Manual Pages

Table of Contents

NAME

SYNOPSIS

options option

options [ option value ] ...

DESCRIPTION

auditlog.enable
Enables/disables the audit logging of commands executed at the console/telnet shell or by using rsh. The default is on. The data is logged to the file /etc/log/auditlog for a filer or /logs/auditlog if the system is a NetCache. The maximum size of auditlog file is allowed to grow to the value specified by the auditlog.max_file_size option. If the auditlog file reaches this size, and on every Saturday at 24:00, /etc/log/auditlog is moved to /etc/log/auditlog.0, /etc/log/auditlog.0 is moved to /etc/log/auditlog.1, and so on (similarly for /logs/auditlog if it is a NetCache). Assuming they do not get full, auditlog files are saved for a total of six weeks.

auditlog.max_file_size
This option controls the maximum size (in bytes) that the auditlog file is allowed to grow to (see above). The default value for this option is 10000000.

autologout.console.enable
Enables/disables the autologout of console connections. The default is on which causes console connections to be disconnected after the console has been idle for the number of minutes specified by the autologout.console.timeout value. Any change to this
option is effective after a command is entered.

autologout.console.timeout
The number of minutes the console is idle after which console connections are disconnected if autologout.console.enable is on. The default is 60 minutes. Any change to this option is effective after a command is entered.

autologout.telnet.enable
Enables/disables the autologout of telnet connections. The default is on which causes telnet connections to be disconnected after the number of minutes specified by the autologout.telnet.timeout value. Any change to this option requires a logout before it takes effect.

autologout.telnet.timeout
The number of minutes after which telnet connections are disconnected if autologout.telnet.enable is on. The default is 60 minutes. Any change to this option requires a logout before it takes effect.

autosupport.cifs.verbose
If on, includes CIFS session and share information in autosupport messages. If off, those sections are omitted. The default is off.

autosupport.content
The type of content that the autosupport notification should contain. Allowable values are complete and minimal. The default value is complete. The minimal option allows the delivery of a "sanitized" and smaller version of the autosupport, at the cost of reduced support from Network Appliance. Please contact Network Appliance if you feel you need to use the minimal option. The complete option is the traditional (and default) form of autosupport. If this option is changed from complete to minimal then all previous and pending autosupport messages will be deleted under the assumption that complete messages should not be transmitted.

autosupport.dafs.verbose
If on, includes more detailed DAFS information in autosupport messages. If off, this detail is omitted. The default is off.

autosupport.doit
Triggers the autosupport daemon to send an autosupport notification immediately. A text word entered as the option is sent in the notification subject line and should be used to explain the reason for the notification.

autosupport.enable
Enables/disables the autosupport notification features (see na_autosupport(8)). The default is on to cause autosupport notifications to be sent. This option will override the autosupport.support.enable option.

autosupport.from
Defines the user to be designated as the sender of the notification. The default is postmaster@your.domain. Email replies from Network Appliance will be sent to this address.

autosupport.mailhost
Defines the list of up to 5 mailhost names. Enter the host names as a comma-separated list with no spaces in between. The default is an empty list.

autosupport.minimal.subject.id
Defines the type of string that is used in the identification portion of the subject line when autosupport.content is set to minimal. Allowable values are systemid and hostname. The default is systemid.

autosupport.noteto
Defines the list of recipients for the autosupport short note email. Up to 5 mail addresses are allowed. Enter the addresses as a comma-separated list with no spaces in between. The default is an empty list to disable short note emails.

autosupport.retry.count
Number of times to try resending the mail before giving up and dropping the mail. Minimum is 5; maximum is 4294967295 ; The default is 15 .

autosupport.retry.interval
Time in minutes to delay before trying to send the autosupport again. Minimum is 30 seconds, maximum is 1 day. Values may end with `s', `m' or `h' to indicate seconds, minutes or hours respectively, if no units are specified than input is
assumed to be in seconds. The default value is 4m.

autosupport.support.enable
Enables/disables the autosupport notification to Network Appliance The default is on to cause autosupport notifications to be sent directly to Network Appliance as described by the autosupport.support.transport option. This option is superceded (overridden) by the value of autosupport.enable.

autosupport.support.proxy
Allows the setting of an http based proxy if autosupport.support.transport is https or http. The default
for this option is the empty string, implying no proxy is necessary.

autosupport.support.to
This option is read only, it shows where autosupport notifications to Network Appliance are sent if autosupport.support.transport is smtp.

autosupport.support.transport
Allows setting the type of delivery desired for autosupport notifications that are destined for Network Appliance. Allowed values are https, http (for direct web based posting) or smtp (for traditional email). The default value is https. Note that http and https may (depending on local network configuration) require that the autosupport.support.proxy option be set correctly. Also smtp requires that autosupport.mailhosts be configured correctly before autosupport delivery can be successful.

autosupport.support.url
This option is read only, it shows where autosupport notifications to Network Appliance are sent if autosupport.support.transport is https or http.

autosupport.throttle
Enables autosupport throttling (see na_autosupport(8)). When too many autosupports are sent in too short a time, additional messages of the same type will be dropped. Valid values for this option are on or off. The default value for this option is on.

autosupport.to
Defines the list of recipients for the autosupport email notification. Up to 5 mail addresses are allowed. Enter the addresses as a comma-separated list with no spaces in between. The default is an empty list. Note that it is no longer necessary to use autosupport@netapp.com in this field to direct autosupport messages to Network Appliance. Please use autosupport.support.enable instead.

backup.log.enable
Backup logging captures important events during dump/restore and records them in /etc/log/backup on root volume. The option allows users to enable or disable this feature. By default, the option is on.

cf.giveback.auto.cifs.terminate.minutes
This options specifies the number of minutes to delay an automatic giveback before terminating CIFS clients that have open files. During the delay the system will periodically send notices to the affected workstations. If 0 (zero) minutes are specified then CIFS clients will be terminated immediately.

cf.giveback.auto.enable
This options turns on/off automatic giveback. An automatic giveback is invoked when one node of a cluster is in takeover mode and "down" node is repaired and reboots. The repaired node will boot into Data ONTAP and the node in takeover mode will detect this and initiate a giveback.

This feature is only available on flash booted systems.

cf.giveback.auto.terminate.bigjobs
This option, when on, specifies that automatic giveback should immediately terminate long running operations (dump/restore, vol verify, etc.) when initiating an automatic giveback. When this option is off the automatic giveback will be deferred until the long running operations have completed.

cf.giveback.check.partner
This option turns on/off checking for partner readiness before starting giveback. It's being used on flash booted systems only.

When this option is on, if operator types in "cf giveback", before starting giveback, the node in takeover state checks that partner has actually booted halfway up. If partner is not ready yet, giveback won't start.

When this option is off, if operator types in "cf giveback", giveback starts without checking partner's status.

The default value is on, which reduces down time caused by a giveback.

Two filers in a cluster can have different settings for this option.

cf.takeover.detection.seconds
This option provides a knob to tune the timer used in takeover detection.

The timer is used by cluster software in monitoring partner node's status. If partner node has not been responding more than n seconds, where n is the value of this option, local node decides to take over.

Two nodes do not need to have same value for this option. This provides asymmetric takeover behavior in terms of aggressiveness.

The default value of this option is 20 seconds. The option can be set to any value between 10 and 180. It is strongly advised that it is set to a value larger than or equal to sk.process.timeout.override+5.

cf.takeover.on_failure
This option allows automatic takeover to be disabled. By default, this option is set to on and a filer will automatically takeover it's partner filer if the latter fails. If set to off, automatic takeovers are disabled, but operator can still initiate manual takeovers.

This option is available only when cluster is licensed and changing the value on one filer automatically changes the value on the partner filer.

cf.takeover.on_panic
This option turns on/off the takeover on panic feature. It's available only when cluster is licensed. Changing the value on one filer automatically changes the value on the partner filer.

This option is turned on when either fcp or iscsi is licensed.

This option is turned off when both fcp and iscsi have been unlicensed.

Users should use caution when manually changing the option value.

cifs.audit.enable
When this option is on, CIFS audit events may be generated for file access or for logon and logoff. For file access events to be generated, the option cifs.audit.file_access_events.enable must also be on. For logon and logoff events to be generated, the option cifs.audit.logon_events.enable must also be on. This option default is off.

cifs.audit.file_access_events.enable
When both this option and the cifs.audit.enable option are on, file access events will be audited when a file is accessed by an account for an operation and the file has a System Access Control List (SACL) entry that matches the access. If no SACL entry matches the access, then no event will be generated. The default is on.

cifs.audit.logon_events.enable
When both this option and the cifs.audit.enable option are on, logon and logoff events will be generated. Logon and logoff events reflect CIFS session connects and disconnects, respectively. The default is on.

cifs.audit.logsize
Specifies the maximum event log file size. The default is 524288. The minimum is 524288 and maximum is 68719476736.

cifs.audit.saveas
Specifies the active event log file. The file must be in an existing directory in a network share. The default log file is /etc/log/adtlog.evt.

cifs.bypass_traverse_checking
When on (the default), directories in the path to a file are not required to have the `X' (traverse) permission. This option does not apply in UNIX qtrees.

cifs.comment
Defines the CIFS server description. CIFS clients see the CIFS server description when browsing servers on the network. The default value for this option is a null string.

cifs.guest_account
Enables a user to get access to the filer provided that either the filer uses a Domain Controller for authentication and the user is not in a trusted domain, or the filer uses the /etc/passwd file or the NIS password database for authentication and the user has no entry in the /etc/passwd or the NIS password database. If this option is set to the name of an account in the password database, a user logging into the filer will be assigned to the guest account if their name is not listed in the password database (when using /etc/passwd or NIS) or if the user is not from a trusted domain (when using a domain controller). The configured user name will be used for the UNIX user ID, group ID, and group set of the specified account. If the option is a null string, guest access is disabled. The default value for this option is a null string.

cifs.home_dir
Specifies the location of user home directories. The argument for the option is a comma-separated list of existing directory paths that are searched in order. If no list is supplied, the current list is displayed. The directories under these paths should have the names of users as their names. When a user connects to the filer using CIFS and there is a directory name that exactly matches the user's name, they will see a share with their name. That is their home directory. Only that user can access the home directory using this share. No other user can see that share name since other users are logged in under a different user name. The default value for this option is the null string. To set this option to the default value (a null string), use a pair of double quotes ("") as the argument.

This command is deprecated.

System administrators are encouraged to write CIFS home directory paths to the file /etc/cifs_homedir.cfg (one path per line).

cifs.home_dir_namestyle
Specifies how the name portion of the path to a user's home directory is determined. If no argument is supplied, the current value of this option is displayed. Valid values for this option are: a null string, ntname, hidden, mapped, or domain. All user home directory paths begin with one of the CIFS home directory paths, followed by a slash and the user's name. If this option is set to ntname then a user's Windows login name is used and only downward symlinks (in the directory hierarchy) are followed. If this option is set to hidden then a user's Windows login name is used. However, the user must append a dollar sign to their user name when connecting to the filer, and the filer will append a dollar sign to the user's name when enumerating the homedir share name. If the value of this option is mapped then the user's UNIX name is used. The UNIX name is obtained by mapping the user's Windows login name using the file /etc/usermap.cfg. If this option is set to domain then the user's name includes both the user's domain and Windows login name separated by a slash. The default value for this option is the null string, which acts like ntname with the exception that symlinks are followed in any direction. To set this option to the default value (a null string), use a pair of double quotes ("") as the argument.

cifs.homedirs_public_for_admin
Specifies whether members of the filer's Builtin\Administrators group can connect to the CIFS home directories of other users. If no argument is supplied, the current value of this option is displayed. If this option is set to on then an administrator can connect to the CIFS home directory of user username by specifying the share ~username (tilde username). This can be useful when setting a user profile to map the user's CIFS home directory on the filer. Windows 2000 Active Directory does not allow a system administrator to set a user's profile to a nonexistent share, and normally a user's CIFS home directory can only be accessed by that user and not by the administrator. The default is on.

cifs.idle_timeout
Specifies the amount of idle time in seconds before the filer disconnects a session. An idle session is a session in which a user does not have any files opened on the filer. The value of this option ranges from 600 to 4,000,000 (effectively infinite). The default is 1800.

cifs.max_mpx
This option controls how many simultaneous operations the filer reports that it can process. An "operation" is each I/O the client believes is pending on the filer including outstanding change notify operations. This value defaults to 50, but clients such as Windows Terminal Server or IIS may require that this number to be increased to avoid errors and performance delays.

CAUTION - The approved values for this parameter are 126, 253, and 1124. The most accurate way to determine which number to use is to measure the RedirectorCurrent Commands statistic on the client with NT perfmon and to increase the number until Current Commands does not hit the negotiated limit. For more information see Microsoft Knowledge Base articles Q191370 and Q232890.

CAUTION - This number should only be changed while cifs is terminated.

CAUTION - Only use the approved values to avoid Q232890.

CAUTION - This value affects allocations in the clients. Use the smallest value necessary for correct behavior.

cifs.netbios_aliases
Provides a comma-separated list of alternative names for the filer. A user can connect to the filer using any of the listed names.

This command is deprecated.

System administrators are encouraged to write CIFS NetBIOS aliases to the file /etc/cifs_nbalias.cfg (one alias per line). Use the "cifs nbalias load" command to cause the filer to process the cifs_nbalias.cfg file. For more information, see the CIFS chapter in the System Administrator's Guide.

cifs.netbios_over_tcp.enable
This option enables the use of NetBIOS over TCP, which is the standard protocol used for CIFS prior to Windows 2000. It defaults to "true". In certain Windows 2000 networks it is desirable to disable that protocol. This option corresponds to the "Enable NetBIOS over TCP" setting in the Windows 2000 Advanced TCP/IP settings tab. If it is set "false" all clients must be Windows 2000, and only Windows 2000 domain controllers and virus scanners can be used.

cifs.netbios_over_tcp.enable takes effect when cifs starts. It should not be changed while cifs is running.

cifs.nfs_root_ignore_acl
When on, ACLs will not affect root access from NFS. The option defaults to "off".

cifs.oplocks.enable
When cifs.oplocks.enable is on (the default), the filer allows clients to use oplocks (opportunistic locks) on files. Oplocks are a significant performance enhancement, but have the potential to cause lost cached data on some networks with impaired reliability or latency, particularly wide-area networks. In general, this option should be disabled only to isolate problems.

cifs.oplocks.opendelta
This option defines the length of artificial delay before sending an opportunistic lock break request to a client that has recently sent the filer an open request. This is done to work around a bug in Microsoft Windows clients that can cause the client to ignore an oplock break request if it is received at a certain time.

The units of this option are in milliseconds. The default is 8 milliseconds. Changes to the option take effect immediately; it is not necessary to restart anything.

For example, when opendelta is 8, the filer will make sure that at least 8 milliseconds have elapsed after receiving or responding to an open-file request before it sends an oplock break on that session.

CAUTION - This option should not be set higher then 35 milliseconds without consulting NetApp Customer Support.

cifs.per_client_stats.enable
Turning this option "on" causes the filer to start gathering statistics on a per-client basis. This allows use of the cifs top command, as well as the -u and -h options of cifs stat. Administrators should be aware that there is overhead associated with collecting the per-client stats. This overhead may noticeably affect filer performance. If the option is turned off, any existing per-client statistics are discarded. The value may be changed at any time without restarting CIFS. The default value of this option is "off".

cifs.perm_check_ro_del_ok
NT delete rules do not allow you to delete a file with the DOS read-only bit set. However, a number of multiprotocol applications require UNIX delete semantics (w-x perms in parent dir without regard to the file's permissions). This option controls this behavior. By default it is "off", which yields NT behavior.

cifs.perm_check_use_gid
This option affects security checking for Windows clients of files with UNIX security where the requester is not the file owner. In all cases Windows client requests are checked against the share-level ACL, then if the requester is the owner, the "user" perms are used to determine the access.

If the requester is not the owner and if perm_check_use_gid is on it means files with UNIX security are checked using normal UNIX rules, i.e. if the requester is a member of the file's owning group the "group" perms are used, otherwise the "other" perms are used.

If the requester is not the owner and if perm_check_use_gid is off, files with UNIX security style are checked in a way which works better when controlling access via share-level ACLs. In that case the requester's desired access is checked against the file's "group" permissions, and the "other" permissions are ignored. In effect, the "group" perms are used as if the Windows client were always a member of the file's owning group, and the "other" perms are never used.

The default setting is on for new installations. For existing installations, this has the opposite effect of the old "PC-mode" installation setting.

If you do not plan to use share-level ACLs to control access to UNIX security style files (e.g. in a UNIX qtree), you might wish to change this setting to on.

cifs.restrict_anonymous.enable
Controls the ability of non-authenticated sessions to enumerate shares and groups. The default is off.

cifs.save_case
This will force all created file names to lower case for better compatibility between 16 bit applications and certain UNIX tools. The default is on.

cifs.scopeid
NetBIOS scope IDs allow the system administrator to create small workgroups out of a network by partitioning the NetBIOS name space; only clients with the same NetBIOS scope ID as the filer will be able to use the filer as a CIFS server. The default scope ID is a null string, but if the filer is to run in a NetBIOS scope other than the default one, its scope ID must be set to the scope ID of that scope. The scope ID can be changed only when CIFS is not running.

cifs.search_domains
Specifies a list of domains that trust each other to search for a mapped account. The argument for the option is a comma-separated list that is searched in order. The default value for this option is the null string. If this option is set to a null string, all domains are searched. You use this option to control searches if you used an asterisk for a domain name in the usermap.cfg file.

cifs.show_snapshot
By default this option is FALSE. The snapshot directory ~snapshot is no longer shown at the root of a share. This is a change in behavior from previous versions. Setting this to TRUE will restore the old behavior. On Windows NT 4 or Windows 95 clients, the user can access snapshots by entering \\filer\share\.snapshot (or ~snapshot or ~snapsht) in the Start->Run menu. Snapshots can also be accessed lower in the share by providing a path to a lower directory. Snapshots can be accessed through DOS on any system by changing to the ~snapsht directory.

NOTE: When this option is TRUE it can confuse programs like FastFind that don't know about snapshots.

cifs.shutdown_msg_level
Normally a message is broadcast to all clients when CIFS is terminating. This option can be set to control this behavior. The value "0" results in never sending such broadcast messages. The value "1" results in sending broadcast messages only to sessions which have open files. The value "2" causes the messages to be sent to all open connections, which is the default behavior.

cifs.sidcache.enable
By default this option is TRUE. This options controls whether or not CIFS will cache SID-to-name translation information that it has received from the domain controllers.

cifs.sidcache.lifetime
By default this option is 1440, which is 24 hours specified in minutes. The option controls how long a SID-to-name cache entry is used before it becomes stale. The SID-to-name mapping functions in the filer will query the appropriate domain controller to update the cached mapping when it is needed, but has become stale. This option is specified in minutes.

cifs.snapshot_file_folding.enable
By default this option is FALSE. This option controls whether or not CIFS will attempt to `fold' files on close with previous snapshot versions of themselves in order to minimize disk usage. Disk space is saved by sharing unchanged file blocks between the active version of the file, and the version of the file in the latest snapshot, if any. The filer must compare block contents when folding a file, so there is a performance vs. space utilization tradeoff to consider with this option.

cifs.symlinks.cycleguard
The cifs.symlinks.cycleguard option (on by default), eliminates the possibility of traversing directories cyclically during the process of following symbolic links. With this option set to on, if the target of the symlink resolves to a directory that is directly above the symlink's parent directory, it is disallowed.

With this option set to off, many standard Windows apps (such as Find in Win95 / NT4.0) will not operate correctly when a symlink points to a parent directory. This is because they do not understand symbolic links and will repeatedly loop on them. Users should use caution when changing this option.

cifs.symlinks.enable
When cifs.symlinks.enable is on (the default), if the object being accessed by a CIFS client is a symbolic link (whether absolute or relative), the filer follows the link with the proviso that the ultimate target turns out to reside within the originating share (thus ensuring that the client has access permission to the target).

cifs.trace_dc_connection
When cifs.trace_dc_connection is on (the default is off), the filer logs all domain controller address discovery and connection activities. This can be used to diagnose DC connection problems on the filer.

cifs.trace_login
When cifs.trace_login is on (the default is off), the filer logs all login-related activities. This can be used to diagnose access problems on the filer.

cifs.weekly_W2K_password_change
This option only affects filers installed in Windows 2000 domains. When "on", this option causes the filer to change its domain password once a week, as is current practice for the filer in NT4 domains. The password change occurs at approximately 1:00 am on Sunday mornings. For Windows 2000 domains with multiple DCs, a password change may inhibit CIFS connections for a short time while the new password is propagated among the DCs. The default for this option is "off". This option has no effect on filers installed in pre-Windows 2000 domains.

cifs.widelink.ttl
When a CIFS client accesses a "wide symbolic link" (widelink), the filer returns both a path referral and a time-to-live value. The CIFS client can cache the widelink path referral for the time-to-live time period. This option allows the system administrator to set the value which the filer returns for time-tolive.

cifs.wins_servers
Displays the list of WINS servers specified during cifs setup as a comma-separated list. This option cannot be set using the options command; it must be set using cifs setup.

cksum_offload.gbeII
Specifies whether calculation of TCP and UDP checksums is offloaded to network interface cards. Offloading reduces CPU utilization. The value "on" enables offloading, and "off" disables it. The option affects Ethernet Controllers numbered II and higher. Checksums are not offloaded for outbound UDP packets in most cases, regardless of the option setting.

On systems initially installed with 6.2 or later releases, the default is "on". Prior to 6.2 the default was "off", and a software upgrade does not change the value.

console.encoding
Specifies how non-ASCII character information is presented. The value can be:

nfs - NFS character set. You can use both NFS extended (> 0x7F) and SGML characters for input.

sgml - SGML character format. You can use both NFS extended (greater than 0x7F) and SGML characters for input.

utf8 - UTF-8 character sets. For input, any character greater than 0x7F is the beginning of a UTF-8 encoding.

The default is nfs.

coredump.metadata_only
Specifies whether complete or partial cores will be dumped. Partial cores are missing the wafl buffers that contain user data. The values can be:

on - Do not dump buffers containing user data.

off - Dump all memory.

The default is on.

dafs.enable
Determines whether the DAFS server starts by default on a filer.

dafs.max_requests_server
Sets the maximum number of requests that the DAFS server can attempt to concurrently execute. Requests submitted which would exceed this limit will be pended (see dafs.max_pending_requests_server) until existing requests complete.

dafs.max_disconnected_sessions
Sets the maximum number of abnormally disconnected client sessions that the DAFS server will save until recovery can be made. If the number of abnormally disconnected client sessions would exceed this limit then the oldest disconnected session will be removed.

dafs.max_pending_requests_server
Sets the maximum number of pending (awaiting initial issue) DAFS requests. This option is only used when the number of DAFS concurrent requests has exceeded dafs.max_requests_server, causing new DAFS requests to be pended. If a new request would exceed dafs.max_pending_requests_server then the request is rejected.

dafs.max_requests
Sets the maximum number of concurrent DAFS requests that a single session may request during session negotiation.

dafs.max_request_size
Sets the maximum size of a request buffer that a single session may request during session negotiation. This should not normally be changed from the default, but can be set to allow (or disallow) clients with exceptionally large DAFS requests to execute. The value is expressed in bytes, and limits the total request size including DAFS operation and generic response headers.

dafs.max_response_size
Sets the maximum size of a response buffer that a single session may request during session negotiation. This should not normally be changed from the default, but can be set to allow (or disallow) clients with exceptionally large DAFS responses to execute. The value is expressed in bytes, and limits the total response size including DAFS operation and generic response headers.

dafs.checksums.enable
Enables use of DAFS-level checksums for DAFS requests and responses. This option may be overridden on a per-NIC basis using the dafs command.

dafs.auth_none.enable
Enables use of the DAFS AUTH_NONE (no security) authentication. This is disabled (off) by default. Please see the DAFS Protocol for more information.

dafs.default_uid
Sets the default numeric user id (uid) to be used when DAFS client credentials are supplied as CRED_DEFAULT or AUTH_DEFAULT. Please see the DAFS Protocol for more information.

dafs.default_gid
Set the default numeric group id (gid) to be used when DAFS client credentials are supplied as CRED_DEFAULT or AUTH_DEFAULT. Please see the DAFS Protocol for more information.

dafs.num_requestd
Sets the default number of DAFS request-processing servers to start for each NIC. This option may be overridden on a per-NIC basis using the dafs command.

dafs.idle_timeout
Sets the time in seconds that a DAFS session can be idle (no requests made) before it is a candidate for disconnection by the filer. A value of 0 disables the idle timeout mechanism. The default idle timeout is 7200 seconds (2 hours). The maximum idle timeout is 65535 seconds (about 18 hours.)

dafs.session_reuse_threshold
Sets the minimum number of seconds a DAFS session must be idle before it becomes eligible for disconnection to reclaim resources needed for other active sessions. The values for this option are expressed in seconds and its default is set to 600. A value of 0 indicates that no session should ever be disconnected in order to free resources for other sessions.

disk.target_port.cmd_queue_depth
Sets the maximum number of concurrent commands that can be dispatched to any target port on an external RAID array. This is useful on gFilers, which support large numbers of LUNs behind a single device ID. If too many commands are issued the overall performance of the external RAID array may be degraded. A value of 0 indicates that no limit is enforced on any target port.

dns.domainname
Sets the DNS domainname to the specified domainname.

dns.enable
Enables DNS client on the filer. The DNS domain must be set and the /etc/resolv.conf file must exist prior to enabling DNS.

dns.cache.enable
Determines whether the DNS cache is used when looking up names. It is on by default. Turning it off will have the side effect of flushing the dns cache. This option has no effect if DNS is not enabled.

fcp.enable
Determines whether FCP service starts by default on a filer.

fpolicy.enable
When turned off, this disables all file policies on the filer, overriding the settings for individual file policies. When turned on, the setting of a given file policy determines if that file policy is enabled or disabled.

ftpd.enable
If on the appliance accepts FTP connections on port 21. If off connections on port 21 are refused. The default is off.

ftpd.3way.enable
Enables/disables third-party transfers. When turned on, allows the transfer of files directly with a remote FTP server. When turned off, the ip address specified in the PORT command must match that of the FTP client; in passive mode only TCP connections from the client will be allowed. This option takes effect immediately and persists across reboots. The default is off.

ftpd.anonymous.enable
Enables/disables anonymous user logins. By default, the options is turned off. An anonymous user will only be allowed to access "anonymous" home directory and its subtrees, however it won't be able to access across volumes. The regular user will not have this limitation unless ftpd.dir.restriction option is set.

ftpd.anonymous.home_dir
Sets the home directory of the anonymous user. By default, it is set to /vol/vol0/home/ftp.

ftpd.anonymous.name
Sets the login user name for the anonymous user, by default, it is set to anonymous.

ftpd.auth_style
Sets the ftpd login authentication style to be one of ntlm, unix or mixed. By default, it is set to mixed.

ftpd.dir.restriction
Sets user home directory restriction to be one of none, homedir or <path>. By default, it is set to none, which means there is no home directory restriction for regular users. When the option is set to homedir, each regular user's file access will be restricted to its own home directory. When the option is set to <path>, all regular users' file access will be redirected and restricted to this special <path>.

ftpd.idle_timeout
Sets the time in seconds/hours/days that an FTPD session can be idle (no requests made) before it is a candidate for disconnection by the filer. A value of 0 disables the idle timeout mechanism. The default idle timeout is 900 seconds. The maximum idle timeout is 12 hours.

ftpd.log.enable
Enables/disables the ftp logging of commands and data transfer activities. By default, the options is turned on.

ftpd.log.filesize
When one of the ftp log files(ftp.cmd or ftp.xfer) reaches this size, /etc/log/ftp.cmd is moved to /etc/log/ftp.cmd.0, /etc/log/ftp.xfer is moved to /etc/log/ftp.xfer.0, /etc/log/ftp.cmd.0 is moved to /etc/log/ftp.cmd.1, /etc/log/ftp.xfer.0 is moved to /etc/log/ftp.xfer.1, and so on; The file size is set to 512k by default, and can range from 1k bytes to 4G-1 bytes. This option can accept an integer with a qualifier (k, K, m, M, g, G). If no qualifier is specified, the value will be in bytes.

ftpd.log.nfiles
Sets the maximum number of log files to be kept in the system. By default, it is set to 6, it can range from 1 to 100.

ftpd.locking
Sets the type of file locking used by FTPD during file retrieval. By default, it is set to none, which means files are not locked in any way during file retrieval. If this option is set to delete, then deletion and renaming is disallowed for files being retrieved.

ftpd.max_connections
Sets the maximum allowable concurrent ftpd connections. The default setting for this option is 400. The upper limit for this setting is 800. Because the other filer services share resources used for ftpd operations, it is possible for the number of ftpd connections that are actually available to be less than the number specified by ftpd.max_connections.it is set to 400. The maximum max_connections can be set up to 800.

ftpd.tcp_window_size
CAUTION -This number will affect ftpd performance, set according to your network configuration. By default, it is set to 32768 Byte.

gfagent.enable
Enables/disables the Gateway Filer agent.

gfagent.hdm.host
Sets the host address to which Gateway agent will send POST request.

gfagent.hdm.password
User password for Device Manager server.

gfagent.hdm.port
Port number of Device Manager's http server.

gfagent.hdm.user
User name for Device Manager server.

gfagent.hdm.uri
Uri to which Gateway agent send POST request.

gfagent.interval.minutes
Time interval between two successive scan/report in minutes.

httpd.admin.access
Restricts HTTP access to FilerView, the administration area of the filer, via a private Network Appliance URL: any URL beginning with /na_admin. For valid values, see na_protocolaccess(8). If this value is set, trusted.hosts is ignored for FilerView access.

httpd.admin.enable
Enables HTTP access to FilerView, the administration area of the filer, via a private Network Appliance URL: any URL beginning with /na_admin is mapped to the directory /etc/http. Thus, a man page on the filer toaster with the file name /etc/http/man/name can be accessed with the URL http://toaster/na_admin/man/name. Valid values for this option are on or off. The default value for this option is on.

httpd.admin.hostsequiv.enable
Enables the use of /etc/hosts.equiv for administrative HTTP authentication. If enabled, the authentication of administrative HTTP (for APIs) will use the contents of /etc/hosts.equiv in the same way that it is used for rsh authentication. See na_hosts.equiv(5) and na_rshd(8) for more details. Valid values for this option are on or off. The default value for this option is on.

httpd.autoindex.enable
Allows the filer to automatically generate a directory listing for directories that do not have an index file. Valid values for this option are on or off. The default value for this option is on.

httpd.access
Restricts HTTP access to the filer. Setting this value does not affect FilerView access set by httpd.admin.access. For valid values, see na_protocolaccess(8).

httpd.enable
Enables HTTP access to the filer. Valid values for this option are on or off. The default value for this option is off.

httpd.log.format
Specifies the log format. Valid values for this option are common or alt1. The default value for this option is common.

httpd.log.max_file_size
Specifies the maximum size that the HTTP log file /etc/log/httpd.log can grow to. The default is (2**31)-1 (or 2,147,483,647), which is the largest file size that many clients support. The valid range is 0 to (2**31)-1.

httpd.rootdir
Specifies the complete pathname of the root directory that contains files and subdirectories for HTTP access. The default for this is `xxx' as it is normally set to the appropriate location during http setup.

httpd.timeout
Specifies the minimum amount of time (in seconds) before an idle HTTP 15 connection will time out. The default is 900 seconds, which is fifteen minutes.

httpd.timewait.enable
When enabled, the filer will put HTTP connections that have been closed by the client into the TIME_WAIT state for one minute, which is twice the maximum segment lifetime (2*MSL). By default, TIME_WAIT state is bypassed for HTTP connections.

ip.fastpath.enable
If the option is on, the filer will attempt to use MAC address and interface caching ("Fastpath") so as to try to send back responses to incoming network traffic using the same interface as the incoming traffic and (in some cases) the destination MAC address equal to the source MAC address of the incoming data. This allows for automatic load-balancing between multiple interfaces of a trunk and between multiple filer interfaces on the same subnet. Valid values for this option are on or off. The default value for this option is on. For TCP connections, the system will also automatically detect if this optimization is not feasible in a specific environment or for a specific connection and turn Fastpath off automatically for those connections for which using Fastpath is inappropriate. The netstat command with the -x option can be used to see if Fastpath is enabled for a specific connection.

ip.match_any_ifaddr
If the option is on, the filer will accept any packet that is addressed to it even if that packet came in on the wrong interface. If you are concerned about security, you should turn this off. Valid values for this option are on or off. The default value for this option is on.

ip.path_mtu_discovery.enable
Enables/disables path MTU discovery; it is currently used only by TCP. Path MTU discovery, described in RFC 1191, allows a host to discover the ``maximum transmission unit'', i.e. the largest link-level packet that can be transmitted, over a path from that host to another host. This means that the filer needn't choose a conservative packet size for a TCP connection to a host not on the same net as the filer, but can attempt to discover the largest packet size that can make it to the other host without fragmentation. Valid values for this option are on or off. The default value for this option is on.

ip.ping_throttle.drop_level
Specifies the maximum number of ICMP echo or echo reply packets (ping packets) that the filer will accept per second. Any further packets within one second are dropped to prevent ping flood denial of service attacks. The default value is 10.

ip.ping_throttle.alarm_interval
Specifies the how often dropped pings will be syslogged in minutes. This prevents a ping flood denial of service attack from flooding the syslog with messages. A value of 0 turns of logging of ping floods. The default value is 0.

ip.tcp.newreno.enable
Enables/disables the use of the NewReno modification to TCP's fast recovery Algorithm (described in RFC 2582). Valid values for this option are on or off. The default value for this option is on.

ip.tcp.sack.enable
Enables/disables the use of TCP Selective Acknowledgements (described in RFC 2018). Valid values for this option are on or off. The default value for this option is on.

ip.ipsec.enable
Enables/disables the Internet Security Protocol (ipsec) support on the filer. Valid values for this option are on or off. The default value for this option is off.

iscsi.enable
Determines whether iSCSI service starts by default on a filer.

iscsi.iswt.tcp_window_size
CAUTION - This number will affect iSCSI performance for the iSCSI software target (ISWT) driver and defines the filer's receive TCP window size for all iSCSI connections involving this driver. The default setting is 65700 bytes. In general, for best performance, the value of this option should be set according to your network configuration, taking into account the latency of the underlying network. However, improved performance may be obtained with certain iSCSI initiators by tuning this value beyond the normal network calculations involving latency and roundtrip time. You must stop/start the iSCSI service for a change in this value to take effect.

ldap.enable
Turns LDAP lookup of uids and gids off or on. An entry must also be made in the /etc/nsswitch.conf file to use LDAP for this purpose.

ldap.servers
List of servers to use for LDAP queries. Use quotation marks to indicate servers whose names have embedded spaces or commas.

ldap.pref_servers
List of preferred LDAP servers. Use this list to indicate servers that are on faster links if any of the servers listed in ldap.servers is on a WAN link or is for some other reason considered slower or less reliable.

ldap.userid
The username to use for the administrative queries necessary to look up UIDs and GIDs given a username. Best practice is to make this a user with read-only access to the database.

ldap.passwd
The password to use for the administrative user. This will always display as six `*'s when listing the options.

ldap.basedn
The base distinguished name to use for user lookups. Typically this will be something like "cn=my company name, cn=uk".

ldap.port
The port to use for LDAP queries. This defaults to 389, LDAP's well-known port assignment. locking.grace_lease_seconds Sets the grace period for
clients to reclaim file locks after a server failure. The grace period is expressed in seconds. For leasebased lock protocols (currently DAFS), it also sets the locking lease period. Clients that have been inactive for a period equal or longer to the lease period may lose all their locking state on a filer.

ndmpd.access
Allows the administrator to restrict access to NDMP operations based on the hostname or the IP address. The default value for this option is all. See na_protocolaccess(8) for details.

ndmpd.authtype
Allows the administrator to control which authentication methods the filer will accept. NDMP supports two authentication types: challenge and plaintext. The default type is challenge. Challenge was MD5 and plaintext was text prior to Data ONTAP 6.4.

ndmpd.connectlog.enabled
Allows NDMP to track all the NDMP connection events for security purposes. Turning the option on allows all the NDMP connection events to be recorded in the syslog(/etc/messages) file. The default value for this option is being changed from on to off. By default, Data ONTAP 6.4 NDMP connection logging allows NDMP connection events for security audit purposes. This optional logging support causes all NDMP connection events to be recorded in the /etc/messages file. When used in conjunction with standard intrusion detection software NDMP connection logging provides a powerful security audit mechanism. However NDMP connection logging significantly increased the number of log messages written to the /etc/messages file. If NDMP connection auditing is not desired, it is advisable to disable NDMP connection logging option to reduce the size of the /etc/messages file. NDMP connection logging can be disabled by issuing the following command at the filer console: options ndmpd.connectlog.enabled off. NDMP connection logging can be enabled by issuing the following command at the filer console: options ndmpd.connectlog.enabled on.

ndmpd.enable
If on the NDMP daemon accepts requests. Turning the option off disables request handling by the NDMP daemon. The default is off. Enabling and disabling this option is equivalent to executing ndmpd on and ndmpd off respectively.

ndmpd.password_length
Allows administrator to select either 8-byte or 16-byte NDMP specific passwords. The default value is 16. This is the length in all existing versions of ONTAP that support this feature, so it will be backwards compatible. This option is persistent and the only legal values are 8 and 16. If an illegal value is entered, the following message will be prompted: options ndmpd.password_length: Length must be either 8 or 16. The options ndmpd.password_length controls password length during both generation and authentication. Supporting multiple concurrent NDMP specific password lengths is NOT required, and will not be possible. That is, if this options is set to 8, all NDMP applications managing backups for that filer MUST use an 8-byte password for authentication.

ndmpd.preferred_interface
You can specify the filer network interface to be used when establishing an NDMP data connection to another filer.

By default, an NDMP data connection uses the same network interface as the NDMP control connection established by the NDMP backup application. However, when a data connection between NDMP-enabled devices needs to be established over an alternate network, it is necessary to specify the filer's interface through which the alternate network will be accessed.

For example, a Unix or NT resident NDMP backup application and multiple NDMP-enabled filers can be interconnected via a corporate network. The same NDMPenabled devices can also be interconnected via an isolated private network. To minimize load on the corporate network, the ndmpd.preferred_interface option can be used to direct all NDMP data connections over the isolated private network.

To specify the preferred network interface to be used for NDMP data connections, issue the following command: options ndmpd.preferred_interface interface. interface identifies the network interface to be used for all NDMP data connections. Any network interface providing TCP/IP access can be specified. If no argument is specified, the command returns the name of the interface currently configured for data connections. If no interface is currently set, it reports disable. You can find the available network interfaces by using the ifconfig -a command.

To disable a preferred network interface specification and force the NDMP default interface to be used for data connections, issue the following command: options ndmpd.preferred_interface disable. The default value for the ndmp.preferred_interface option is disable.

Note: The ndmpd.preferred_interface option is persistent across filer reboots.

nfs.export.neg.timeout
The default for this option is 3600 seconds (one hour). This option sets the expiration time for entries which were denied access in the export access cache. The minimum value is 60 seconds and the maximum is 2 days.

nfs.export.pos.timeout
The default for this option is 36000 seconds (ten hours). This option sets the expiration time for entries granted access in the export access cache. The minimum value is 60 seconds and the maximum is 2 days.

nfs.kerberos.file_keytab.enable
The default for this option is off. When enabled, the vfiler is directed to use a file based Kerberos key table (in /etc/krb5.keytab), with a format equal to that generated by an MIT-based kadmin command.

nfs.kerberos.principal
The default for this string option is a zero length string. If nfs.kerberos.file_keytab.enable is enabled, then the nfs.kerberos.principal option must be set to the host specific part of an NFS server's Kerberos principal name. For example, if nfs.kerberos.principal is set to elrond.netapp.com, then the resulting principal name of the NFS server will be nfs/elrond.netapp.com@realm, where realm is the value of nfs.kerberos.realm. Note that nfs/elrond.netapp.com@realm must appear as an entry in /etc/krb5.keytab.

nfs.kerberos.realm
The default for this string option is a zero length string. If nfs.kerberos.file_keytab.enable is enabled, then the nfs.kerberos.realm option must be set to the host specific part of an NFS server's Kerberos principal name. For example, if nfs.kerberos.principal is set to NETAPP.COM, then the resulting principal name of the NFS server will be nfs/principal@NETAPP.COM, where principal is value of nfs.kerberos.principal. Note that nfs/principal@NETAPP.COM
must appear as an entry in /etc/krb5.keytab.

nfs.locking.check_domain
The default for this option is on. If this option is set to off, then the NFS version 2 and 3 lock manager (NLM) and the NFS version 2 and 3 status monitor (NSM) will ignore the domain suffix when comparing the client host name in an NSM request with that of client host name associated with an outstanding lock. One might want to set the nfs.locking.check_domain to off if one has NFS version 2 or 3 clients that issue NLM requests with fully qualified domain names (FQDNs) and NSM requests with non-FQDNs. Similarly, if the converse is true, one might want to turn nfs.locking.check_domain off. Otherwise, clients that send hostnames inconsistently will leave locks held on the filer, requiring manual intervention even after the client reboots (and sends the NSM recovery message).

If nfs.locking.check_domain is off, then one must take care to make sure than the non-FQDNs of each client are unique, lest two clients with different domains cause each other to lose locks. For example, if the option is off, then two NFS clients, one named wally.eng.netapp.com and the other named wally.corp.netapp.com will be considered as the same for purposes of processing the NSM recovery message when either client reboots. It is strongly recommended that clients be fixed and/or reconfigured to obviate the need for setting nfs.locking.check_domain to off.

Because NFS version 4 uses schemes for locking and lock recovery that are completely different than NLM and NSM, the nfs.locking.check_domain option and the associated issue, do not apply to NFS version 4.

nfs.mount_rootonly
When enabled, the mount server will deny the request if the client is not root user using privileged ports. Valid values for this option are on (enabled) or off (disabled). The default value for this option is on for more secure access.

nfs.mountd.trace
When enabled, all mount requests are logged. This option is intended to help debug denied mount requests. Valid values for this option are on (enabled) or off (disabled). The default value for this option is ff to avoid too many messages.

nfs.per_client_stats.enable
Enables/disables the collection and display of perclient NFS statistics, as described in na_nfsstat(1). Valid values for this option are on or off. The default value for this option is off.

nfs.require_valid_mapped_uid
If this option is "on" it forces all NFS requests to be successfully mapped via the /etc/usermap.cfg mechanism. This allows NFS requests to be selectively validated by UID or IP address. This mapping is described in na_usermap.cfg(5). Valid values for this option are on or off. The default value for this option is off.

nfs.tcp.enable
When enabled, the NFS server supports NFS over TCP. By default, the feature is disabled since some clients which support NFS over TCP do so with performance inferior to UDP. It can be enabled if this is not an issue in your environment. Valid values for this option are on or off. The default value for this option is off.

nfs.ifc.xmt.high
NFS goes into transmit flow control when the send window is full and the number of outstanding requests increases beyond nfs.ifc.xmt.high. At that time NFS will stop reading from the TCP input window. The default value for this option is set to 16. Its maximum limit is 64. This is a non-persistent option.

nfs.ifc.xmt.low
NFS comes out of flow control when the number of outstanding requests goes below nfs.ifc.xmt.low. The default value for this option is set to 8. Its minimum value is 0. This is a non-persistent option.

nfs.udp.xfersize
The maximum transfer size (in bytes) that the NFS mount protocol will negotiate with the client for UDP transport. Larger transfer sizes often result in better NFS performance. Prior to 5.3.5, this defaulted to 8192 due to a FDDI bug. For 5.3.5 and later the default is 32768.

nfs.v2.df_2gb_lim
Causes the filer to return replies to the "file system statistics" NFS version 2 request that shows no more than (2**31)-1 (or 2,147,483,647) total, free, or available bytes (i.e., 2GB) on the file system.

Some NFS clients require this option because, if they get return values from the "file system statistics" request with more than the specified number of bytes, they'll incorrectly compute the amount of free space on the file system, and may think that there's no free space on a file system that has more than 2GB free. Valid values for this option are on or off. The default value for this option is off.

nfs.v3.enable
When enabled, the NFS server supports NFS version 3. Disable this option if there is a problem with some client when using NFS version 3, and that client cannot be configured to use NFS version 2. Valid values for this option are on (enabled) or off (disabled). The default value for this option is on.

nfs.v4.enable
When enabled, the NFS server supports NFS version 4. NFS version 4 support is only over the TCP protocol. Valid values for this option are on (enabled) or off (disabled). The default value for this option is on.

nfs.v4.read_delegation
When enabled, read delegations are supported for NFS version 4. This feature is not supported for NFS versions 2 and 3. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off.

nfs.v4.id.domain
This option controls the domain portion of the string form of user and group names as defined in the NFS version 4 protocol. The domain name is normally taken from the NIS domain in use, or otherwise from the DNS domain. However if this option is set, it will override this default behavior. nfs.webnfs.enable When enabled, the NFS server supports WebNFS lookups. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off.

nfs.webnfs.rootdir
Specifies the WebNFS rootdir. Once the rootdir is set, WebNFS clients can issue lookups relative to the rootdir using the public filehandle. The default value for this option is `XXX'. This option is only used when nfs.webnfs.rootdir.set is on, and nfs.webnfs.rootdir.set can only be on if this option contains the fully qualified pathname to a valid, existing directory.

nfs.webnfs.rootdir.set
This option needs to be enabled for the rootdir setting to take effect. Disabling this option disables the existing rootdir setting. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off. Note that this option can only be enabled if the nfs.webnfs.rootdir option contains a fully qualified pathname to a valid, existing directory.

nis.domainname
Sets the NIS domain to the specified domainname. The default for value for this option is the null string.

nis.enable
Enables NIS client on the filer. The NIS domain must be set prior to enabling NIS. Valid values for this option are on or off. The default value for this option is off.

nis.group_update.enable
Enables the local caching of the NIS group files. Valid values for this option are on or off. The default value for this option is off.

nis.group_update_schedule
Specifies the hours of the day when the local NIS group cache has to be updated. `now' will update the cache immediately. The valid value for this option is a comma separated list of hours, in the range of 1 to 24. The default value for this option is 24.

nis.servers
Specifies the list of preferred NIS servers. Valid values for this option is `*' or a comma separated list of ip addresses. The default value for this option is `*'.

pcnfsd.enable
Enables/disables the PCNFSD (PC)NFS authentication request server (see na_pcnfsd(8)). Valid values for this option are on or off. The default value for this option is off.

pcnfsd.umask
Specifies the default umask for files created by (PC)NFS clients. The value of this option is a threedigit octal number, and the digits correspond to the read, write, and execute permissions for owner, group, and other, respectively. The default value for this option is 022, which means that files normally created with mode 666 effectively will have mode 644. (``644'' means that the file owner has read and write permissions, but the members of the group and others have only read permission.)

raid.media_scrub.enable
Enables/Disables continuous background media scrubs for all volumes within the system. Valid values for this option are on or off. The default value for this option is on. When enabled a low overhead version of scrub which checks only for media errors runs continuously on all volumes of the system. Background media scrub incurs negligible performance impact on user workload and uses aggressive disk and CPU throttling to achieve that.

raid.media_scrub.deadline
Sets the deadline period, in hours, for completing a media_scrub on any volume. Valid values for this option range from 72 to 336 hours. The default value for this option is 72 hours. This option determines the minimum rate at whch scsi verify requests will be scheduled to enable media scrub completion within the deadline period. Media scrubs can however complete much faster during idle periods of operation.

raid.default_raidtype
Specifies the default raidtype to use when creating new volumes. The possible values for this option are ""raid4" (one parity disk per raidgroup), and "raid_dp" (two parity disks per raidgroup).

raid.reconstruct_speed
This option is obsolescent. See raid.reconstruct.perf_impact for the option that controls the effect of RAID reconstruction.

raid.reconstruct.perf_impact
Sets the overall performance impact of RAID reconstruction. When the CPU and disk bandwidth are not consumed by serving clients, RAID reconstruction consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option lets you control how much of the CPU and disk bandwidth will be taken away for reconstruction, and hence how much of a negative performance impact it will be to the serving of clients. As you increase the value of this option, the speed of reconstruction will also increase. The possible values for this option are "low", "medium", and "high". The default value is "medium". There is also a special value of "default", which will use the current default value. When mirror resync and reconstruction are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

raid.reconstruct.wafliron.enable
Enables starting wafliron (see na_vol(1)) when reconstruction encounters a medium error. Valid values for this option are on and off. The default value for this option is on. When a medium error is encountered during reconstruction, access to the volume is temporarily restricted and reconstruction proceeds bypassing media errors. If this option is enabled, wafliron is started automatically, thus bringing the volume back online. If this option is disabled, the volume stays restricted.

raid.resync.perf_impact
Sets the overall performance impact of RAID mirror resync (whether started automatically by the system or implicitly by an operator issued command). When the CPU and disk bandwidth are not consumed by serving clients, a resync operation consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option lets you control how much of the CPU and disk bandwidth will be taken away for resync operations, and hence how much of a negative performance impact it will be to the serving of clients. As you increase the value of this option, the speed of resync will also increase. The possible values for this option are "low", "medium", and "high". The default value is "medium". There is also a special value of "default", which will use the current default value. When mirror resync and reconstruction are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

raid.scrub.duration
Sets the duration of automatically started scrubs, in minutes. If this is not set or set to 0, it defaults to 6 hours (360 minutes). If set to `-1', all automatic scrubs will run to completion.

raid.scrub.enable
Enables/disables the RAID scrub feature (see na_disk(1)). Valid values for this option are on or off. The default value for this option is on. This option only affects the scrubbing process that gets started from cron. For user requested scrubs, this option is ignored.

raid.scrub.perf_impact
Sets the overall performance impact of RAID scrubbing (whether started automatically or manually). When the CPU and disk bandwidth are not consumed by serving clients, scrubbing consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option lets you control how much of the CPU and disk bandwidth will be taken away for scrubbing, and hence how much of a negative performance impact it will be to the serving of clients. As you increase the value of this option, the speed of scrubbing will also increase. The possible values for this option are "low", "medium", and "high". The default value is "low". There is also a special value of "default", which will use the current default value. When scrub and mirror verify are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

raid.scrub.schedule
Specifies the weekly schedule (day, time and duration) for scrub started automatically by the raid.scrub.enable option. The default schedule is Sunday 1 a.m. for the duration specified by raid.scrub.duration option. If an empty string ("") is specified as an argument, it will delete the previous scrub schedule and add the default schedule. One or more schedule can be specified using this option. The syntax is duration[h|m]@weekday@start_time,[duration[h|m]@weekday@start_time,...]

where
duration is the time period for which scrub operation is allowed to run, in hours or minutes ('h' or `m' respectively). If duration is not specified, raid.scrub.duration option value will be used as duration for the schedule.

weekday
is the day when scrub operation should start. Valid values are sun, mon, tue, wed, thu, fri, sat.

start_time
is the time when scrub should start, specified in 24 hour format. Only hour (0-23) needs to be specified.

For example,
options raid.scrub.schedule 240m@tue@2,8h@sat@22 will cause scrub to start on every Tuesday at 2 a.m. for 240 minutes, and on every Saturday at 10 p.m. for 480 minutes.

raid.timeout
Sets the time in hours, as a number greater than or equal to 1, that the system will run after a single disk failure has caused the system to go into degraded mode. The default is 24. If the raid.timeout option is specified after the system is already in degraded mode, the timeout is set to the value specified and the timeout restarted.

raid.verify.perf_impact
Sets the overall performance impact of RAID mirror verify. When the CPU and disk bandwidth are not consumed by serving clients, a verify operation consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option lets you control how much of the CPU and disk bandwidth will be taken away for verify, and hence how much of a negative performance impact it will be to the serving of clients. As you increase the value of this option, the speed of verify will also increase. The possible values for this option are "low", "medium", and "high". The default value is "low". There is also a special value of "default", which will use the current default value. When scrub and mirror verify are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

rmc.setup
If LAN settings have been provided for a remote management controller, this will be set to on and the presence of its dedicated LAN interface and external power supply is periodically verified.

rsh.access
Restricts rsh access to the filer. For valid values, see na_protocolaccess(8).

rsh.enable
Enables the RSH server on the filer. Valid values for this option are on or off. The default value for this option is on.

security.passwd.rules.enable
This option controls whether a check for minimumlength and password composition is performed when new passwords are specified (see na_passwd(1) and/or na_useradmin(1) for additional information on the rules that are enforced by the check). A value of on means that the check will be made, and the password rejected if it doesn't pass the check. A value of off means that the check won't be made. The default value for this option is on. This option does not apply to the users "root" or "Administrator" (the NT Administrator account).

snapmirror.access
This option determines which snapmirror destinations filers may initiate transfers, and over which network interfaces. When set to "legacy", snapmirror uses the older snapmirror.allow to determine access. The option value is a string containing an expression which provides the access filter. An example of the options command for snapmirror.access is options snapmirror.access host=toaster,fridge. The default value is "legacy". See na_snapmirror(1) , na_snapmirror.allow(5) and na_protocolaccess(8) for more details.

snapmirror.checkip.enable
Enables IP address based verification of snapmirror destination filers by source filers. Valid values are on or off. The default value is off. See na_snapmirror.allow(5) for more details.

snapmirror.delayed_acks.enable
Enables TCP/IP delayed acknowledgements. Disabling this can improve performance of SnapMirror network connections in high latency networks. Valid values are on or off. The default value is on.

snapmirror.enable
Enable or disable SnapMirror operations. Valid values for this option are on or off. The default value for this option is off. When on (SnapMirror must be licensed), SnapMirror data transfers and SnapMirror scheduler are enabled. The command snapmirror on and snapmirror off has the same effect as this option. See na_snapmirror(1) for more details.

snapmirror.log.enable
Determines whether snapmirror activity is logged to the snapmirror log file. The setting does not affect syslog output from snapmirror. Valid values for this option are on or off. The default value for this option is on. When on, all the snapmirror activities will be logged in /etc/log/snapmirror. See na_snapmirror(5) for more details.

snapvault.access
Restricts/allows client and server access to snapvault from a different filer. The default value is "none" For valid values, see na_protocolaccess(8).

snapvault.enable
Enable or disable snapvault operation. Valid values for this option are on or off. The default value for this option is off.

snmp.access
Restricts SNMP access to the filer. For valid values, see na_protocolaccess(8).

snmp.enable
Enables the SNMP server on the filer. Valid values for this option are on or off. The default value for this option is on.

ssh.access
Restricts ssh access to the filer. For valid values, see na_protocolaccess(8).

ssh.enable
Enables or disables the SSH 2.0 protocol on the filer. Valid values for this option are on or off. The default value for this option is off.

ssh.passwd_auth.enable
Enables or disables the password authentication on the ssh server. Valid values for this option are on or off. The default value for this option is on.

ssh.pubkey_auth.enable
Enables or disables the public key authentication on the ssh server. Valid values for this option are on or off. The default value for this option is on.

ssh1.enable
Enables or disables the SSH 1.x protocol on the filer. Valid values for this option are on or off. The default value for this option is off.

ssh2.enable
Enables or disables the SSH 2.0 protocol on the filer. Valid values for this option are on or off. The default value for this option is off. This option is equivalent to the ssh.enable option.

tape.persistent_reservations
Enables the use of SCSI persistent reservations for fibre channel attached tape drives and medium changers. This option applies to all fibre channel attached tape drives and medium changers and cannot be enabled or disabled on an individual device basis. Persistent reservations provide a method for a device to only accept commands from one initiator. In an environment with multiple initiators using the same device, persistent reservations prevent the initiators from accessing the device at the same time.

Some tape drives and medium changers do not implement SCSI persistent reservations correctly. This option is disabled by default to prevent problems from occurring with these devices.

Enabling this option may cause problems if tape drives or medium changers do not work properly. If tape commands report the device is reserved when no other initiators are using the device, this option should be disabled.

Valid values for this option are on or off. The default value for this option is off.

telnet.access
Restricts telnet access to the filer. For valid values, see na_protocolaccess(8). If this value is set, trusted.hosts is ignored for telnet.

telnet.enable
Enables the Telnet server on the filer. Valid values for this option are on or off. The default value for this option is on.

telnet.hosts
Deprecated option, use trusted.hosts instead.

tftpd.enable
Enables the tftp (Trivial File Transfer Protocol) server on the filer. Valid values for this option are on or off. The default value for this option is off. When enabled, the filer's tftp server allows get requests, but does not allow put requests.

tftpd.logging
Enables console logging of accesses for files via tftp. Valid values for this option are on or off. The default value for this option is off.

tftpd.rootdir
Specifies the tftpd rootdir. All relative accesses to files via tftp are considered relative to this directory. All absolute accesses via tftp can only access a file if it lies in the filesystem tree rooted at this directory. A valid value for this option is the fully qualified pathname to a valid, existing directory on any volume on the filer. The default value of this option is /etc/tftpboot.

timed.enable
Determines whether a time daemon (timed) runs on the filer. If timed.enable is on, the filer synchronizes its time with a time server. Valid values for this option are on or off. The default value for this option is on.

Cluster considerations: regardless of the setting of this option, we always attempt to keep the time on the two nodes synchronized. One node plays the role of "time master" and the other node plays the role of "time slave." The determination of time master and time slave is automatic and can not be controlled by the administrator. The time slave always attempts to synchronize with the time master using the sntp protocol over the cluster interconnect. If that attempt fails, this option determines whether the time slave will then try to synchronize with a time source or sources specified by timed.proto and timed.servers.

timed.auto_adjust
When this option is on, the filer attempts to correct the internal time keeping to reduce the need to apply time corrections from other sources. When an optimal value is found, this option is turned off automatically. If not satisfied with the correction, it may be turned on again manually. It typically takes 40 or more corrections to find an optimal value.

timed.log
Specifies whether time changes initiated by timed should be logged to the console.

Cluster considerations: specifies whether time changes initiated by the time slave should be logged to the console.

timed.max_skew
Specifies the maximum amount of skew between the time reported by the time server and the filer's time that we will allow when synchronizing the time. If the difference in the time reported by the server and the filer's time is greater than this value, the filer will not synchronize to the time reported by the time server. The maximum skew is specified in seconds (suffix s), minutes (suffix m), or hours (suffix h). Defaults to "30m".

Cluster considerations: specifies the maximum amount of skew between the time reported by the time master and the time slave's time.

timed.min_skew
Specifies the minimum amount of skew between the time reported by the time server and the filer's time that you allow when synchronizing the time. If the difference in the time reported by the server and the filer's time is less than this value, the filer will not synchronize to the time reported by the time server. The minimum skew is specified in milliseconds. Defaults to "10" (10 milliseconds). This option only applies when timed.proto is set to "sntp" or "rtc".

Cluster considerations: specifies the minimum amount of skew between the time reported by the time master and the time slave's time.

timed.proto
Specifies the protocol used to synchronize time. Valid values for this option are rdate, sntp or rtc. rdate specifies the rdate (RFC 868) protocol. sntp specifies the Simple Network Time Protocol (RFC 2030). rtc specifies the Internal Real-Time Clock chip. The default value for this option is rtc.

Note that ntp is the displayed value for the sntp setting, and can also be used as a valid alias for sntp in this option.

Cluster considerations: the time slave always uses the sntp protocol when synchronizing to the time master.

timed.sched
Specifies the timed synchronization schedule. There are several pre-defined schedules:

hourly
synchronize every hour (the default)

multihourly
synchronize every 6 hours

daily
synchronize every day at midnight.

Custom schedules may also be specified by giving the number of minutes or hours between time synchronization. Minutes are specified by digits followed by an "m"; hours are specified by digits followed by an "h". For example, options timed.sched 2h will cause time to be synchronized every two hours.

To avoid overburdening the time server, the filer randomly selects the exact time of the synchronization within a window specified by timed.window.

After timed.sched is set, timed.window is capped at ten percent of timed.sched.

Cluster considerations: specifies the time synchronization schedule for the time slave.

timed.servers
Specifies up to five time servers used by the time daemon. Time servers are contacted in the order specified; if a server can't be contacted, the time daemon tries the next one in the list. The default value for this option is the null string.

Cluster considerations: the time slave always attempts to synchronize with the time master. If that attempt fails and timed.proto is rdate or sntp, this option specifies the time servers used by the time slave.

timed.window
Specifies a window around the synchronization time set by timed.sched. The actual synchronization time is randomly chosen from within this window. timed.window is specified in seconds (suffix s) or minutes (suffix m). The value may be 0, but it may not exceed ten percent of timed.sched. timed.window defaults to "0s".

Cluster considerations: specifies a window around the synchronization time set by timed.sched for the time slave.

trusted.hosts
Specifies up to 5 clients that will be allowed telnet, rsh, and administrative HTTP (i.e. FilerView) access to the server. The host names should be entered as a comma-separated list with no spaces in between. Enter a "*" to allow access to all clients; this is the default. Enter a "-" to disable access to the server. NOTE: this option used to be called telnet.hosts, and in fact that is still an alias for this option. This value is ignored for telnet if telnet.access is set, and is ignored for administrative HTTP if httpd.admin.access is set. See na_protocolaccess(8) for more details.

vol.copy.throttle
Specifies the default speed of all volume copy operations. The speed can be a number in the range from 1 to 10, 10 being the highest speed and the default. When a vol copy operation is started, its throttle is set to this value. See na_vol(1) for more details on the vol copy command.

wafl.default_nt_user
Specifies the NT user account to use when a UNIX user accesses a file with NT security (has an ACL), and that UNIX user would not otherwise be mapped. If this option is set to the null string, such accesses will be denied. The default value for this option is the null string.

wafl.default_security_style
Specifies the default security style assigned to a new volume. All qtrees created on the volume get this as their security style. Legal values for this option are `unix', `ntfs', or `mixed'. The default value for this option is `unix', unless the filer is an NTFSonly filer, in which case the default is `ntfs'.

wafl.default_unix_user
Specifies the UNIX user account to use when an authenticated NT user did not match an entry in the usermap.cfg file. If this option is set to the null string, NT users which are not matched in the usermap.cfg file will not be allowed to log in. The default value for this option is `pcuser'.

wafl.nt_admin_priv_map_to_root
When on (the default), an NT administrator is mapped to UNIX root.

wafl.root_only_chown
When enabled, only the root user can change the owner of a file. When disabled, non-root users can change the owner of files that they own. When a non-root user changes the owner of a file they own, both the set-UID and set-GID bits of that file are cleared for security reasons. A non-root user is not allowed to give away a file if it would make the recipient overrun its user quota. wafl.root_only_chown is enabled by default.

wafl.wcc_minutes_valid
Specifies the number of minutes a WAFL credential cache entry is valid. The value can range from 1 through 20160. The default is 20.

webdav.enable
Enables WebDAV access to the filer. Valid values for this option are on or off. The default value for this option is off.

Multiple options can be set at once in an options command. For example:

   options nfs.tcp.enable on nfs.v2.df_2gb_lim on raid.timeout 48

CLUSTER CONSIDERATIONS

However, a few options must have the same setting for both filers in a cluster for takeover to work properly. If you change the setting for one of these options on one filer, the filer displays a message reminding you to make the same change on the other filer. In takeover mode, the same option values are used for both filers.

The following list of options must have the same value on both filers in a cluster:

  snmp.enable
  telnet.enable
  trusted.hosts

  timed.enable
  timed.log
  timed.max_skew
  timed.min_skew
  timed.proto
  timed.sched
  timed.servers
  timed.window

The following list of options are overwritten by the live filer's values during takeover:

  auditlog.enable
  auditlog.max_file_size
  autologout.telnet.enable
  autologout.telnet.timeout
  dns.domainname
  dns.enable
  httpd.log.format
  httpd.timeout
  httpd.timewait.enable
  ip.match_any_ifaddr
  ip.path_mtu_discovery.enable
  nfs.per_client_stats.enable
  nfs.v2.df_2gb_lim
  nfs.v3.enable
  nis.domainname
  nis.enable
  nis.group_update.enable
  nis.group_update_schedule
  nis.servers
  pcnfsd.enable
  raid.reconstruct_speed
  raid.reconstruct.wafliron
  raid.timeout
  rmc.setup
  vol.copy.throttle
  wafl.root_only_chown
  wafl.wcc_minutes_valid

VFILER CONSIDERATIONS

  cifs.audit.enable
  cifs.audit.file_access_events.enable
  cifs.audit.logon_events.enable
  cifs.audit.logsize
  cifs.audit.saveas
  cifs.bypass_traverse_checking
  cifs.comment
  cifs.guest_account
  cifs.home_dir [deprecated]
  cifs.home_dir_namestyle
  cifs.homedirs_public_for_admin
  cifs.idle_timeout
  cifs.max_mpx
  cifs.netbios_aliases
  cifs.netbios_over_tcp.enable
  cifs.nfs_root_ignore_acl
  cifs.oplocks.enable
  cifs.oplocks.opendelta
  cifs.perm_check_ro_del_ok
  cifs.perm_check_use_gid
  cifs.restrict_anonymous.enable
  cifs.save_case
  cifs.scopeid
  cifs.search_domains
  cifs.show_snapshot
  cifs.shutdown_msg_level
  cifs.sidcache.enable
  cifs.sidcache.lifetime
  cifs.snapshot_file_folding.enable
  cifs.symlinks.cycleguard
  cifs.symlinks.enable
  cifs.trace_login
  dns.domainname
  dns.enable
  nfs.mount_rootonly
  nfs.per_client_stats.enable
  nfs.require_valid_mapped_uid
  nfs.tcp.enable
  nfs.udp.xfersize
  nfs.v2.df_2gb_lim
  nfs.v3.enable
  nfs.webnfs.enable
  nfs.webnfs.rootdir
  nfs.webnfs.rootdir.set
  nis.domainname
  nis.enable
  nis.group_update.enable
  nis.group_update_schedule
  nis.servers
  pcnfsd.enable
  pcnfsd.umask
  rsh.access
  rsh.enable
  security.passwd.rules.enable
  wafl.default_nt_user
  wafl.default_unix_user
  wafl.nt_admin_priv_map_to_root
  wafl.wcc_max_entries
  wafl.wcc_minutes_valid

SEE ALSO

BUGS

Table of Contents

• NAME
• SYNOPSIS
• DESCRIPTION
• CLUSTER CONSIDERATIONS
• VFILER CONSIDERATIONS
• SEE ALSO
• BUGS