Net 装机维护 DataONTAP82ArchiveandComplianceManagement.docx

《Net 装机维护 DataONTAP82ArchiveandComplianceManagement.docx》由会员分享，可在线阅读，更多相关《Net 装机维护 DataONTAP82ArchiveandComplianceManagement.docx（137页珍藏版）》请在三一文库上搜索。

1、NetAppxDataONTAP8.2ArchiveandComplianceManagementGuideFor7-ModeNetApp, Inc.495 East JaVa Drive Sunnyvale, CA 94089 U.S.Part number: 215-07975_A0May 2013Telephone:+1(408)822-60Fax:+1(408)822-4501Supporttelephone:+1(888)463-8277Web:Feedback:doccommentsContentsWhatSnapLockis9HowSnapLockworks9Hardwarepl

2、atformsSUPportedforSnapLock10LicensingSnapLockfunctionality10EnablingtheSnapLockfunctionality11SnapLockandAutoSupportmessages11WhatComplianceClockis12WhatsystemConiplianceClockis12WhatvolumeComplianceClockis12InitializingthesystemComplianceCIock13ViewingthesystemCompIianceClockandvolumeComplianceClo

3、cktime13UpgradeconsiderationsforComplianceClock14HowthevolumeComplianceClockimpactsSnapLockoperations15OperationsthatmightaffectvolumeComplianceClocktime15CreatingSnapLockvolumes16CreatingSnapLocktraditionalvolumes16CreatingSnapLockaggregatesandtheirflexiblevolumes17SnapLockCompliancewriteverificati

4、onoption18UsingtheSnapLockCompliancewriteverificationoption18WhataWORMfileis19HowtomanageWORMdata20TransitioningdatatotheWORMstate20DeterminingtheWORMstatusofafile21ExtendingtheretentiondateofaWORMfile22WhattheWORMappendfileis23CreatingaWORMappendfile23Whatretentionperiodis25HowtheSnapLockvolumerete

5、ntionperiodworks26Viewingtheretentionperiodofavolume26Whattheminimumretentionperiodis27Settingtheminimumretentionperiod28Whatthemaximumretentionperiodis28Settingthemaximumretentionperiod29Whatthedefaultretentionperiodis29Settingthedefaultretentionperiod30CommittingfilestoWORMstateautomatically31HowS

6、napLockautocommitfeatureworks31Settingtheautocommitperiod31DisplayingtheautocommitperiodofaSnapLockvolume34Whattheprivilegeddeletefeatureis35Howprivilegeddeleteworks35Limitationsoftheprivilegeddeletefunctionality36Ensuringsecureconnectiontothestoragesystem37Enablingprivilegeddeletefunctionality37Dis

7、ablingordisallowingprivilegeddeletefunctionality38DeletingaWORMfileusingprivilegeddelete38Howprivilegeddeleteaffectsmirroringinteractions39Considerationswhenusingtheprivilegeddeletefeature40WhatSnapLockloggingis41TypesofSnapLocklogfiles4lWhattheSnapLocklogfilecontains42AdvantagesofSnapLocklogging45L

8、imitationsofSnapLocklogging46AssigningaSnapLocklogvolume46Howarchivingalogfileworks47Archivinglogfiles47FindingthestatusoftheSnapLocklogfile48UpgradeandrevertconsiderationsforSnapLocklogging49HowDataONTAPtracksthefilesonSnapLockvolumes50DestroyingaSnapLockvolume50Destroyingaggregates50HowSnapLockuse

9、sfingerprints52Howafingerprintiscalculated52Inputparametersforthefingerprintoperation53Calculatingthefingerprintofafile53Outputparametersforthefingerprintoperation54SnapLockinteractionwithavFilerunit57CreatingtherootofavFilerunitfromaSnapLockvolumetoanon-SnapLockvolume571.imitationsofvFilerunitsonSn

10、apLockvolumes58SnapLockinteractionwithHAconfiguration59SnapLockinteractionwithMetroCIuster60SnapLockinteractionwithFIexCIonevolumes61ProtectingyourSnapLockvolumeswithSnapMirror62SnapLockqtreeSnapMirrorresynchronizationrestrictions62Whatthedumpfileis63ExtractingfilesfromthedumpfileafteraqtrccSnapMirr

11、orrcsynchronization63Howtosetancnd-to-cndSnapLockCompliancevolumeSnapMirrorrelationship64LimitationsoftheSnapMirrorrelationship64CreatingavolumeSnapMirrorrelationshipforaFlexVolvolume65CreatingavolumeSnapMirrorrelationshipforatraditionalvolume66TheSnapLockforSnapVauItfeature-secureSnapVauItdestinati

12、on68GuidelinesforusingtheSnapLockforSnapVauItfeature69Aspectsofcapacityplanning70GuidelinesforestimatingSnapVaultsecondarystoragesystemvolumesize70Estimatingthelogvolumesize71HowtosetupSnapVauItbackups72ConfiguringaprimarystoragesystemforSnapVault72ConfiguringaSnapVaultsecondarystoragesystem73Schedu

13、lingSnapVaultupdatebackupsontheprimarystoragesystem74SchedulingSnapVaultupdatebackupsontheSnapVaultsecondarystoragesystem75SchedulingSnapVaultupdatebackupsontheSnapVaultprimaryandsecondarystoragesystemschedules75GuidelinesforschedulingSnapVaulttransfers76ManagementofWORMSnapshotcopiesbyusingSnapVauI

14、t77HowretentionofSnapshotcopiesworksonSnapLockvolumes77HowSnapshotcopiesarenamedonSnapLockvolumes77RetentionperiodforWORMSnapshotcopiescreatedbySnapVault78DefaultSnapVaultsettingsfortheWORMSnapshotcopiesretentionperiod78SpecifyingretentionperiodforWORMSnapshotcopies78ExtendingtheretentionperiodofWOR

15、MSnapshotcopies79ListingSnapshotcopiesontheWORMvolume80ListingSnapshotcopiesandretentiondates80DeletingexpiredWORMSnapshotcopies81Howtoretainmorethan255SnapVaultSnapshotcopies82HowtocreateanewvolumetoretainmoreSnapshotcopies82AdvantagesofcloningSnapshotcopies82AdvantagesofcopyingSnapshotcopies83Crea

16、tinganewvolumeforretainingSnapshotcopies83Verifyingthestateoftheoldvolume83RemovingtheSnapVaultschedulesfortheoldvolume85Creatingavolumeclonetoanewvolume85CopyingtheappropriateSnapshotcopytoanewvolume86Checkingorsettingtheretentionperiodonthenewvolume87Checkingvolumeoptionsonthenewvolume87Restarting

17、allSnapVaultrelationshipsinthenewvolume88ReconfiguringtheSnapVaultschedulesinthenewvolume88EnsuringthemigrationofSnapshotcopies89StoppingallSnapVaultrelationshipsintheoldvolume89BackupofthelogvolumescreatedbytheSnapLockforSnapVaultfeature90ProtectingalogvolumeoftheSnapLockforSnapVauItfeature90Failin

18、govertothestandbysystem90Reestablishingstandbyprotection90HowtoresynchronizeabrokenSnapVaultrelationship91TurningSnapVaultoff91ManagementofSnapVauItlogfiles92RegulatorycomplianceandSnapVaultlogfiles92HowSnapVaultmaintainscompliance92Operationslogfile92Files-transferredlogfiles93Configuringthelogvolu

19、mesoftheSnapLockforSnapVaultfeature93Wherethelogfilesarekept94Whatfiles-transferredlogfilescontain94Typesoflogentriesrecorded95Logentryformat95Howlogentriesarecreated96HowtoprovidebackupandstandbyprotectionusingSnapMirror98SettingupbackupandstandbyprotectionforSnapVauIt99Reestablishingbackupandstand

20、byprotectionforSnapVault99Returningtotheoriginalbackupandstandbyconfiguration1001.imitationstocompliancebackupandstandbyservice100HowtomanageSnapLockthroughDataONTAPAPIs102WhatONTAPIis103SettingupaclienttouseONTAPIcalls104BenefitsofusingtheDataONTAPAPIsuite107ListofSnapLockAPIs108VoIume-Create108fil

21、e-get-snaplock-retention-time109file-get-snaplock-retention-time-list-infb-max109file-set-snaplock-retention-time109file-snaplock-retcntion-time-list-infb109snaplock-get-log-volume109snaplock-get-options109snaplock-log-archive110snaplock-log-status-list-infb110snaplock-privileged-delete-filc110snapl

22、ock-set-log-volume110snaplock-set-options110file-get-fingerprint110snaplock-get-system-compliance-clock111snaplock-get-volume-compliance-clock111Whattheextendeddaterangemechanismis112SettingfilestoWORMstatefromanapplication113UsingSnapLockvolumedefaultstosetretentionperiod115UsingtheSnapLockautocomm

23、itfeaturefromanapplication116HowtoimplementSrl叩LOCkfeaturesthroughDataONTAPAPIs.117UsingtheSnapLockprivilegeddeletefeaturefromanapplication.118UsingtheSnapLockloggingfeaturefromanapplication119Whatevent-basedretentionis120Whatlegalholdis121Implementationofevent-basedretentionandthelegalholdfeatureus

24、ingSnapLock122Implementingevent-basedretentionandlegalhold123Deletingarecordusingtheprivilegeddeletefeature125ExamplesforsettingafiletoWORMstateusinganapplication126ExamplesforsettingtheSnapLockvolumedefaults129Examplesforsettingtheautocommitfeatureandtimeintervals130Examplesforcreatingacompliancead

25、ministrator131ExamplesforsettingaSnapLocklogvolume133Examplesforenablingtheprivilegeddeletefeature134Examplesforperformingaprivilegeddelete135Copyrightinformation136Trademarkinformation137Howtosendyourcomments138Index139WhatSnaDLOCkisSnapLockisanalternativetothetraditionalopticalwriteonce,readmany(W

26、ORM)data.SnapLockisusedforthestorageofread-onlyWORMdata.SnapLockisalicense-based,disk-based,open-protocolfeaturethatworkswithapplicationsoftwaretoadministernon-rewritablestorageofdata.TheprimaryobjectiveofthisDataONTAPfeatureistoprovidestorage-enforcedWORMandretentionftnctionalitybyusingopenfileprot

27、ocolssuchasCIFSandNFS.SnapLockcanbedeployedforprotectingdatainstrictregulatoryenvironmentsinsuchawaythateventhestorageadministratorisconsideredanuntrustedparty.SnapLockprovidesspecialpurposevolumesinwhichfilescanbestoredandcommittedtoanonerasable,non-rcwritablestateeitherforeverorforadesignatedreten

28、tionperiod.SnapLockallowsthisretentiontobeperformedatthegranularityofindividualfilesthroughstandardopenfileprotocolssuchasCIFSandNFS.HowSnapLockworksTheWORMdataonSnapLockvolumesisadministeredinthesamewayasdataonregular(nonWORM)volumes.SnapLockvolumesoperateinWORMmodeandsupportstandardfilesystemseman

29、tics.YoucancreatedataonaSnapLockvolumeandcommitittotheWORMstatebytransitioningthefilefromawritablestatetoaread-onlystate.Markinganactivewritablefileasread-onlyonaSnapLockvolumecommitsthedatatoWORM.WhenafileiscommittedtoWORM,itcannotbealteredordeletedbyapplications,users,oradministratorsuntilthefiler

30、etentiondateisreached.TheexceptionisinSnapLockEnterprisevolumes,whereyoucandeleteafilebeforeitreachestheretentiondatebyusingtheprivilegeddeletefeature.ThedatathatiscommittedtotheWORMstateonaSnapLockvolumecannotbechangedordeletedbeforeitsretentiondate.However,youcanchangeordeletetheemptydirectoriesan

31、dfilesthatarenotcommittedtoaWORMstate.Directoriesdonotbehaveanydifferentlythantheywouldonregularvolumes,withtheexceptionthattheycannotberenamedormovedoncecreated.ItisarequirementforregulatorycompliancethatWORMdatabenotonlynon-erasableandnon-rewritable,butitmustalsobelockeddowninthesamelocationatwhic

32、hitwascreated.InthecaseofWORMimplementation,thismeansthatthedirectorypathtoWORMfilesmustbelockeddownandshouldneverchange.InDataONTAP7.0andlater,WORMfilescanbedeletedaftertheirretentiondateshavebeenreached.TheretentiondateonaWORMfileissetwhenthefileiscommittedtotheWORMstate,butitcanbeextendedatanytim

33、e.TheretentionperiodcanneverbeshortenedforanyWORMfile.HardwareplatformssupportedforSnapLockSnapLockisexclusivelyalicensedfeatureofDataONTAPandissupportedonalmostallNetApphardwareplatfns.V-SeriessupportsSnapLockEnterpriseonbothnativeandthird-partystorage,however,SnapLockComplianceissupportedonlyonnat

34、ivedisks.1.icensingSnapLockfunctionalityYoumustlicenseSnapLockCompliance,SnapLockEnterprise,orbothbeforeyoucanusetheSnapLockfeature.Afterinstallingthelicense,youneedtoenablethem.BeforeyoubeginYoumustensurethatStorageEncryptionfunctionalityisnotenabledonthestoragesystem.StorageEncryptionisnotsupporte

35、dwithSnapLock.IfStorageEncryptionisenabledonastoragesystem,youcannotusetheSnapLockfunctionality.IfaSnapLocklicenseisinstalledonthestoragesystem,StorageEncryptionfunctionalitywillbeunavailable.AboutthistaskSnapLockdoesnotsupportsolid-statedrive(SSD)aggregates.Steps1. CheckiftheSnapLocklicensesexiston

36、thestoragesystembyenteringthefollowingcommand:license2. InstallalicenseforSnapLockCompliance,SnapLockEnterprise,orbothbyusingthelicenseaddcommand.TousetheSnapLockCompliancefeature,enterthefollowingcommand:licenseaddsnaplock_licenseToinstalltheSnapLockEnterprisefeature,enterthefollowingcommand:licens

37、eaddsnaplock_enterpriseAfteryoufinishEnabletheSnapLocklicense.RelatedtasksEnablingtheSnapLockfunctionalityonpage11EnablingtheSnapLockfunctionalityAfterinstallingtheSnapLocklicense,youmustalsoenablethefunctionality.BeforeyoubeginYoumusthavelicensedtheSnapLockCompliance,SnapLockEnterpriseorboththefunc

38、tionalities.AboutthistaskNote:IfyourstoragesystemcontainsSnapLocklicenseandyouupgradetoDataONTAP8.2,theSnapLockfunctionalitywillbeenabledbydefault.Steps1. Dependingonyourrequirement,completeoneofthefollowingsteps:If you want to.Enable the SnapLock Enterprise functionalityDisable the SnapLock Enterpr

39、ise functionalityEnterthefollowingcommand.optionslicensed_feature.snaplock_enterprise.enableonoptionslicensed_feature.snaplock_enterprise.enableoff2. Dependingonyourrequirement,completeoneofthefollowingsteps:If you want to.Enable the SnapLock Compliance functionalityDisable the SnapLock Compliance f

40、unctionalityEnterthefollowingcommand.optionslicensed_feature.snaplock.enableonoptionslicensed_feature.snaplock.enableoffAfteryoufinishInitializethesystemComplianceClock.SnapLockandAutoSupportmessagesIfyouenabletheAutoSupportfeature,thestoragesystemsendsAutoSupportmessagestotechnicalsupport.AutoSuppo

41、rtmessagesincludeevent,log-leveldescriptions,SnapLockvolumestateandoptions.TheAutoSupportmessagesalsocontainthesystemComplianceClocktime,thevolumeCompIianceClocktimeofalltheSnapLockvolumes,andtheexpirydateofallvolumesonthestoragesystem.Note:AutoSupportmessagesdonotincludeoptionssuchasaprivilegeddele

42、tesetting.ToknowmoreabouttheAutoSupportmessages,seetheDataONTAPSystemAdministrationGuidefor7-Mode.WhatCompIianceCIockisComplianceClockisasecuretimebasethatpreventscompliantdatafrombeingtamperedwith.ComplianceClockmakesitimpossibletoprematurelymodifyordeletedatabyalteringsystemclock.StartingwithDataO

43、NTAP8.1,therearetwotypesofComplianceClockvolumeComplianceClockandsystemComplianceClock.ThesetwotypesofComplianceClockminimizetheComplianceClocklagandenabletheexpiryofWORMfileswithextendedretention.RelatedconceptsWhattheextendeddaterangemechanismisonpage112WhatsystemCompIianceCIockisAsystemCompliance

44、Clockisasecuretimebaseforeachstoragesystem.ThesystemComplianceClockprovidestheinitialvalueforvolumeComplianceClockwhenanewSnapLockvolumeiscreated.ThesystemComplianceClockconfigurationisusedasareferencetimeforupdatingthevolumeComplianceClock.WhatvolumeCompIianceCIockisThevolumeComplianceClockisatime-

45、basedsecurityfeatureforeachvolume.ThevolumeComplianceClockisusedtodeterminetheexpirydateofWORMfilesandSnapshotcopiesinaSnapLockvolume.ThevolumeComplianceClockisinitializedautomaticallyduringthecreationofanewSnapLockvolume.WhenanewSnapLockvolumeiscreated,thevolumeComplianceClockgetsitsinitialtimefrom

46、thesystemCompIianceClocktime.Since,eachSnapLockvolumemaintainsitsownvolumeComplianceClockvalue;therefore,achangeintheComplianceClockvalueofonevolumedoesnotaffecttheComplianceClockofanyothervolume.HowvolumeCompIianceCIockinteractswiththesystemCompIianceCIockThevolumeCompIianceClockobtainsitsstartingv

47、aluefronthesystemComplianceClocktimewhenanewvolumeiscreated.Therefore,acontinuousassociationismaintainedbetweenthevolumeComplianceClockandsystemComplianceClock.ThisassociationminimizestheinstancesofComplianceClocklag.InitializingthesystemCompIianceCIockYoumustinitializethesystemComplianceClocktocreateSnapLockvolumes.Duringinitialization,thesystemCompIia