Start a Conversation

Unsolved

This post is more than 5 years old

K

4145

March 20th, 2013 06:00

Celerra and ISILON ISI_VOL_COPY command


Hi,

We're in the middle of migrating from CELERRA to ISILON and are running into issues using both ROBOCOPY and EMCOPY.

In order to use these tools the initiatior needs to have sufficient rights on the source volume/share as these tools are file based.

In our organization the NAS administrator is not always the same person as the administrator of the shares and volumes and as such we don't always have the necessary rights on these volumes to read all files with skipped files as a result.

ISILON has a toold called "isi_vol_copy" which does block based copies using the NDMP framework .. however all documentation speaks about migrations between NetApp and ISILON.  I'm now wondering whether this tool is also supported on CELERRA.  Does anybody has any experience with this?

Thx,

8.6K Posts

March 20th, 2013 07:00

No – I don’t think it does

The NDMP data format is not part of the standard – its vendor specific

Isi_vol_copy was specifically written to “translate” between the NetApp and the Isilon NDMP data format

Emcopy should be able to cope with insufficient rights on the source files/dirs IF if is run as Domain Administrator with Backup privileges and the proper options.

Check the forum here – there were a number of posts about it

BTW there is also an Isilon support forum here at ECN

467 Posts

March 21st, 2013 04:00

What you can do is run your process as a domain administrator.  If you have more than one CIFS server on the celerra (ie it's in more than one AD domain) you may need to use a domain administrator for each server.  It should get you most everything you need doing it that way. 

Also,  I have some tools i've written on my blog which may help you our a bit as part of the migration.  I have a script to export your celerra filesystems and create the folder and quota on isilon,  create your nfs and cifs shares, and one which will generate your emcopy commands for you.

All can be found at http://blog.virtualstoragezone.com

8.6K Posts

March 21st, 2013 05:00

Even with domain admin removed from the ACL’s a program using Backup Operator privilege can still copy the files

Just like a (good) Backup application can backup/restore files that aren’t normally accessible to the user running the backup

Not that it’s not a “free pass” – the privilege needs to specifically invoked by the program using a special API.

If you just think that you can give BO priv to a user and then use explorer to copy/open files – that won’t work.

Backup files and directories (SeBackupPrivilege)

Allows the user to circumvent file and directory permissions to backup the system.

The privilege is selected only when the application attempts to access through the NTFS backup application interface.

Otherwise normal file and directory permissions apply.

This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file.

Any access request other than read is still evaluated with the ACL.

The following access rights are granted if this privilege is held:

·        READ_CONTROL

·        ACCESS_SYSTEM_SECURITY

·        FILE_GENERIC_READ

·        FILE_TRAVERSE

Emcopy and robocopy in backup mode can do this – of course sometime there are bugs

See for example http://support.microsoft.com/kb/979808/en-us

467 Posts

March 21st, 2013 05:00

Interesting - never thought about that.  I think i'd just use nfs to copy the permissions and make sure to maintain the ACLs... I like to use cpio for these types of copies

1 Rookie

 • 

20.4K Posts

March 21st, 2013 05:00

we have customers who manage their own permissions and domain admin is removed from ACLs.

Moderator

 • 

284 Posts

March 21st, 2013 10:00

If you use NFS to copy the data off of Celerra, you will lose the Windows extended ACLs, as NFS does not support these.  You will need to use a copy tool like EMCOPY in order to retain all of the extended ACLs on each of the files in Celerra.

Don't forget about the other tools that go along with EMCOPY, like LGDUP and EMCACL, which can also help you retain ACLs and permissions as you copy.

1 Rookie

 • 

20.4K Posts

March 21st, 2013 10:00

you can use lgdup with Isilon ?

8.6K Posts

March 21st, 2013 11:00

Well – in order for lgdup to work the CIFS server has to have implemented the Microsoft API to manage localgroups

It doesn’t run towards a mapped drive – it really needs a CIFS server name to talk to

1 Rookie

 • 

20.4K Posts

March 21st, 2013 11:00

lgdup mentions that source and target should be netbios name ..is that what you mean by "mapped drive" ? If that's the case, what do i specify for Isilon: SmartConnect Name, Cluster netbios name ?

Thanks

Moderator

 • 

284 Posts

March 21st, 2013 11:00

You're probably right, I'm not sure I have the right privs to test it in the lab, so I don't know whether or not you can modify Isilon LGs from the command line.  If you can only do so from the Admin console, then lgdup won't work.

Moderator

 • 

284 Posts

March 21st, 2013 11:00

lgdup is run on a Windows host, and you specify a source and target mapped drive.  So it is working through the CIFS protocol, not through any magic on the backend with the Celerra specifically (or the Isilon for that matter).  The help does say that you use the tool to move from an NT server to a Celerra, but like I said you specify a source and target server bame, on which you have to have Admin or Account Operators privs in order to run the tool.  So it's not doing anything magical.

Moderator

 • 

284 Posts

March 21st, 2013 11:00

I also can't use the MMC to manage LGs, so that's probably a fair indication that lgdup won't work.

1 Rookie

 • 

20.4K Posts

March 21st, 2013 12:00

William Stein wrote:

I also can't use the MMC to manage LGs, so that's probably a fair indication that lgdup won't work.

i can (OneFS 6.5.5.12)

Moderator

 • 

284 Posts

March 21st, 2013 12:00

dynamox wrote:

William Stein wrote:

I also can't use the MMC to manage LGs, so that's probably a fair indication that lgdup won't work.

i can (OneFS 6.5.5.12)

That's a good sign.  If you have the requisite permissions on the source and target, I don't see why it wouldn't work.

1 Rookie

 • 

20.4K Posts

March 21st, 2013 12:00

i can use Windows MMC to connect to Isilon SMB server and create local groups, would that imply that lgdup would work as well ? I have virtual isilon running, will need to test it out.

No Events found!

Top