1、NetAppxClusteredDataONTAP8.2RemoteSupportAgentConfigurationGuideForUsewithClusteredDataONTAPNetApp, Inc.495 East JaVa Drive Sunnyvale, CA 94089 U.S.Part number: 215-08022_A0May 2013Telephone:+1(408)822-60Fax:+1(408)822-4501Supporttelephone:+1(888)463-8277Web:Feedback:doccommentsTableofContents3Conte
2、ntsWhatRemoteSupportAgentis5Remotesupportarchitecture5WhatRemoteSupportAgentdoes6HowRemoteSupportAgentusesAutoSupport7HowRemoteSupportAgentusesHTTPorHTTPS8HowRemoteSupportAgentprovidesdataandnetworksecurity8HowtheSP/RLMprovidesdataandnetworksecurity9WheretofindmoreinformationaboutRemoteSupportAgent1
3、0ConfiguringRemoteSupportAgent11Pre-deloymentconsiderationsforCluster-Mode11UpgradingtheSP/RLMfirmware12UpgradinganddowngradingDataONTAPtouseSPIwebservicecluster-wide.12Configuringyourstoragesysteminaclusterenvironment13ConfiguringtheRemoteSupportAgentsoftwareforCluster-Mode22ManagingandmonitoringRe
4、moteSupportAgent26DisablingandenablingRemoteSupportAgent26CommandsformanagingRemoteSupportAgent27rsahelp27rsasetup28rsashow31rsastatus33rsatest34AccessingtheRemoteSupportEnterpriseUI36RemoteSupportEnterpriseservicepagedescriptions38Troubleshooting39Remotesupporterrormessages39Cannotconnecttohost39Ca
5、nnotresolvehostname39OnCommandSystemManagerhostnamedoesnotmatchconfiguration.40HTTP503-resourceunavailable40HTTPerror403-accessdenied4041HTTPerror-invalidusernameorpassword,HTTPhealthcheckinterfacebusy41HTTPoperationtimeout41HTTPversionnotsupportedbyhost41optionhttpd.admin.enablenotsettoon42optionht
6、tpd.autoindex.enablc42RemoteSupportPolicyisdisabled42RSEhealthcheckinterfacebusy42RSEorproxyconfigurationisnotvalid42Unknownhost43WaitingforRLMtimetobeset43Remotesupportproblems43IncorrectfieldinformationinNetAppControllerSummary43IncorrectinformationinRemoteSupportAgentConfigurationSummary.43Incorr
7、ectstoragecontrollerinformation44U44Copyrightinformation45Trademarkinformation46Howtosendyourcomments47Index48WhatRemOteSUPPOrtAgentisRemoteSupportAgent(RSA)isaremotediagnosticsdatacollectorthatisembeddeddirectlyintothestoragecontrollersremotemanagementdevicefirmware.RemoteSupportAgentenablesaNetApp
8、supportengineertoremotelyrequestanautomateduploadoflogfiles,corefiles,andotherdiagnosticinformationstoredinthestoragecontrollerandtoremotelytriggeranon-demandAutoSupportcollection.TheRemoteSupportAgentisprovidedinthelatestfirmwareforstoragesystemsthatsupportanonboardServiceProcessor(SP)ortheRemoteLA
9、NModule(RLM)add-oncard.RemoteSupportAgentcanonlybeinstalledonsystemswiththeonboardServiceProcessorortheRemoteLANModule.FAS20xxsystemsthathavethebuilt-inBaseboardManagementController(BMC)arcnotsupported.Note:YoucanaccessandusethebasicSPandRLMfeaturesindependentlyofRemoteSupportAgent.Remotesupportarch
10、itectureRemoteSupportAgentisapartoftheNetAppRemoteSupportDiagnosticsTool,whichhelpsNetAppSupportsolveyourstoragesystemissueswithouttheneedftrstaffintervention.TheNetRemoteSupportDiagnosticsToolconsistsofthefollowingcomponents:AremotemanagementdeviceTheremotemanagementdevicecanbetheSer,iceProcessor(S
11、P)ortheRemoteLANModule(RLM),dependingonthestoragesystemmodel.TheSP/RLMstaysoperationalregardlessoftheoperatingstateofthesystem.Itprovidesremoteplatformmanagementcapabilities,includingremoteaccess,monitoring,troubleshooting,logging,andalertingfeatures.Forcluster-modesystems,theSP/RLMmusthaveaccesstot
12、heClusterManagementLIF.FormoreinformationabouttheSP/RLM,seetheClusteredDataONTAPSystemAdministrationGuideforClusterAdministrators.RemoteSupportAgent(RSA)RemoteSupportAgentispartoftheSP/RLMfirmware.RemoteSupportEnterprise(RSE)RemoteSupportEnterpriseistheapplicationandsen,eratNetAppthatlistensforthecu
13、stomersRemoteSupportAgentconnectionandprovidestheGUIthataNetAppTechnicalSupportEngineerusestorequestdiagnosticdata.RSAcommunicateswithRSEtoreceivesupportactionrequestsandsenddiagnosticdata.ThefollowingdiagramillustratesthearchitectureoftheNetAppRemoteSupportDiagnosticsToolincluster-modesystems:Relat
14、edinformationNetAppRemoteSupportDiagnosticsToolpage-WhatRemoteSupportAgentdoesRemoteSupportAgentremotelycollectsdata,intelligentlyhandlescorefiles,andsendsnotificationofdownstoragecontrollers.RemotedatacollectionRemoteSupportAgentenablesNetAppSupporttorequesttheuploadoffilesfromthe/mroot/etc/logandm
15、rootetccrashdirectoriesandtheirsubdirectoriesinanynodethatishostingtheClusterManagementLIF.ThesetwodirectoriescontainonlyNetAppstoragecontrollerenvironmentalanddebugginginformationanddonotcontainanycustomer-sensitivedata.Multiplefilescanbeuploadedfromthesedirectories,asrequired,duringcasetriage.Remo
16、teSupportAgentalsoenablesNetAppSupporttoremotelytriggeranAutoSupportmessageonyourstoragecontrollerandhaveacompleteAutoSupportlogreturnedbyusingtheDataONTPAutoSupportmechanism.IntelligentcorefilehandlingWhenasystempanics,RemoteSupportAgentautomaticallyuploadsthecorefiletoNetAppSupportwithoutyourinter
17、vention.RemoteSupportAgentuploadsacorefileonlyifitisnotcorruptedandthepanicsignaturedoesnotmatchanyknownpanicmessageintheNetApppanicmessagedatabase.Insuchacondition,thecaseisupdatedwiththelatestinformation.RemoteSupportAgenthandlescorefileuploadfailureasfollows:FailureonthestoragecontrollerIfthereis
18、afailureonthestoragecontrollerduringcorefilecollection,RemoteSupportAgentretriesthecorefilecollection.Ifunsuccessful,RemoteSupportAgentterminatestheretryandsendsafailurealarmtoRemoteSupportEnterprise.WhenRemoteSupportEnterprisereceivesthealarm,itnotifiesNetAppSupportthatanautomaticcoreuploadfailed.N
19、etAppSupportthenreachesouttocustomercontactstorequestamanualcoreupload.RemoteSupportEnterprisefaultornetworkoutageIntheeventofanetworkfaultoroutageduringafiletransmission,RemoteSupportAgentretriesthefileuploadseveraltimes.NotificationofdownstoragecontrollerWhentheSP/RLMdetectsthatastoragecontrolleri
20、sdown,forexample,duetoanabnormalreboot,theSP/RLMautomaticallytriggersanAutoSupportmessagetoNetAppSupport.Aproblemcaseiscreatedandthelistedhardwarecontactisnotified.AutoSupportmustbeenabledonallnodesintheclusterforthisfeaturetoworkcorrectly.HowRemoteSupportAgentusesAutoSupportRemoteSupportAgentenable
21、saNetAppSupportengineertoremotelytriggeranAutoSupportrequestonthestoragecontrollerandhavetheAutoSupportdatasentbacktoNetAppsupport.WhenAutoSupportisconfiguredandenabledontheNetAppstoragesystem,RemoteSupportAgentenablesNetAppSupporttobeginproblemdiagnosticsimmediatelywithoutwaitingforyoutosendanupdat
22、edAutoSupportmessage.ItalsoenablesNetAppSupporttoeffectivelytroubleshootcasesthatoccurduringoffhourswhenyouarenotavailabletosendanAutoSupportmessage.WhenRemoteSupportAgentsendsacommandtoDataONTAPtotriggeranAutoSupportmessage,themessageisuniquelyidentifiedbythesubjectlinenRemoteSupportAgenttriggeredA
23、SUP.nRemoteSupportAgentusesthesystemnodeautosupportcommandparametersthatareconfiguredonthenode.ForinformationaboutconfiguringandenablingAutoSupport,seetheClusteredDataONTAPSystemAdministrationGuideforClusterAdministrators.HowRemoteSupportAgentusesHTTPorHTTPSRemoteSupportAgentusesHTTPorHTTPStocommuni
24、catewiththestoragecontrollertoinitiatecommandsandtocollectfiles.ItusesHTTPStosendsystemlogsandcorefilesfromtheDataONTAProotvolumetoRemoteSupportEnterpriseontheNetAppSupportside.Duringacasetriage,theSupportteamoftenrequiresthesystemlogsandcorefiles.BecauseRemoteSupportAgentdoesnothavedirecthardwareac
25、cesstothesefiles,itusesHTTPorHTTPStorequestthesefilesfromthestoragecontroller,tomanuallytriggeranAutoSupportmessagefromthestoragesystem,andtomonitortheprogressofcorefileoperations.ItusesHTTPStocommunicatewithRemoteSupportEnterpriseontheNetAppSupportsideandtosendsystemlogsandcorefilesthatarelocatedon
26、theDataONTAProotvolume.RemotedatacollectionbytheNetAppSupportteamislimitedtofileswithinthemrootetccrashandmrootetclogdirectoriesandtheirsubdirectories.UsingHTTPenablesRemoteSupportAgentsfasteraccesstothediagnosticsdataontheNetAppcontroller.UsingHTTPSenablesenhancedsecurityonthedataflowbetweenRemoteS
27、upportAgentandtheNetAppcontrollerwithinyourintranet.Youshouldselectthebesttransportoptionbasedonperformanceandsecurityconsiderations.HowRemoteSupportAgentprovidesdataandnetworksecurityToensuredataandnetworksecurity,RemoteSupportAgentenablesyoutohavefullcontrolandvisibilityoverallremoteeventsandactiv
28、ities.RemoteSupportAgentusesthefollowingsecuritymeasures:Connectionsareoutboundonly.ConnectionbetweenRemoteSupportAgentandRemoteSupportEnterpriseisalwaysinitiatedbyRemoteSupportAgent.Thisensuresthatthereisonlyanoutboundconnectionfromyoursitetotechnicalsupport.RemoteSupportAgentdoesnotallowdial-inacc
29、essfromNetApptoyoursystem.RemoteSupportAgentperiodicallyconnectstoRemoteSupportEnterprise,downloadsanyactionrequests,anduploadsthesystemstatusorresultstosatisfypreviousrequeststoRemoteSupportEnterprise.Thenonalhealthcheckconnectionintervaliseveryfiveminutesforstoragecontrollersthatarenotbeingactivel
30、yassistedbyaNetAppSupportengineerincasetriage.Theconnectioninten,alchangestoevery10secondsifaNetAppSupportengineerrequestsremotedatacollectionfromthestoragesystem.Thecollectionintervalreturnstothenomialintervalwithinashorttimeaftercasetriagerequestshavestopped.Allcommunicationsareauthenticated.Commu
31、nicationbetweenRemoteSupportAgentandRemoteSupportEnterpriseisencryptedusing128-bitVeriSignsignedSecureSocketLayer(SSL)certificates.RemoteSupportAgentretainsacopyoftheRemoteSupportEnterprisepubliccertificatetoensurethatcommunicationoccursonlywithNetAppSupport.Iftheauthenticationfails,theconnectionisb
32、rokenandnodataissent. Accesstodiagnosticdataiscontrolled.RemoteSupportAgentconnectstotheNetAppSupportserverperiodically,totransferinformationandrespondtoservicerequests.Afterdataexchange,ifnosession(suchasafiletransfer)isactive,theconnectionisclosed.RemoteSupportAgentdoesnothaveaccesstoyouruserdata.
33、Theonlydirectorytreesthatareaccessiblefromtherootvolumeofthestoragesystemaremrootetccrashand/mroot/etc/logdirectoriesandtheirsubdirectories.Diagnosticdataisstoredsecurely.DatathatisuploadedfromRemoteSupportAgentisstoredinahighlysecureOracledatabasebehindtheNetAppcorporatefirewall.Accesstothisdataisr
34、estrictedtoauthorizedNetAppSupportpersonnel.AllactionstakenbyNetpSupportusingRemoteSupportEnterprisearerecordedandcanbeauditedbyaccessingtheRemoteSupportEnterpriseinterfaceatyourNetAppSupportsitelogin. Securityassessmentsareconductedperiodically.SecurityassessmentshelptoensurethatRemoteSupportAgentc
35、onformstoindustrybestpracticesforprotectingyourdata.Formoreinformation,seetheThird-PartySecurityAssessmentlinkundertheAdditionalInformationheadingtoexaminetheRemoteLANModuleSecurityAssessmentwhitepaperbySSecuritypoliciesarecheckedatstartup.WhenRemoteSupportAgentstarts,itchecksthesecuritypoliciesthat
36、areconfiguredinthestoragecontroller.RemoteSupportAgentisnotifiedwheneveryouchangethesecuritypolicies.IfthesecuritypolicydoesnotallowcommunicationtotheRemoteSupportEnterpriseserver,thenRemoteSupportAgentdoesnotconnecttoRemoteSupportEnterprise.RemoteSupportAgentfeatures,includingremotedatacollection,c
37、oreupload,andAutoSupportmessagegeneration,aredisabled.Ifthesecuritypolicyischangedfromallowingcommunicationtonotallowingcommunication,thenRemoteSupportAgentreportsthenewpolicytoRemoteSupportEnterpriseandstopsanysubsequentcontactwithRemoteSupportEnterprise.YoucandisabletheconnectiontoNetAppSupportand
38、allRemoteSupportAgentfeaturesbyusingthersasetupcommandwiththepolicy-enableoptionsettoNo.HowtheSP/RLMprovidesdataandnetworksecurityTheSP/RLMonyourstoragecontrollerusessingleoutbound-onlyethemetconnection,locallysecuredusernameandpasswords,andasingleportfordataandnetworksecuritysupport. Asingleethemet
39、connectionistheonlyexternalinterfaceontheSP/RLM.TheSP/RLMfirewallpreventsincomingconnectionsfromoutsideyournetwork.ItallowsonlyconnectionsfromwithinyournetworkbytheDataONTAPadministrationaccounts(inboundSSHonly). ConnectionstoNetAppareoutgoingonly.OnlyanoutgoingconnectiontoNetApponport443isallowed.D
40、atacollectionisonlyfromthe/mroot/etc/crashandmrootetclogdirectories,andtheirsubdirectories.AdministratoruserIDandpasswordisrequired.TheadministratoruserIDandpasswordthatisconfiguredinDataONTAPissuppliedtotheconfigurationoftheRemoteSupportAgentsothatitcancommunicatewithDataONTAP.TheSP/RLMcontrolsacce
41、sstothestoragesystem.Thereisnorequirementforaspecialaccount;youcanuseanyaccountaslongasitisintheDataONTAPAdministratorsgroup.Ifmultipleadministratorsaresharingtheaccount,thenarecommendedbestpracticeistocreateaspecialaccountforRemoteSupportAgentusage.Onlyoneportacceptsconnections.TheonlySP/RLMporttha
42、tacceptsconnectionrequestsisSSH(port22).TheonlyoutboundportsallowedareSMTP(port25),SNMP(trapport162),andSSL(port443).WheretofindmoreinformationaboutRemoteSupportAgentYoucanfindadditionalinformationaboutRemoteSupportAgent,SP,RLM,andRemoteSupportEnterpriseindocumentsontheNetAppSupportSite. TheNetAppRe
43、moteSupportDiagnosticsToolsectionoftheNetAppSupportScontainsusefulbackgroundinformation,anFAQsection,andasecurityassessment.TheClusteredDataONTAPSystemAdministrationGuideforClusterAdministratorscontainsinformationaboutSPandRLM,AutoSupport,andRemoteSupportEnterprise.TheDataONTAPUpgradeandRevertZDowng
44、radeGuideforCluster-ModecontainsinformationaboutupdatingtheSPandRLMfirmware.11ConfiguringRemoteSupportAgentConfiguringRemoteSupportAgentconsistsofupgradingtheSPRLM,configuringyourstoragesystem,andthenconfiguringRemoteSupportAgent.Pre-deploymentconsiderationsforCluster-ModeBeforeyoubegintoconfigureRe
45、moteSupportAgent,youmustensurethatitsatisfiesyoursecuritypoliciesforInternetaccess.BeforeyoudeployRemoteSupportAgentinyourclusterenvironment,allofthefollowingconditionsmustexistandrequirementsmustbemet.FormoreinformationaboutDataONTAPcommands,seetheClusteredDataONTAPSystemAdministrationGuideforClust
46、erAdministratorsandtheappropriatemanpages.RemoteSupportAgentrequirementsYoumusthavearemotemanagementdeviceonyourNetAppFASandV-Seriesstoragesystems:RemoteSupportAgentisprovidedasafirmwareupgradetotheRemoteLANModule(RLM)card.Firmware3.0orlaterisrequired;release4.0orlaterisrecommended.,RemoteSupportAge
47、ntisincludedintheSen,iceProcessor(SP)firmwareonFASandV-Series2200,3200,and6200systems. Youmusthavea128-bit,encrypted,outboundHTTPSconnectiontotheInternetoverport443.,Youmusthavea10/100Mbpsfull-duplexEthernetportwithautonegotiationenabled. YoumusthaveaccesstothetargetURL. AutoSupportmustbeenabledonthestoragesystem.StoragesystemrequirementsTheSer,iceProcessor(SP)orRemoteLANModule(RLM)mustbeconfigured.ThespsetupandrimsetupcommandsdisplaytheSPorRLMconfiguration.AutoSupportmustbeenabledonthestoragesystem.
