expired. Use StoreOnce CLI commands to show the current license status and apply the demo and individual licenses. See the StoreOnce System CLI Reference Guide and License management on page 170 for more information. Multiple users The StoreOnce System Management Console supports multiple GUI and CLI sessions. However, we recommend: No more than 8 active operator sessions for the GUI No more than 16 active operator sessions for the CLI No more than 1 active administrator session to ensure there is no confusion when configuration changes are made Currently, you cannot see which users are logged in. The accounts show command will list all the user accounts defined for the StoreOnce System. For each account the authority level is provided. 210 Basic troubleshooting

211 Problems connecting to the StoreOnce System from the backup application Perform the following checks: Make sure you have the latest version or software patches for the backup application. See for supported applications. Stop and restart the backup application services after the backup device has been discovered. If you still cannot access the device, check the Device Manager to make sure it is accessible from the host. For Fibre Channel devices: Models with an 8Gb Fibre Channel card have a theoretical limit of 255 devices per Fibre Channel port on a host or switch; models with 4Gb Fibre Channel card have a theoretical limit of 127 devices per Fibre Channel port on a host or switch. There are practical limitations on the number of devices that each host, Fibre Channel switch, or HBA can access. It is possible to configure more drive and library devices than a host can access. Although the Fibre Channel connection supports a greater theoretical number of devices per Fibre Channel port on a host or switch, HPE recommends that no more than 64 devices are configured for use by a single host. Timeout problems with NAS CIFS shares By default, Windows CIFS timeout is set low for NAS backup implementations. This can lead to various error message related to lost connection to the share, unrecoverable write errors or timeout problems resulting backup job failures. It is recommended to add or to increase the SessTimeout value from the default of 45 (seconds) to 300 (five minutes). Increasing the timeout ensures that the Windows CIFS timeout does not cause your backup application to prematurely timeout the running job. This can resolve issues resulting from timeouts, but is not exclusively the only reason for such failures. A large number of out of sequence writes causing slow response times within the product often can be the root cause. Further analysis may be required if increasing the timeout is not successful. In order to increase the timeout: 1. From the Start menu, click Run.. 2. Type regedit in the Open: field and click OK. 3. Expand and locate the registry subtree as follows: 4. HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \LanmanWorkstation \ Parameters 5. Add a new REG_DWORD key with the name of SessTimeout. 6. Set the timeout value. It is recommended to initially set the timeout value at 300 and then change the value according to the situation of your machine. 7. Reboot the client. Problems connecting to the StoreOnce System from the backup application 211

212 NFS stale handle error The following scenarios can cause problems when connecting to a NAS share. Scenario 1 1. Create an NFS share and mount it on a Linux box. 2. Delete the share on the StoreOnce System without unmounting it from the Linux box. 3. Recreate the share again with the same name. In this scenario, the Linux client will assign a new set of inodes to the new share, but when trying to access the old mount point it will use the previous set of inodes and will therefore not connect. Scenario 2 1. Create an NFS share and mount it on a Linux box. 2. The service set for the share fails over or fails back without unmounting it from the Linux box. In this scenario, the StoreOnce NFS server will assign a new set of file handles to the share, but when the Linux client tries to access the old mount point it will use the previous set of file handles and will therefore not connect. For both scenarios, reboot the host Linux system or unmount and remount the NFS share to restore the connection. If backup or replication fails Backup fails In the StoreOnce System GUI, check the system Events (at the bottom of the navigation tree). One reason for a backup failure is that the system has insufficient free capacity, as reported by the ISV. A warning is generated at 70% and at each increase of 5%. After 85% the warnings come at smaller increases. At 95%, the warnings become alerts and are sent at each increase of 1%. When capacity reaches 98% full, the system becomes read-only (no new data can be written), however, you can still delete old data. Hewlett Packard Enterprise also strongly recommends checking backup application error logs. The following issues can result in errors: Exceeding the maximum concurrent jobs Exceeding the maximum number of concurrent open files for NAS Exceeding the total number of files in a NAS share Reconfiguring devices whilst backups are in progress Deleting replication mappings Replication fails If replication needs to take place through a firewall, the network administrator will need to open (TCP) ports 9387 (Command protocol) and 9388 (Data protocol) to allow the replication traffic to pass to and from the StoreOnce System. If the replication Source Appliance fails and goes offline whilst it was performing a NAS replication job, the replication target share appliance may be left in an inconsistent state. This state may result in a failure to recover from some files in the share or perform a list of files in the share because relationships between files and folders have been lost. This will automatically be repaired by the target appliance as soon as it detects the loss of the source appliance, however it may take up to 10 minutes to complete this repair during which time the share will not be available for access. If some files are failing to replicate and remain out of sync for long periods of time, check that the backup application is not holding open those files. This can be done by checking that there are no queued or paused jobs in the backup application, or restarting backup application services. If neither action resolves the problem, reboot the backup application server. 212 NFS stale handle error

213 StoreOnce Catalyst troubleshooting Since StoreOnce Catalyst is designed to allow maximum control by the client application, any problems will be remedied by checking the job configuration on the client. In the unlikely event that the StoreOnce Catalyst Status displays as Fault, contact Hewlett Packard Enterprise support services for further advice. IMPORTANT: Performance If StoreOnce Catalyst operations need to take place through a firewall, the network administrator will need to open TCP ports 9387 (Command protocol) and 9388 (Data protocol) to allow StoreOnce Catalyst traffic to pass to and from the StoreOnce System. Your StoreOnce System is designed for high performance backup and restore operations according to the specification documented. However, it requires careful configuration. There are many reasons why you may not see the performance you expected from your StoreOnce System. Your own network speed or disk access is not fast enough to allow streaming of data. Your backup application is not optimized. For example, there are not enough backup streams configured to achieve optimum performance. Your StoreOnce System is not optimized for your network and application. See Reporting Central on page 127 to view detailed information about your system operations. StoreOnce System configuration problems I cannot see additional slots from the backup application When you create additional slots for an autoloader/library on the StoreOnce System, you may need to restart services on the backup application so that it can see the new slots. I cannot recover the configuration file You can only recover a configuration file to an StoreOnce System if no devices (NAS shares or Virtual Tape Libraries) have been created on that appliance. Only use this option in emergencies, when the StoreOnce System has lost both disks and all disk configuration. Transferring licenses Can I transfer the License To Use to a different StoreOnce System? No. The LTU is tied uniquely to the serial number of your StoreOnce System hardware. If your hardware serial number changes (by swapping out the unit motherboard), the LTU must be transferred to the new hardware via the Hewlett Packard Enterprise Licensing website. A new LTU is generated, which must then be applied and activated via the Web Management Interface on the repaired/replaced system. StoreOnce Catalyst troubleshooting 213

214 Advanced troubleshooting More detailed troubleshooting information can be found at Enabling power on after power has been lost In the event of a cold reboot when power has been lost to the whole system, the order in which power is re-applied is important. The recommended and preferred order for switching on the circuit breakers to the PDU is in the following sequence (often from the top down, but the location of circuit breakers varies, depending upon the type of PDU). This enables power to the pre-installed hardware in the following sequence: 1. Network switches will power on immediately on connection to the PDU. Check for fault lights on the switches (front and rear of the rack). 2. Power on the disk enclosures using the power button (on the upper left as seen from the rear). 3. After 10 minutes, power on the nodes (servers) using the power button on the front of each server. VLAN networking problems The StoreOnce System supports VLAN tagging. The following guidelines apply: The VLAN tagging interfaces can be configured on both single and bonded interfaces. The user can configure a maximum of 128 IPv4 VLANs and 128 IPv6 VLANs per appliance; they may be consecutive or non-consecutive. The user can configure all VLANs on one Port Set, or divide the VLANs over multiple Port Sets. Each VLAN tag interface is configured using the VLAN ID index, which is the same as the switch VLAN ID number and must be an integer from 2 to Each VLAN tag interface can be configured for use with one IPv4 and one IPv6 subnet. For example, if a VLAN tag ID was configured for use with ports eth 0 and eth1 on IPv4, it can also be configured for use on IPv6 with that Port Set but it cannot be used with any other Port Set. Software update process Software updates can only be performed through the StoreOnce CLI using the administrator user account. Software updates are delivered to customers in the form of a single rpm package, which may contain multiple rpms. Everything is updated in the same way, using the rpm package: the software, third-party components and the firmware for hardware components. All nodes are updated in parallel. A software update is NOT an online process. Services will shut down to perform the updates, so the whole appliance will be offline for a period of time (up to 60 minutes). IMPORTANT: A software upgrade process cannot be performed on a cluster if one or more nodes are down. In this case, the node needs to be brought up and working prior to the software update process. Similarly, if a service set is faulty, the upgrade may not work in some circumstances Firmware updates Firmware updates for system components, such as hard disk drives and BIOS, are included in the software update package, but they are not implemented as part of the software update process. 214 Advanced troubleshooting

215 You can implement firmware updates in two ways: You can use the StoreOnce CLI command hardware update firmware to implement firmware updates. See the StoreOnce System CLI Reference Guide for more information on using the command. You can initiate a check on installed firmware and then upgrade firmware using the StoreOnce System Management GUI. See Firmware page on page 151. What happens to the GUI during failover If the node that fails is not the active Management Console, failover will be transparent to the user. Events and s or SNMP (if configured) will notify the user that failover has occurred. It is also possible to track the progress of failover on the GUI screens as illustrated in this section. If the node that fails is the active Management Console, users will be logged off and must log back in again once services are resumed. Even if the failed node is not the active Management Console, Hewlett Packard Enterprise recommends logging out and logging back into the GUI to refresh it after a failover. The StoreOnce System page and all the configuration pages below it in the navigator contain a list of all the configured service sets and their current status. Example: There is a single couplet with two service sets. Service Set 1 is currently running on its main node. Similarly, Service Set 2 is currently running on its main node (and each is configured to be the failover node for the other). In the event of a hardware problem that causes the main node on Service Set 1 to fail, the service set stops temporarily while failover occurs. As failover progresses, the service set status changes to Unknown. On completion, the service sets information shows Service Set 1 and Service Set 2 both running on the same Current Node; the failed node has moved to the failover node without any user intervention and both service sets are now running correctly. What happens to the GUI during failover 215