Preparing a non-administrator domain user on the NetApp filer for Data Insight


Preparing a non-administrator domain user on the NetApp filer for Data Insight
Prev	Configuring NetApp file server monitoring	Next

To configure a NetApp filer from the Management Console, you can use an account which is not in the administrators group on the NetApp filer, but has some specific privileges.

Perform the following steps on the NetApp filer console to add a non-administrator user, for example, testuser.

To create a non-administrator user

Create a new role, for example testrole, using the useradmin utility on the filer.
Add the login-* and API-* capabilities to the role.
For example, useradmin role add testrole -a login-*,api-*.

You can also choose to assign specific capabilities to the role.

Table: Additional capabilities for adding a non-administrator user account provides a detailed description of each capability.
Create a new group, for example, testgroup and apply the role testrole to it.
For example, useradmin group add testgroup -r testrole.
Add the user testdomain\testuser to testgroup
For example, useradmin domainuser add testdomain\testuser -g testgroup.
Add the user testdomain\testuser to Backup Operators group.
For example, useradmin domainuser add testdomain\testuser -g Backup Operators.

Note:

For vfilers, append the above command-line examples with vfiler run <vfilername>.

Table: Additional capabilities for adding a non-administrator user account

Capability	Description
login-http-admin	Enables you to log into the NetApp filer and run commands. With this capability, you can get latency statistics (for scan throttling), volume size information, or discover shares.
api-system-get-ontapi-version api-system-get-version	Enables you to get the ONTAPI version number and the system version number respectively. These are required to set the login handle context properly. Data Insight reports a failure when you test the connection to the filer, if these capabilities are absent. Also, if these capabilities are absent, you cannot execute any APIs including those required to discover shares, and get latency statistics.
api-fpolicy-set-policy-options	Enables you to set a flag on the NetApp filer to enable ACL change notifications. If you choose not to supply this capability to Symantec, the filer administrator must set this property manually using the root telnet console (fpolicy options <policyname> cifs_setattr on).
api-fpolicy-list-info api-fpolicy-create-policy api-fpolicy-enable-policy api-fpolicy-disable-policy api-fpolicy-destroy-policy	Required to enable Data Insight to automatically create and enable FPolicy on the NetApp filer. Optionally, the filer administrator can set up the policy using the root telnet console. Data Insight reports a failure when you test the connection to the filer, if these capabilities are absent. However, you can save a filer with the policy that is already created and enabled by the filer administrator without testing the connection to the filer.
api-fpolicy-server-list-info api-fpolicy-list-info	Used to retrieve useful statistics from the NetApp filer, such as, total event count and event failures. These APIs are used every two hours so they do not load the system. However, absence of these capabilities does not cause any problems.
api-license-list-info	Used to check if this NetApp filer has CIFS license and print the appropriate diagnostic message. Data Insight reports a failure when you create or enable FPolicy on the filer or when you test the connection to the filer, if these capabilities are absent. However, you can save a filer with the policy that is already created and enabled by the filer administrator without testing the connection to the filer.
api-options-set	Used to enable the global FPolicy flag on the NetApp filer. In the absence of this capability, FPolicy creation fails. Also, Data Insight reports a failure when you test the connection to the filer, if these capabilities are absent. However, you can save a filer with the policy that is already created and enabled by the filer administrator without testing the connection to the filer.
api-cifs-share-list-iter-start api-cifs-share-list-iter-next api-cifs-share-list-iter-end	Used to discover shares on the NetApp filer. Absence of these capabilities can result in a failure to discover the shares. Optionally, you can add shares manually from the Data Insight console.
api-perf-object-get-instances-iter-start api-perf-object-get-instances-iter-next api-perf-object-get-instances-iter-end	Used to get CIFS latency information from the NetApp filer, which enables the self-throttling scan feature of Data Insight. Absence of these APIs can cause scanner to fail if you enable the feature to throttle scanning.
api-volume-list-info	Used to periodically fetch size information for NetApp volumes.
api-nfs-exportnfs-list-rules	Used to discover all NFS shares that are exported from the NetApp filer. If this capability is absent, these NFS shares are not discovered.
api-net-ping api-net-resolve	Used to check network connectivity from the filer to the Data Insight Collector. These APIs are useful to run some diagnostic checks on the filer. However, such checks can also be done manually by the NetApp administrator, and hence these APIs are not mandatory.
api-fpolicy-volume-list-set	Used to set the volume names on the filer which are to be excluded from being monitored by FPolicy. If this capability is absent, you cannot exclude volumes from being monitored by FPolicy from the Data Insight console . However, you can exclude volumes manually using the CLI on the NetApp console. See Excluding volumes on a NetApp file server.
api-system-get-info	Used to discover the NetApp system serial number. The information is used by external reporting tools like Veritas Operations Manager (VOM) to report about the NetApp filers that Data Insight monitors. This privilege is mandatory if VOM integration is required.

Prev	Up	Next
Preparing the NetApp vfiler for Fpolicy	Home	Enabling export of NFS shares on a NetApp file server