options

options option

options partial-option

options [ option value ] ...

The legal options are as follows:

auditlog.enable
Enables/disables the audit logging of commands executed at the console/telnet shell or by using rsh. The default is on. The data is logged to the file /etc/log/auditlog for a filer or /logs/auditlog if the system is a NetCache. The maximum size of auditlog file is allowed to grow to the value specified by the auditlog.max_file_size option. If the auditlog file reaches this size, and on every Saturday at 24:00, /etc/log/auditlog is moved to /etc/log/auditlog.0, /etc/log/auditlog.0 is moved to /etc/log/auditlog.1, and so on (similarly for /logs/auditlog if it is a NetCache). Assuming they do not get full, auditlog files are saved for a total of six weeks.

auditlog.max_file_size
This option controls the maximum size (in bytes) that the auditlog file is allowed to grow to (see above). The default value for this option is 10000000.

autologout.console.enable
Enables/disables the autologout of console connections. The default is on, which causes console connections to be disconnected after the console has been idle for the number of minutes specified by the autologout.console.timeout value. Any change to this
option is effective after a command is entered.

autologout.console.timeout
The number of minutes the console is idle after which console connections are disconnected if autologout.console.enable is on. The default is 60 minutes. Any change to this option is effective after a command is entered.

autologout.telnet.enable
Enables/disables the autologout of telnet connections. The default is on, which causes telnet connections to be disconnected after the number of minutes specified by the autologout.telnet.timeout value. Any change to this option requires a logout before it takes effect.

autologout.telnet.timeout
The number of minutes after which telnet connections are disconnected if autologout.telnet.enable is on. The default is 60 minutes. Any change to this option requires a logout before it takes effect.

autosupport.cifs.verbose
If on, includes CIFS session and share information in autosupport messages. If off, those sections are omitted. The default is off.

autosupport.content
The type of content that the autosupport notification should contain. Allowable values are complete and minimal. The default value is complete. The minimal option allows the delivery of a "sanitized" and smaller version of the autosupport, at the cost of reduced support from Network Appliance. Please contact Network Appliance if you feel you need to use the minimal option. The complete option is the traditional (and default) form of autosupport. If this option is changed from complete to minimal then all previous and pending autosupport messages will be deleted under the assumption that complete messages should not be transmitted.

autosupport.dafs.verbose
If on, includes more detailed DAFS information in autosupport messages. If off, this detail is omitted. The default is off.

autosupport.doit
Triggers the autosupport daemon to send an autosupport notification immediately. A text word entered as the option is sent in the notification subject line and should be used to explain the reason for the notification.

autosupport.enable
Enables/disables the autosupport notification features (see na_autosupport(8)). The default is on to cause autosupport notifications to be sent. This option will override the autosupport.support.enable option.

autosupport.from
Defines the user to be designated as the sender of the notification. The default is postmaster@your.domain. Email replies from Network Appliance will be sent to this address.

autosupport.local.nht_data.enable
Enables/disables the Health Trigger (NHT) data autosupport to be sent to the recipients listed in autosupport.to. NHT data is the binary, internal log data from each disk drive, and in general, is not parsable by other than Network Appliance. There is no customer data in the NHT attachments. The default for this option is off.

autosupport.local.performance_data.enable
Enables/disables performance data autosupport to be sent to the recipients listed in autosupport.to. The performance autosupport contains hourly samples of system performance counters, and in general is only useful to Network Appliance. There is no customer data in the performance data autosupports. The default is off.

autosupport.mailhost
Defines the list of up to 5 mailhost names. Enter the host names as a comma-separated list with no spaces in between. The default is an empty list.

autosupport.minimal.subject.id
Defines the type of string that is used in the identification portion of the subject line when autosupport.content is set to minimal. Allowable values are systemid and hostname. The default is systemid.

autosupport.nht_data.enable
Enables/disables the generation of the Health Trigger (NHT) data autosupport. Default is off

autosupport.noteto
Defines the list of recipients for the autosupport short note email. Up to 5 mail addresses are allowed. Enter the addresses as a comma-separated list with no spaces in between. The default is an empty list to disable short note emails.

autosupport.performance_data.enable
Enables/disables hourly sampling of system performance data, and weekly creation of a performance data autosupport. The default is on.

autosupport.retry.count
Number of times to try resending the mail before giving up and dropping the mail. Minimum is 5; maximum is 4294967295 ; The default is 15 .

autosupport.retry.interval
Time in minutes to delay before trying to send the autosupport again. Minimum is 30 seconds, maximum is 1 day. Values may end with `s', `m' or `h' to indicate seconds, minutes or hours respectively If no units are specified, then input is assumed to be in seconds. The default value is 4m.

autosupport.support.enable
Enables/disables the autosupport notification to Network Appliance. The default is on to cause autosupport notifications to be sent directly to Network Appliance as described by the autosupport.support.transport option. This option is superseded (overridden) by the value of autosupport.enable.

autosupport.support.proxy
Allows the setting of an HTTP-based proxy if autosupport.support.transport is https or http. The default
for this option is the empty string, implying no proxy is necessary.

autosupport.support.to
This option is read only, it shows where autosupport notifications to Network Appliance are sent if autosupport.support.transport is smtp.

autosupport.support.transport
Allows setting the type of delivery desired for autosupport notifications that are destined for Network Appliance. Allowed values are https, http (for direct Web-based posting) or smtp (for traditional email). The default value is https. Note that http and https may (depending on local network configuration) require that the autosupport.support.proxy option be set correctly. Also smtp requires that autosupport.mailhosts be configured correctly before autosupport delivery can be successful.

autosupport.support.url
This option is read only, it shows where autosupport notifications to Network Appliance are sent if autosupport.support.transport is https or http.

autosupport.throttle
Enables autosupport throttling (see na_autosupport(8)). When too many autosupports are sent in too short a time, additional messages of the same type will be dropped. Valid values for this option are on or off. The default value for this option is on.

autosupport.to
Defines the list of recipients for the autosupport email notification. Up to 5 mail addresses are allowed. Enter the addresses as a comma-separated list with no spaces in between. The default is an empty list. Note that it is no longer necessary to use the standard Network Appliance autosupport email address in this field to direct autosupport messages to Network Appliance. Please use autosupport.support.enable instead.

backup.log.enable
Backup logging captures important events during dump/restore and records them in /etc/log/backup on the root volume. The option allows users to enable or disable this feature. By default, the option is on.

cf.giveback.auto.cifs.terminate.minutes
This options specifies the number of minutes to delay an automatic giveback before terminating CIFS clients that have open files. During the delay, the system will periodically send notices to the affected workstations. If 0 (zero) minutes are specified, then CIFS clients will be terminated immediately.

cf.giveback.auto.enable
This options turns on/off automatic giveback. An automatic giveback is invoked when one node of a cluster is in takeover mode and the "down" node is repaired and reboots. The repaired node will boot into Data ONTAP and the node in takeover mode will detect this and initiate a giveback.

This feature is only available on flash booted systems.

cf.giveback.auto.terminate.bigjobs
This option, when on, specifies that automatic giveback should immediately terminate long running operations (dump/restore, vol verify, etc.) when initiating an automatic giveback. When this option is off, the automatic giveback will be deferred until the long running operations have completed.

cf.giveback.check.partner
This option turns on/off checking for partner readiness before starting giveback. It's being used on flash booted systems only.

When this option is on, if operator types in "cf giveback", before starting giveback, the node in takeover state checks that partner has actually booted halfway up. If partner is not ready yet, giveback won't start.

When this option is off, if operator types in "cf giveback", giveback starts without checking partner's status.

The default value is on, which reduces downtime caused by a giveback.

Two filers in a cluster can have different settings for this option.

cf.takeover.change_fsid
This option only applies to filers with a cluster_remote license.

It determines whether a cluster failover using the forcetakeover -d command will change the file system identifiers (fsid) of the partner volumes that have been failed over. By default this option is set to on and fsids of all partner volumes are changed. Clients must be re-mounted as a result. If this option is turned off, fsids will not be altered and a forcetakeover -d will be transparent for all volumes except for those with nvfail option turned on. In either case, any mapped luns contained within partner volumes will be made offline after a forcetakeover -d.

It is recommended that this option be set to it's default value of on. Two nodes do not need to have same value for this option.

cf.takeover.detection.seconds
This option provides a knob to tune the timer used in takeover detection.

The timer is used by cluster software in monitoring partner node's status. If partner node has not been responding more than n seconds, where n is the value of this option, local node decides to take over.

Two nodes do not need to have same value for this option. This provides asymmetric takeover behavior in terms of aggressiveness.

The default value of this option is 15 seconds. The option can be set to any value between 10 and 180. In case sk.process.timeout.override has been manually set, it is strongly advised that this option is set to a value larger than or equal to sk.process.timeout.override+5.

cf.takeover.on_failure
This option allows automatic takeover to be disabled. By default, this option is set to on and a filer will automatically takeover it's partner filer if the latter fails. If set to off, automatic takeovers are disabled, but operator can still initiate manual takeovers.

This option is available only when cluster is licensed and changing the value on one filer automatically changes the value on the partner filer.

cf.takeover.on_disk_shelf_miscompare
This option allows negotiated takeover to be enabled when the cluster nodes detect a mismatch in disk shelf count. By default, this option is set to off.

This option is available only when cluster is licensed and changing the value on one filer automatically changes the value on the partner filer.

cf.takeover.on_network_interface_failure
This option allows negotiated takeover to be enabled when the cluster nodes detect failures in network interfaces. Only those network interfaces that have explicitly enabled negotiated failover via the ifconfig command will be monitored. By default, this option is set to off.

This option is available only when cluster is licensed and changing the value on one filer automatically changes the value on the partner filer.

cf.takeover.on_network_interface_failure.policy This option determines what policy to apply for triggering negotiated failover when network interfaces fail. There are two policies that are currently supported: all_nics implying failover when all network interfaces participating in negotiated failover fail and any_nic implying failover when any one of the network interfaces participating in negotiated failover fails. By default, this option is set to all_nics.

This option is available only when cluster is licensed.

cf.takeover.on_panic
This option turns on/off the takeover on panic feature. It's available only when cluster is licensed. Changing the value on one filer automatically changes the value on the partner filer.

This option is turned on when either fcp or iscsi is licensed.

This option is turned off when both fcp and iscsi have been unlicensed.

Users should use caution when manually changing the option value.

cf.takeover.on_short_uptime
This option determines whether a cluster failover will happen if a filer fails within sixty seconds of booting up. By default, this option is set to on.

This option is available only when cluster is licensed and changing the value on one filer automatically changes the value on the partner filer.

cifs.audit.autosave.file.extension
Specifies the type of file extension that will be appended to the "saveas" file name when the autosave feature is enabled. It will append a timestamp or counter value to the saved EVT file. The valid values for this option are timestamp and counter.

cifs.audit.autosave.file.limit
Specifies how many Microsoft Event Log (EVT) files are to be saved before they are rotated. Once the limit of files exist on the filer, the oldest file is always overwritten. If the value of this option is 0, then the filer will have no limit to how many file are automatically saved on the filer. This option needs to have the autosave feature enabled. The minimum is 0 and the maximum is 999.

cifs.audit.autosave.onsize.enable
When this option is on, the CIFS Audit Logging Facility (ALF) daemon will automatically save the cifsaudit.alf file to the corresponding EVT file based on the size of the cifsaudit.alf file. The option cifs.audit.autosave.onsize.threshold is needed to be set in order to specify the actual threshold to trigger the auto save.

cifs.audit.autosave.onsize.threshold
This option specifies the size threshold which should trigger an auto save. The option cifs.audit.autosave.onsize.enable should be enabled for this option to be used. The threshold value can be specified by using the k (kilobytes), m (megabytes), g (gigabytes), or the % (percentage) suffix. The minimum for all suffixes is 1, whereas the maximum for k is 67108864, for m is 65535, for g is 64 and for % is 100. Note that if the suffix is percentage this should be perceived as a percentage of the size of the cifsaudit.alf file which can be specified by the Fbcifs.audit.logsize option

cifs.audit.autosave.ontime.enable
When this option is on, the CIFS Audit Logging Facility (ALF) daemon will automatically save the cifsaudit.alf file to the corresponding EVT file based on an internal timer. The option cifs.audit.autosave.ontime.interval is needed to be set to specify the timer interval to trigger the auto save.

cifs.audit.autosave.ontime.interval
This option specifies the time interval which should trigger an auto save. The option cifs.audit.autosave.ontime.enable should be enabled for this option to be used. The interval value can be specified by using the s (seconds), m (minutes), h (hours), or the d (days) suffix. The minimum for all suffixes is 1, whereas the maximum for s is 60, for m is 60, for h is 24 and for d is 7.

cifs.audit.enable
When this option is on, CIFS audit events may be generated for file access or for logon and logoff. For file access events to be generated, the option cifs.audit.file_access_events.enable must also be on. For logon and logoff events to be generated, the option cifs.audit.logon_events.enable must also be on. This option default is off.

cifs.audit.file_access_events.enable
When both this option and the cifs.audit.enable option are on, file access events will be audited when a file is accessed by an account for an operation and the file has a System Access Control List (SACL) entry that matches the access. If no SACL entry matches the access, then no event will be generated. The default is on.

cifs.audit.logon_events.enable
When both this option and the cifs.audit.enable option are on, logon and logoff events will be generated. Logon and logoff events reflect CIFS session connects and disconnects, respectively. The default is on.

cifs.audit.logsize
Specifies the maximum event log file size in bytes. The default is 524288. The minimum is 524288 and maximum is 68719476736.

cifs.audit.nfs.enable
Enables CIFS auditing of files in Unix security style qtrees. When enabled, auditable events performed on these files are recorded in the log file. Auditable events are specified by the Windows SACLs either on the file itself, or on the file specified in the value of cifs.audit.nfs.filter.filename.

cifs.audit.nfs.filter.filename
Points to the filter file used to identify which file events get included in the CIFS log by default. When an operation is performed on Unix security style qtree files that have no SACL set, the SACL set on the file identified by this option is used to determine which events get logged.

cifs.audit.saveas
Specifies the active event log file. The file must be in an existing directory in a network share. The default log file is /etc/log/adtlog.evt.

cifs.bypass_traverse_checking
When on (the default), directories in the path to a file are not required to have the `X' (traverse) permission. This option does not apply in UNIX qtrees.

cifs.client.dup-detection
Windows servers attempt to detect duplicate sessions in order to terminate any sessions that did not terminate when a client system rebooted. Early versions of Windows servers compare client NetBIOS names to determine duplication, while newer ones use the client IP addresses.

This option determines how the appliance performs duplicate session detection. With this option set to ip-address the appliance compares client IP addresses. With this option set to name (the default) the appliance compares client NetBIOS names. With this option set to off the appliance does not perform duplicate session detection.

cifs.comment
Defines the CIFS server description. CIFS clients see the CIFS server description when browsing servers on the network. The default value for this option is a null string.

cifs.guest_account
Enables a user to get access to the filer provided that either the filer uses a Domain Controller for authentication and the user is not in a trusted domain, or the filer uses the /etc/passwd file or the NIS password database for authentication and the user has no entry in the /etc/passwd or the NIS password database. If this option is set to the name of an account in the password database, a user logging into the filer will be assigned to the guest account if their name is not listed in the password database (when using /etc/passwd or NIS) or if the user is not from a trusted domain (when using a domain controller). The configured user name will be used for the UNIX user ID, group ID, and group set of the specified account. If the option is a null string, guest access is disabled. The default value for this option is a null string.

cifs.home_dir_namestyle
Specifies how the name portion of the path to a user's home directory is determined. If no argument is supplied, the current value of this option is displayed. Valid values for this option are: a null string, ntname, hidden, mapped, or domain. All user home directory paths begin with one of the CIFS home directory paths, followed by a slash and the user's name. If this option is set to ntname then a user's Windows login name is used and only downward symlinks (in the directory hierarchy) are followed. If this option is set to hidden then a user's Windows login name is used. However, the user must append a dollar sign to their user name when connecting to the filer, and the filer will append a dollar sign to the user's name when enumerating the homedir share name. If the value of this option is mapped then the user's UNIX name is used. The UNIX name is obtained by mapping the user's Windows login name using the file /etc/usermap.cfg. If this option is set to domain then the user's name includes both the user's domain and Windows login name separated by a slash. The default value for this option is the null string, which acts like ntname with the exception that symlinks are followed in any direction. To set this option to the default value (a null string), use a pair of double quotes ("") as the argument.

cifs.homedirs_public_for_admin
Specifies whether members of the filer's Builtin\Administrators group can connect to the CIFS home directories of other users. If no argument is supplied, the current value of this option is displayed. If this option is set to on then an administrator can connect to the CIFS home directory of user username by specifying the share ~username (tilde username). This can be useful when setting a user profile to map the user's CIFS home directory on the filer. Windows 2000 Active Directory does not allow a system administrator to set a user's profile to a nonexistent share, and normally a user's CIFS home directory can only be accessed by that user and not by the administrator. The default is on.

cifs.idle_timeout
Specifies the amount of idle time in seconds before the filer disconnects a session. An idle session is a session in which a user does not have any files opened on the filer. The value of this option ranges from 600 to 4,000,000 (effectively infinite). The default is 1800.

cifs.max_mpx
This option controls how many simultaneous operations the filer reports that it can process. An "operation" is each I/O the client believes is pending on the filer including outstanding change notify operations. This value defaults to 50, but clients such as Windows Terminal Server or IIS may require that this number to be increased to avoid errors and performance delays.

CAUTION - The approved values for this parameter are 126, 253, and 1124. The most accurate way to determine which number to use is to measure the RedirectorCurrent Commands statistic on the client with NT perfmon and to increase the number until Current Commands does not hit the negotiated limit. For more information see Microsoft Knowledge Base articles Q191370 and Q232890.

CAUTION - This number should only be changed while cifs is terminated.

CAUTION - Only use the approved values to avoid Q232890.

CAUTION - This value affects allocations in the clients. Use the smallest value necessary for correct behavior.

cifs.ms_snapshot_mode
Specifies the mode for snapshot access from a Microsoft Shadow Copy client. Valid values for this option are off, pre-xp and xp. off disables snapshot access from all Windows Shadow Copy clients. xp allows access to snapshots from Windows XP and later Shadow Copy clients only. pre-xp in addition allows access to snapshots from Windows 2000 Shadow Copy clients. Note that the downlevel pre-xp mode should only be used if Windows 2000 snapshot access is required as it may introduce a very slight performance hit when there is a heavy load on the filer and very long pathnames are in use.

cifs.netbios_aliases
Provides a comma-separated list of alternative names for the filer. A user can connect to the filer using any of the listed names.

This command is deprecated.

System administrators are encouraged to write CIFS NetBIOS aliases to the file /etc/cifs_nbalias.cfg (one alias per line). Use the "cifs nbalias load" command to cause the filer to process the cifs_nbalias.cfg file. For more information, see the CIFS chapter in the System Administrator's Guide.

cifs.netbios_over_tcp.enable
This option enables the use of NetBIOS over TCP, which is the standard protocol used for CIFS prior to Windows 2000. It defaults to "true". In certain Windows 2000 networks it is desirable to disable that protocol. This option corresponds to the "Enable NetBIOS over TCP" setting in the Windows 2000 Advanced TCP/IP settings tab. If it is set "false" all clients must be Windows 2000, and only Windows 2000 domain controllers and virus scanners can be used.

cifs.netbios_over_tcp.enable takes effect when cifs starts. It should not be changed while cifs is running.

cifs.nfs_root_ignore_acl
When on, ACLs will not affect root access from NFS. The option defaults to "off".

cifs.oplocks.enable
When cifs.oplocks.enable is on (the default), the filer allows clients to use oplocks (opportunistic locks) on files. Oplocks are a significant performance enhancement, but have the potential to cause lost cached data on some networks with impaired reliability or latency, particularly wide-area networks. In general, this option should be disabled only to isolate problems.

cifs.oplocks.opendelta
This option defines the length of artificial delay before sending an opportunistic lock break request to a client that has recently sent the filer an open request. This is done to work around a bug in Microsoft Windows clients that can cause the client to ignore an oplock break request if it is received at a certain time.

The units of this option are in milliseconds. The default is 8 milliseconds. Changes to the option take effect immediately; it is not necessary to restart anything.

For example, when opendelta is 8, the filer will make sure that at least 8 milliseconds have elapsed after receiving or responding to an open-file request before it sends an oplock break on that session.

CAUTION - This option should not be set higher then 35 milliseconds without consulting Network Appliance Global Services.

cifs.per_client_stats.enable
Turning this option "on" causes the filer to start gathering statistics on a per-client basis. This allows use of the cifs top command, as well as the -u and -h options of cifs stat. Administrators should be aware that there is overhead associated with collecting the per-client stats. This overhead may noticeably affect filer performance. If the option is turned off, any existing per-client statistics are discarded. The value may be changed at any time without restarting CIFS. The default value of this option is "off".

cifs.perm_check_ro_del_ok
NT delete rules do not allow you to delete a file or directory with the DOS read-only bit set. However, a number of multi-protocol applications require UNIX delete semantics (w-x perms in parent dir without regard to the permissions of the file or directory). This option controls this behavior. By default it is "off", which yields NT behavior.

cifs.perm_check_use_gid
This option affects security checking for Windows clients of files with UNIX security where the requester is not the file owner. In all cases Windows client requests are checked against the share-level ACL, then if the requester is the owner, the "user" perms are used to determine the access.

If the requester is not the owner and if perm_check_use_gid is on it means files with UNIX security are checked using normal UNIX rules, i.e. if the requester is a member of the file's owning group the "group" perms are used, otherwise the "other" perms are used.

If the requester is not the owner and if perm_check_use_gid is off, files with UNIX security style are checked in a way which works better when controlling access via share-level ACLs. In that case the requester's desired access is checked against the file's "group" permissions, and the "other" permissions are ignored. In effect, the "group" perms are used as if the Windows client were always a member of the file's owning group, and the "other" perms are never used.

The default setting is on for new installations. For existing installations, this has the opposite effect of the old "PC-mode" installation setting.

If you do not plan to use share-level ACLs to control access to UNIX security style files (e.g. in a UNIX qtree), you might wish to change this setting to on.

cifs.restrict_anonymous
Controls the access restrictions of non-authenticated sessions. Permitted values for this option are 0, 1 and 2. 0 sets no special access restrictions, 1 disallows enumeration of users and shares, and 2 fully restricts access. This option corresponds to the RestrictAnonymous registry entry in Windows. Note that these restrictions do not apply to mapped Null users.

cifs.restrict_anonymous.enable
Deprecated option, use cifs.restrict_anonymous instead.

cifs.save_case
When this option is on, CIFS will preserve the case when files are created or renamed. If this option is turned off, all filenames will be forced to lower case. This can help with compatibility between certain 16-bit applications and UNIX tools. The default is on.

cifs.scopeid
NetBIOS scope IDs allow the system administrator to create small workgroups out of a network by partitioning the NetBIOS name space; only clients with the same NetBIOS scope ID as the filer will be able to use the filer as a CIFS server. The default scope ID is a null string, but if the filer is to run in a NetBIOS scope other than the default one, its scope ID must be set to the scope ID of that scope. The scope ID can be changed only when CIFS is not running.

cifs.search_domains
Specifies a list of domains that trust each other to search for a mapped account. The argument for the option is a comma-separated list that is searched in order. The default value for this option is the null string. If this option is set to a null string, all domains are searched. You use this option to control searches if you used an asterisk for a domain name in the usermap.cfg file.

cifs.show_snapshot
By default this option is FALSE. The snapshot directory ~snapshot is no longer shown at the root of a share. This is a change in behavior from previous versions. Setting this to TRUE will restore the old behavior. On Windows NT 4 or Windows 95 clients, the user can access snapshots by entering \\filer\share\.snapshot (or ~snapshot or ~snapsht) in the Start->Run menu. Snapshots can also be accessed lower in the share by providing a path to a lower directory. Snapshots can be accessed through DOS on any system by changing to the ~snapsht directory.

NOTE: When this option is TRUE it can confuse programs like FastFind that don't know about snapshots.

cifs.shutdown_msg_level
Normally a message is broadcast to all clients when CIFS is terminating. This option can be set to control this behavior. The value "0" results in never sending such broadcast messages. The value "1" results in sending broadcast messages only to sessions which have open files. The value "2" causes the messages to be sent to all open connections, which is the default behavior.

cifs.sidcache.enable
By default this option is TRUE. This options controls whether or not CIFS will cache SID-to-name translation information that it has received from the domain controllers.

cifs.sidcache.lifetime
By default this option is 1440, which is 24 hours specified in minutes. The option controls how long a SID-to-name cache entry is used before it becomes stale. The SID-to-name mapping functions in the filer will query the appropriate domain controller to update the cached mapping when it is needed, but has become stale. This option is specified in minutes.

cifs.signing.enable
Signing is a security feature provided by the CIFS protocol that is designed to detect and prevent `manin-the-middle' intrusion into CIFS communications. This is achieved by calculating a security signature value for every incoming and outgoing CIFS packet.

This feature introduces a performance penalty on both the client and the filer when in use, and thus is disabled by default. In a trusted network where the performance impact of this feature might outweigh the benefits that it provides, it is recommended that this feature remain disabled.

cifs.snapshot_file_folding.enable
By default this option is FALSE. This option controls whether or not CIFS will attempt to `fold' files on close with previous snapshot versions of themselves in order to minimize disk usage. Disk space is saved by sharing unchanged file blocks between the active version of the file, and the version of the file in the latest snapshot, if any. The filer must compare block contents when folding a file, so there is a performance vs. space utilization tradeoff to consider with this option.

cifs.symlinks.cycleguard
The cifs.symlinks.cycleguard option (on by default), eliminates the possibility of traversing directories cyclically during the process of following symbolic links. With this option set to on, if the target of the symlink resolves to a directory that is directly above the symlink's parent directory, it is disallowed.

With this option set to off, many standard Windows apps (such as Find in Win95 / NT4.0) will not operate correctly when a symlink points to a parent directory. This is because they do not understand symbolic links and will repeatedly loop on them. Users should use caution when changing this option.

cifs.symlinks.enable
When cifs.symlinks.enable is on (the default), if the object being accessed by a CIFS client is a symbolic link (whether absolute or relative), the filer follows the link with the proviso that the ultimate target turns out to reside within the originating share (thus ensuring that the client has access permission to the target).

cifs.trace_dc_connection
When cifs.trace_dc_connection is on (the default is off), the filer logs all domain controller address discovery and connection activities. This can be used to diagnose DC connection problems on the filer.

cifs.trace_login
When cifs.trace_login is on (the default is off), the filer logs all login-related activities. This can be used to diagnose access problems on the filer.

cifs.universal_nested_groups.enable
When cifs.universal_nested_groups.enable is off, the filer does not include membership in nested groups or membership in universal groups from other domains in the forest. The default is on. This option is pertinent to all NFS clients accessing a file or directory with Windows-style security and does not affect CIFS clients. Changes to the option take effect immediately, affecting all new NFS connections thereafter; it is not necessary to restart the CIFS service. This option will be deprecated in a future release when the filer will always include the above memberships.

CAUTION - ALL group memberships are fetched from Active Directory only when (a) user and filer are in the same domain tree (b) or else user's domain tree has a two-way transitive trust with the filer's domain tree.

cifs.weekly_W2K_password_change
This option only affects filers installed in Windows 2000 domains. When "on", this option causes the filer to change its domain password once a week, as is current practice for the filer in NT4 domains. The password change occurs at approximately 1:00 am on Sunday mornings. For Windows 2000 domains with multiple DCs, a password change may inhibit CIFS connections for a short time while the new password is propagated among the DCs. The default for this option is "off". This option has no effect on filers installed in pre-Windows 2000 domains.

cifs.widelink.ttl
When a CIFS client accesses a "wide symbolic link" (widelink), the filer returns both a path referral and a time-to-live value. The CIFS client can cache the widelink path referral for the time-to-live time period. This option allows the system administrator to set the value which the filer returns for time-tolive.

cifs.wins_servers

cifs.wins_servers
This option can display or set the list of WINS servers used by the CIFS service. To set the list, pass a comma-separated list of IPv4 addresses. To see the current list of WINS servers, leave the parameter blank. To clear the list, pass a "" (null) parameter.

cksum_offload.gbeII
Specifies whether calculation of TCP and UDP checksums is offloaded to network interface cards. Offloading reduces CPU utilization. The value "on" enables offloading, and "off" disables it. The option affects Ethernet Controllers numbered II and higher. Checksums are not offloaded for outbound UDP packets in most cases, regardless of the option setting.

On systems initially installed with 6.2 or later releases, the default is "on". Prior to 6.2 the default was "off", and a software upgrade does not change the value.

console.encoding
Specifies how non-ASCII character information is presented. The value can be:

nfs - NFS character set. You can use both NFS extended (> 0x7F) and SGML characters for input.

sgml - SGML character format. You can use both NFS extended (greater than 0x7F) and SGML characters for input.

utf8 - UTF-8 character sets. For input, any character greater than 0x7F is the beginning of a UTF-8 encoding.

The default is nfs.

coredump.dump.attempts
Controls how many attempts should be made to dump a core. Extra attempts are only made if the previous attempt failed due to a disk write error. Legal values range from 0 - 5. If 0 is chosen, no cores will be dumped.

The default is 2.

coredump.metadata_only
Specifies whether complete or partial cores will be dumped. Partial cores are missing the wafl buffers that contain user data. The values can be:

on - Do not dump buffers containing user data.

off - Dump all memory.

The default is on.

dafs.enable
Determines whether the DAFS server starts by default on a filer.

dafs.max_requests_server
Sets the maximum number of requests that the DAFS server can attempt to concurrently execute. Requests submitted which would exceed this limit will be pended (see dafs.max_pending_requests_server) until existing requests complete.

dafs.max_disconnected_sessions
Sets the maximum number of abnormally disconnected client sessions that the DAFS server will save until recovery can be made. If the number of abnormally disconnected client sessions would exceed this limit then the oldest disconnected session will be removed.

dafs.max_pending_requests_server
Sets the maximum number of pending (awaiting initial issue) DAFS requests. This option is only used when the number of DAFS concurrent requests has exceeded dafs.max_requests_server, causing new DAFS requests to be pended. If a new request would exceed dafs.max_pending_requests_server then the request is rejected.

dafs.max_requests
Sets the maximum number of concurrent DAFS requests that a single session may request during session negotiation.

dafs.max_request_size
Sets the maximum size of a request buffer that a single session may request during session negotiation. This should not normally be changed from the default, but can be set to allow (or disallow) clients with exceptionally large DAFS requests to execute. The value is expressed in bytes, and limits the total request size including DAFS operation and generic response headers.

dafs.max_response_size
Sets the maximum size of a response buffer that a single session may request during session negotiation. This should not normally be changed from the default, but can be set to allow (or disallow) clients with exceptionally large DAFS responses to execute. The value is expressed in bytes, and limits the total response size including DAFS operation and generic response headers.

dafs.checksums.enable
Enables use of DAFS-level checksums for DAFS requests and responses. This option may be overridden on a per-NIC basis using the dafs command.

dafs.auth_none.enable
Enables use of the DAFS AUTH_NONE (no security) authentication. This is disabled (off) by default. Please see the DAFS Protocol for more information.

dafs.default_uid
Sets the default numeric user id (uid) to be used when DAFS client credentials are supplied as CRED_DEFAULT or AUTH_DEFAULT. Please see the DAFS Protocol for more information.

dafs.default_gid
Set the default numeric group id (gid) to be used when DAFS client credentials are supplied as CRED_DEFAULT or AUTH_DEFAULT. Please see the DAFS Protocol for more information.

dafs.num_requestd
Sets the default number of DAFS request-processing servers to start for each NIC. This option may be overridden on a per-NIC basis using the dafs command.

dafs.idle_timeout
Sets the time in seconds that a DAFS session can be idle (no requests made) before it is a candidate for disconnection by the filer. A value of 0 disables the idle timeout mechanism. The default idle timeout is 7200 seconds (2 hours). The maximum idle timeout is 65535 seconds (about 18 hours.)

dafs.session_reuse_threshold
Sets the minimum number of seconds a DAFS session must be idle before it becomes eligible for disconnection to reclaim resources needed for other active sessions. The values for this option are expressed in seconds and its default is set to 600. A value of 0 indicates that no session should ever be disconnected in order to free resources for other sessions.

disk.maint_center.allowed_entries
Sets the number of times a disk is allowed to be put into maintenance center testing as a result of reaching a threshold. If a disk reaches another threshold and has already been through maintenance center testing the allowed number of times, the disk is failed. Administrator-initiated testing is not counted. The administrator can test disks any number of times. The default value is 1.

disk.maint_center.enable
Enables/disables maintenance center functionality. The default value is on.

disk.maint_center.max_disks
This option specifies the maximum number of disks that can be running maintenance center tests on a system at the same time. The default value is 84.

disk.maint_center.spares_check
This option specifies whether to check the number of available spares before putting a disk into the maintenance center as the result of reaching a threshold. If this option is on and there are fewer than two available spares when a disk reaches a threshold, the disk is not put into the maintenance center. If the option is off or there are atleast two available spares, the disk is put into the maintenance center. This option has no effect on administrator-initiated testing of disks. The default value is on.

disk.target_port.cmd_queue_depth
Sets the maximum number of concurrent commands that can be dispatched to any target port on an external RAID array. This is useful on gFilers, which support large numbers of LUNs behind a single device ID. If too many commands are issued the overall performance of the external RAID array may be degraded. A value of 0 indicates that no limit is enforced on any target port.

dns.domainname
Sets the DNS domainname to the specified domainname.

dns.enable
Enables DNS client on the filer. The DNS domain must be set and the /etc/resolv.conf file must exist prior to enabling DNS.

dns.cache.enable
Determines whether the DNS cache is used when looking up names. It is on by default. Turning it off will have the side effect of flushing the dns cache. This option has no effect if DNS is not enabled.

fcp.enable
Determines whether FCP service starts by default on a filer.

flexcache.access
Restricts FlexCache access to the filer. The default value is none. For valid values, see na_protocolaccess(8).

flexcache.enable
Enables FlexCache server on the filer. Valid values for this option are on or off. If this option is set to off, no FlexCache volumes can be mapped to any of the volumes on this filer. Existing FlexCache volumes that are currently mapped to this filer are no longer serviced. If this option is set to on, FlexCache volumes can be mapped to volumes on this filer. The default value for this option is off.

fpolicy.enable
When turned off, this disables all file policies on the filer, overriding the settings for individual file policies. When turned on, the setting of a given file policy determines if that file policy is enabled or disabled.

ftpd.enable
When enabled [on], this option allows FTP connections on port 21. When disabled [off], connection attempts on port 21 are refused. The default value for this option is off.

ftpd.3way.enable
Enables/disables third-party file transfers. When enabled [on], this option allows file transfers directly to and from a remote FTP server. When disabled, the IP address specified in the PORT command must match that of the FTP client; in passive mode, only TCP connections from the client will be allowed. This option takes effect immediately and persists across reboots. The default value for this option is off.

ftpd.anonymous.enable
Enables/disables anonymous user logins. An anonymous user will only be allowed to access "anonymous" home directory and its subtrees. Anonymous users are not allowed access to external volumes. Named account users will not have this limitation unless the ftpd.dir.restriction option is enabled. The default value for ftpd.anonymous.enable is off.

ftpd.anonymous.home_dir
Sets the home directory for the anonymous user account. The default value for this option is null.

ftpd.anonymous.name
Specifies the login name for the anonymous user account. The default value for this option is anonymous.

ftpd.auth_style
Sets the ftpd login authentication style to be ntlm, unix or mixed. The default value for this option is mixed.

ftpd.dir.restriction
Sets user home directory restriction. Valid values are none or homedir. The default setting, none, indicates that there is no home directory restriction for regular users. When this option is set to homedir, each named account user's access is restricted to that user's own home directory or to the override directory, if one is specified by the ftpd.dir.override. option.

ftpd.dir.override
Sets the override path for the user home directory. The default value of this option is null, which indicates no home directory override; users will be placed in their home directory upon login. When the value of this option is a valid directory path, users will be placed in that directory upon login. This option applies only to named user accounts. The behavior of the default user account is not affected by the value of ftpd.dir.override.

ftpd.idle_timeout
Sets the time in seconds (s), hours (h) or days (d) between requests that an FTPD session can be idle before it becomes a candidate for disconnection by the filer. The default idle timeout value is 900 seconds (900s). The maximum idle timeout value is 48 hours (48h).

ftpd.log.enable
Enables/disables the logging of FTP commands and data transfer operations. The default value of this option is on.

ftpd.log.filesize
Specifies the maximum file size for FTP logs in the /etc/log directory. When one of the active FTP log files (ftp.cmd or ftp.xfer) reaches this size, it is renamed to ftp.cmd.1 (or ftp.xfer.1, for the transfer log) and that renamed log history file is closed. If there is already a historical log file, such as ftp.cmd.1, that file is renamedto ftp.cmd.2. This renaming process continues sequentially for all historical log files, until the maximum number of historical log files (specified by ftpd.log.nfiles) is reached. Once the maximum number of historical FTP log files is reached, the oldest log file is deleted each time a new active FTP log file is opened. See the description of the ftpd.log.nfiles option for more information. The default value for ftpd.log.filesize is 512k. The valid range for this option is from 1KB to 4GB-1. Valid abbreviations for units of measurement are k or K (kilobytes), m or M (megabytes), g or G (gigabytes). If no unit of measurement is specified, the value is interpreted to be bytes.

ftpd.log.nfiles
Sets the maximum number of log files to be kept. Once an active log file reaches the size limit determined by the ftpd.log.filesize option, a new active log file is created. The old active log file is stored as a historical log file by appending the file name with ".1". All existing historical files are renamed by incrementing the numeric suffix; for example, "ftp.cmd.2" becomes "ftp.cmd.3" and so on. Only the number of files specified by ftpd.log.nfiles are kept. When the maximum number of historical log files is exceeded, the highest-numbered (oldest) log file is deleted. For example, if nfiles is set to 6, ftp.cmd.5 would be deleted rather than renamed. The default value for this option is 6; The valid range for this option is from 1 to 100, inclusive.

ftpd.locking
Sets the type of file locking used by the ftpd during file retrieval. The default value for this option, none, designates that files are not to be locked in any way during file retrieval. When the value of this option is delete, files being retrieved cannot be deleted or renamed.

ftpd.max_connections
Sets the maximum number of concurrent ftpd connections allowed. This option is the limit of the total number of FTP control connections allowed to the filer, or to all vFilers hosted on the physical filer. For clustered configurations, the number of connections permitted is doubled when in takeover mode. The default value of this option is 500. The maximum value is 5000.

ftpd.tcp_window_size
Sets the TCP window size for FTP operations. The default, 32768 bytes, works for many network environments. Change this value only when required for your network configuration. Changes to this option can strongly affect ftpd performance.

gfagent.enable
Enables/disables the Gateway Filer agent.

gfagent.hdm.host
Sets the host address to which Gateway agent will send POST request.

gfagent.hdm.password
User password for Device Manager server.

gfagent.hdm.port
Port number of Device Manager's http server.

gfagent.hdm.user
User name for Device Manager server.

gfagent.hdm.uri
Uri to which Gateway agent send POST request.

gfagent.interval.minutes
Time interval between two successive scan/report in minutes.

httpd.admin.access
Restricts HTTP access to FilerView, the administration area of the filer, via a private Network Appliance URL: any URL beginning with /na_admin. For valid values, see na_protocolaccess(8). If this value is set, trusted.hosts is ignored for FilerView access.

httpd.admin.enable
Enables HTTP access to FilerView, the administration area of the filer, via a private Network Appliance URL: any URL beginning with /na_admin is mapped to the directory /etc/http. Thus, a man page on the filer toaster with the file name /etc/http/man/name can be accessed with the URL http://toaster/na_admin/man/name. Valid values for this option are on or off. The default value for this option is on.

httpd.admin.ssl.enable
Enables HTTPS access to FilerView. To set up ssl, use the secureadmin command. See na_secureadmin(1) for more details.

httpd.admin.hostsequiv.enable
Enables the use of /etc/hosts.equiv for administrative HTTP authentication. If enabled, the authentication of administrative HTTP (for APIs) will use the contents of /etc/hosts.equiv in the same way that it is used for rsh authentication. See na_hosts.equiv(5) and na_rshd(8) for more details. Valid values for this option are on or off. The default value for this option is on.

httpd.autoindex.enable
Allows the filer to automatically generate a directory listing for directories that do not have an index file. Valid values for this option are on or off. The default value for this option is on.

httpd.access
Restricts HTTP access to the filer. Setting this value does not affect FilerView access set by httpd.admin.access. For valid values, see na_protocolaccess(8).

httpd.enable
Enables HTTP access to the filer. Valid values for this option are on or off. The default value for this option is off.

httpd.log.format
Specifies the log format. Valid values for this option are common or alt1. The default value for this option is common.

httpd.log.max_file_size
Specifies the maximum size that the HTTP log file /etc/log/httpd.log can grow to. The default is (2**31)-1 (or 2,147,483,647), which is the largest file size that many clients support. The valid range is 0 to (2**31)-1.

httpd.rootdir
Specifies the complete pathname of the root directory that contains files and subdirectories for HTTP access. The default for this is `xxx' as it is normally set to the appropriate location during http setup.

httpd.timeout
Specifies the minimum amount of time (in seconds) before an idle HTTP 15 connection will time out. The default is 900 seconds, which is fifteen minutes.

httpd.timewait.enable
When enabled, the filer will put HTTP connections that have been closed by the client into the TIME_WAIT state for one minute, which is twice the maximum segment lifetime (2*MSL). By default, TIME_WAIT state is bypassed for HTTP connections.

ip.fastpath.enable
If the option is on, the filer will attempt to use MAC address and interface caching ("Fastpath") so as to try to send back responses to incoming network traffic using the same interface as the incoming traffic and (in some cases) the destination MAC address equal to the source MAC address of the incoming data. This allows for automatic load-balancing between multiple interfaces of a trunk and between multiple filer interfaces on the same subnet. Valid values for this option are on or off. The default value for this option is on. For TCP connections, the system will also automatically detect if this optimization is not feasible in a specific environment or for a specific connection and turn Fastpath off automatically for those connections for which using Fastpath is inappropriate. The netstat command with the -x option can be used to see if Fastpath is enabled for a specific connection.

ip.match_any_ifaddr
If the option is on, the filer will accept any packet that is addressed to it even if that packet came in on the wrong interface. If you are concerned about security, you should turn this off. Valid values for this option are on or off. The default value for this option is on.

ip.path_mtu_discovery.enable
Enables/disables path MTU discovery; it is currently used only by TCP. Path MTU discovery, described in RFC 1191, allows a host to discover the ``maximum transmission unit'', i.e. the largest link-level packet that can be transmitted, over a path from that host to another host. This means that the filer needn't choose a conservative packet size for a TCP connection to a host not on the same net as the filer, but can attempt to discover the largest packet size that can make it to the other host without fragmentation. Valid values for this option are on or off. The default value for this option is on.

ip.ping_throttle.drop_level
Specifies the maximum number of ICMP echo or echo reply packets (ping packets) that the filer will accept per second. Any further packets within one second are dropped to prevent ping flood denial of service attacks. The default value is 10.

ip.ping_throttle.alarm_interval
Specifies the how often dropped pings will be syslogged in minutes. This prevents a ping flood denial of service attack from flooding the syslog with messages. A value of 0 turns of logging of ping floods. The default value is 0.

ip.tcp.newreno.enable
Enables/disables the use of the NewReno modification to TCP's fast recovery Algorithm (described in RFC 2582). Valid values for this option are on or off. The default value for this option is on.

ip.tcp.sack.enable
Enables/disables the use of TCP Selective Acknowledgements (described in RFC 2018). Valid values for this option are on or off. The default value for this option is on.

ip.ipsec.enable
Enables/disables the Internet Security Protocol (ipsec) support on the filer. Valid values for this option are on or off. The default value for this option is off.

iscsi.enable
Determines whether iSCSI service starts by default on a filer.

iscsi.isns.rev
Determines the draft level of the iSNS specification the iSNS service on the filer is compatible with. As an example, say the iSNS server that the filer plans on connecting to is compatible with draft 22 of the iSNS specification. The administrator would set the iscsi.isns.rev to 22. This would ensure that the iSNS service on the filer would be compatible with the iSNS server. If this setting is not properly set, the filer may not be able to successfully register with the iSNS server.

iscsi.iswt.tcp_window_size
CAUTION - This number will affect iSCSI performance for the iSCSI software target (ISWT) driver and defines the filer's receive TCP window size for all iSCSI connections involving this driver. The default setting is 131400 bytes. In general, for best performance, the value of this option should be set according to your network configuration, taking into account the latency of the underlying network. However, improved performance may be obtained with certain iSCSI initiators by tuning this value beyond the normal network calculations involving latency and roundtrip time. You must stop/start the iSCSI service for a change in this value to take effect.

kerberos.replay_cache.enable
This option enables the Kerberos replay cache feature. This feature prevents passive replay attacks by storing user authenticators on the filer for a short time, and by insuring that the authenticators are not reused in subsequent Kerberos tickets by attackers. Storing and comparing the user authenticators can result in a substantial performance penalty for higher workloads on the filer. The default value for this option is off.

ldap.enable
Turns LDAP lookup off or on. An entry must also be made in the /etc/nsswitch.conf file to use LDAP for this purpose.

ldap.ADdomain
The Active Directory Domain name in DNS format to use for LDAP queries. Typically this will be something like "group.company.com".

ldap.base
The base distinguished name to use for common ldap lookups, which include user passwd lookup, group lookup and netgroup lookup. The format of the base string is: "(filter1):scope1;(filter2):scope2;". Typically the filer is something like "cn=company,cn=uk". The scope can be one of those three choices: BASE, ONELEVEL or SUBTREE. The default scope is SUBTREE if it is not specified.

ldap.base.passwd
The base distinguished name to use for user passwd lookups, this option will override the ldap.base option. The format of the base string is: "(filter1):scope1;(filter2):scope2;". Typically the filer
is something like "cn=company,cn=uk". The scope can be one of those three choices: BASE, ONELEVEL or SUBTREE. The default scope is SUBTREE if it is not specified.

ldap.base.group
The base distinguished name to use for group lookups, this option will override ldap.base option. The format of the base string is: "(filter1):scope1;(filter2):scope2;". Typically the filer is something like "cn=company,cn=uk". The scope can be one of those three choices: BASE, ONELEVEL or SUBTREE. The default scope is SUBTREE if it is not specified.

ldap.base.netgroup
The base distinguished name to use for netgroup lookups, this option will override ldap.base option. The format of the base string is: "(filter1):scope1;(filter2):scope2;". Typically the filer
is something like "cn=company,cn=uk". The scope can be one of those three choices: BASE, ONELEVEL or SUBTREE. The default scope is SUBTREE if it is not specified.

ldap.name
The username to use for the administrative queries necessary to look up UIDs and GIDs given a username. Best practice is to make this a user with read-only access to the database.

ldap.nssmap.attribute.gecos
The substitution for RFC 2307 gecos attribute. The default value is "gecos".

ldap.nssmap.attribute.gidNumber
The substitution for RFC 2307 gecos gidNumber. The default value is "gidNumber".

ldap.nssmap.attribute.groupname
The substitution for RFC 2307 group name attribute. The default value is "cn".

ldap.nssmap.attribute.homeDirectory
The substitution for RFC 2307 homeDirectory attribute. The default value is "homeDirectory".

ldap.nssmap.attribute.loginShell
The substitution for RFC 2307 loginShell attribute. The default value is "loginShell".

ldap.nssmap.attribute.memberNisNetgroup
The substitution for RFC 2307 memberNisNetgroup attribute. The default value is "memberNisNetgroup".

ldap.nssmap.attribute.memberUid
The substitution for RFC 2307 memberUid attribute. The default value is "memberUid".

ldap.nssmap.attribute.netgroupname
The substitution for RFC 2307 netgroup name attribute. The default value is "cn".

ldap.nssmap.attribute.nisNetgroupTriple
The substitution for RFC 2307 nisNetgroupTriple attribute. The default value is "nisNetgroupTriple".

ldap.nssmap.attribute.uid
The substitution for RFC 2307 uid attribute. The default value is "uid".

ldap.nssmap.attribute.uidNumber
The substitution for RFC 2307 uidNumber attribute. The default value is "uidNumber".

ldap.nssmap.attribute.userPassword
The substitution for RFC 2307 userPassword attribute. The default value is "userPassword".

ldap.nssmap.objectClass.nisNetgroup
The substitution for RFC 2307 nisNetgroup object class. The default value is "nisNetgroup".

ldap.nssmap.objectClass.posixAccount
The substitution for RFC 2307 posixAccount object class. The default value is "posixAccount".

ldap.nssmap.objectClass.posixGroup
The substitution for RFC 2307 posixGroup object class. The default value is "posixGroup".

ldap.passwd
The password to use for the administrative user. This will always display as six `*'s when listing the options.

ldap.port
The port to use for LDAP queries. This defaults to 389, LDAP's well-known port assignment.

ldap.servers
List of servers to use for LDAP queries. Use quotation marks to indicate servers whose names have embedded spaces or commas.

ldap.servers.preferred
List of preferred LDAP servers. Use this list to indicate servers that are on faster links if any of the servers listed in ldap.servers is on a WAN link or is for some other reason considered slower or less reliable.

ldap.usermap.attribute.unixaccount
Specify the unix account attribute name for the ldap usermapping search.

ldap.usermap.attribute.windowsaccount
Specify the windows account attribute name for the ldap usermapping search.

ldap.usermap.base
The base distinguished name to use for ldap usermapping. The format of the base string is: "(filter1):scope1;(filter2):scope2;". Typically the filer
is something like "cn=company,cn=uk". The scope can be one of those three choices: BASE, ONELEVEL or SUBTREE. The default scope is SUBTREE if it is not specified.

ldap.usermap.enable
Enable the filer to search an LDAP database for the user mapping between Unix users and Windows accounts.

locking.grace_lease_seconds
Sets the grace period for clients to reclaim file locks after a server failure. The grace period is expressed in seconds. For lease-based lock protocols (currently DAFS), it also sets the locking lease period. Clients that have been inactive for a period equal or longer to the lease period may lose all their locking state on a filer.

ndmpd.access
Allows the administrator to restrict access to NDMP operations based on the hostname or the IP address. The default value for this option is all. See na_protocolaccess(8) for details.

ndmpd.authtype
Allows the administrator to control which authentication methods the filer will accept. NDMP supports two authentication types: challenge and plaintext. The default type is challenge. Challenge was MD5 and plaintext was text prior to Data ONTAP 6.4.

ndmpd.connectlog.enabled
Allows NDMP to track all the NDMP connection events for security purposes. Turning the option on allows all the NDMP connection events to be recorded in the syslog(/etc/messages) file. The default value for this option is being changed from on to off. By default, Data ONTAP 6.4 NDMP connection logging allows NDMP connection events for security audit purposes. This optional logging support causes all NDMP connection events to be recorded in the /etc/messages file. When used in conjunction with standard intrusion detection software NDMP connection logging provides a powerful security audit mechanism. However NDMP connection logging significantly increased the number of log messages written to the /etc/messages file. If NDMP connection auditing is not desired, it is advisable to disable NDMP connection logging option to reduce the size of the /etc/messages file. NDMP connection logging can be disabled by issuing the following command at the filer console: options ndmpd.connectlog.enabled off. NDMP connection logging can be enabled by issuing the following command at the filer console: options ndmpd.connectlog.enabled on.

ndmpd.enable
If on the NDMP daemon accepts requests. Turning the option off disables request handling by the NDMP daemon. The default is off. Enabling and disabling this option is equivalent to executing ndmpd on and ndmpd off respectively.

ndmpd.ignore_ctime.enabled
This option, when on, allows user to exclude files with ctime changed from filer incremental dumps since other processes like virus scanning often alter the ctime of files. When this option is off, backup on the filer will include all files with a change or modified time later then the last dump in the previous level dump. This option is persistent across reboots.

Most WIN32 APIs are often unaware of the "last changed time", ctime, they often incorrectly set a later time for files, causing these files to be included in the filer's incremental dumps, making the incremental dump very large. This is partially defying the purpose of having incremental dumps, since one uses incremental dumps to speed up the backup by only dumping files that were "changed" since the last backup.

ndmpd.password_length
Allows administrator to select either 8-byte or 16-byte NDMP specific passwords. The default value is 16. This is the length in all existing versions of ONTAP that support this feature, so it will be backwards compatible. This option is persistent and the only legal values are 8 and 16. If an illegal value is entered, the following message will be prompted: options ndmpd.password_length: Length must be either 8 or 16. The options ndmpd.password_length controls password length during both generation and authentication. Supporting multiple concurrent NDMP specific password lengths is NOT required, and will not be possible. That is, if this options is set to 8, all NDMP applications managing backups for that filer MUST use an 8-byte password for authentication.

ndmpd.preferred_interface
You can specify the filer network interface to be used when establishing an NDMP data connection to another filer.

By default, an NDMP data connection uses the same network interface as the NDMP control connection established by the NDMP backup application. However, when a data connection between NDMP-enabled devices needs to be established over an alternate network, it is necessary to specify the filer's interface through which the alternate network will be accessed.

For example, a Unix or NT resident NDMP backup application and multiple NDMP-enabled filers can be interconnected via a corporate network. The same NDMPenabled devices can also be interconnected via an isolated private network. To minimize load on the corporate network, the ndmpd.preferred_interface option can be used to direct all NDMP data connections over the isolated private network.

To specify the preferred network interface to be used for NDMP data connections, issue the following command: options ndmpd.preferred_interface interface. interface identifies the network interface to be used for all NDMP data connections. Any network interface providing TCP/IP access can be specified. If no argument is specified, the command returns the name of the interface currently configured for data connections. If no interface is currently set, it reports disable. You can find the available network interfaces by using the ifconfig -a command.

To disable a preferred network interface specification and force the NDMP default interface to be used for data connections, issue the following command: options ndmpd.preferred_interface disable. The default value for the ndmp.preferred_interface option is disable.

Note: The ndmpd.preferred_interface option is persistent across filer reboots.

nfs.access
Restricts nfs access to the filer. For valid values, see na_protocolaccess(8).

nfs.export.allow_provisional_access
The default for this option is enabled. This option controls whether provisional access is granted in the event that a name service outage prevents the filer from determining if a given client has access to an exported path.

For example, the client in question may have readwrite access to an exported path. In this situation access is provided in IP address format. The client however could also be part of a netgroup that is given read-only access to the same path. Under normal circumstances the client would not be given write access because of how access rules are applied. In the event that the netgroup could not be resolved or expanded, the client would provisionally be granted write access since an entry for it could be found in IP form.

This example illustrates a security issue in that it is possible for clients to be given more access rights than originally intended. Therefore, the option is provided to disable provisional access. This has the effect of delaying access until it is possible for the filer to definitively determine access rights for the client.

nfs.assist.queue.limit
The default for this option is 40. This option controls the percentage of NFS asynchronous messages which can be placed onto the NFS assist queue. Once this limit has been reached, further NFS requests which need to undergo a name service transaction will instead have permissions granted based on nfs.export.allow_provisional_access. The number of available NFS asynchronous messages can be determined with nfsstat -d.

nfs.export.auto-update
The default for this option is enabled. This option controls whether automatic updates are performed on the /etc/exports file. If it is not set, then the commands vol create, vol delete, and vol rename will not automatically rewrite the file. Instead they will syslog the need to edit the file.

nfs.export.harvest.timeout
The default for this option is 3600 seconds (one hour). This option sets the idle expiration time for entries in the export access cache. This timer resets every time the export is accessed from the host. The minimum value is 60 seconds and the maximum is 7 days.

nfs.export.neg.timeout
The default for this option is 1800 seconds (30 minutes). This option sets the refresh time for entries which were denied access in the export access cache. The minimum value is 60 seconds and the maximum is 7 days.

nfs.export.pos.timeout
The default for this option is 36000 seconds (ten hours). This option sets the refresh time for entries granted access in the export access cache. The minimum value is 60 seconds and the maximum is 7 days.

nfs.export.resolve.timeout
The default for this option is 8 seconds. This option had been hidden before and may have had a default of either 30 or 15 seconds. This option controls how long a name service lookup is allowed to proceed before the NFS export code will determine that the name servers are not responding in a timely fashion.

nfs.kerberos.file_keytab.enable
The default for this option is off. When enabled, the vfiler is directed to use a file based Kerberos key table (in /etc/krb5.keytab), with a format equal to that generated by an MIT-based kadmin command.

nfs.kerberos.principal
The default for this string option is a zero length string. If nfs.kerberos.file_keytab.enable is enabled, then the nfs.kerberos.principal option must be set to the host specific part of an NFS server's Kerberos principal name. For example, if nfs.kerberos.principal is set to elrond.mycompany.com, then the resulting principal name of the NFS server will be nfs/elrond.mycompany.com@realm, where realm is the value of nfs.kerberos.realm. Note that nfs/elrond.mycompany.com@realm must appear as an entry in /etc/krb5.keytab.

nfs.kerberos.realm
The default for this string option is a zero length string. If nfs.kerberos.file_keytab.enable is enabled, then the nfs.kerberos.realm option must be set to the host specific part of an NFS server's Kerberos principal name. For example, if nfs.kerberos.realm is set to MYCOMPANY.COM, then the resulting principal name of the NFS server will be nfs/principal@MYCOMPANY.COM, where principal is value of
nfs.kerberos.principal. Note that nfs/principal@MYCOMPANY.COM must appear as an entry in /etc/krb5.keytab.

nfs.locking.check_domain
The default for this option is on. If this option is set to off, then the NFS version 2 and 3 lock manager (NLM) and the NFS version 2 and 3 status monitor (NSM) will ignore the domain suffix when comparing the client host name in an NSM request with that of client host name associated with an outstanding lock. One might want to set the nfs.locking.check_domain to off if one has NFS version 2 or 3 clients that issue NLM requests with fully qualified domain names (FQDNs) and NSM requests with non-FQDNs. Similarly, if the converse is true, one might want to turn nfs.locking.check_domain off. Otherwise, clients that send hostnames inconsistently will leave locks held on the filer, requiring manual intervention even after the client reboots (and sends the NSM recovery message).

If nfs.locking.check_domain is off, then one must take care to make sure than the non-FQDNs of each client are unique, lest two clients with different domains cause each other to lose locks. For example, if the option is off, then two NFS clients, one named wally.eng.mycompany.com and the other named wally.corp.mycompany.com will be considered as the same for purposes of processing the NSM recovery message when either client reboots. It is strongly recommended that clients be fixed and/or reconfigured to obviate the need for setting nfs.locking.check_domain to off.

Because NFS version 4 uses schemes for locking and lock recovery that are completely different than NLM and NSM, the nfs.locking.check_domain option and the associated issue, do not apply to NFS version 4.

nfs.mount_rootonly
When enabled, the mount server will deny the request if the client is not root user using privileged ports. Valid values for this option are on (enabled) or off (disabled). The default value for this option is on for more secure access.

nfs.mountd.trace
When enabled, all mount requests are logged. This option is intended to help debug denied mount requests. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off to avoid too many messages.

nfs.netgroup.strict
When enabled, all entries in the export access lists which do not have a `@' prepended are considered to not be netgroups. This setting will bypass a potentially spurious netgroup lookup for each non-netgroup entry in the access lists.

nfs.notify.carryover
This is set to on by default. When set to off, the hosts present in the /etc/sm/notify file are not sent NSM reboot notifications after a filer panic/reboot. A zero-byte file /etc/sm/.dontcarryover is created after atleast one round of notifications or after one hour passes since the notifications began (whichever comes later). If the /etc/sm/.dontcarryover file exists and the above option is false, then the existing /etc/sm/notify file is truncated. In all other cases, the exisiting /etc/sm/notify file is used for subsequent notifications.

nlm.trace
When enabled, all asynchronous nlm requests and server callbacks are logged. This option is intended to help debug asynchronous nlm requests and all lock requests which were blocked on the server because of a conflict and require the server to send a callback to the client. This option is persistent across reboots so it should be used carefully. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off to avoid too many messages.

nfs.per_client_stats.enable
Enables/disables the collection and display of perclient NFS statistics, as described in na_nfsstat(1). Valid values for this option are on or off. The default value for this option is off.

nfs.require_valid_mapped_uid
If this option is "on" it forces all NFS requests to be successfully mapped via the /etc/usermap.cfg mechanism. This allows NFS requests to be selectively validated by UID or IP address. This mapping is described in na_usermap.cfg(5). Valid values for this option are on or off. The default value for this option is off.

nfs.response.trace
If this option is "on", it forces all NFS requests which have exceeded the time set in nfs.response.trigger to be logged. If this option is "off", only one message will be logged per hour. The default value for this option is off.

nfs.response.trigger
Any NFS request which takes longer to complete than the time set by this option will be logged, according to the state of nfs.response.trace. The results of this option can be used to determine if the client side message "NFS Server not responding" is due to the server or the network. The default value for this option is 60 seconds.

nfs.rpcsec.ctx.high
The default is zero. If set to a value other than zero it sets a high-water mark on the number of stateful RPCSEC_GSS (see RFC2203) authentication contexts (today, only Kerberos V5 produces stateful authentication state in NFS). If it is zero, then no explicit high-water mark is set.

nfs.rpcsec.ctx.idle
Default is 360 seconds. This is the amount of time, in seconds, an RPCSEC_GSS context (see the description for the nfs.rpcsec.ctx.high option) will be permitted to be unused before it is deleted.

nfs.tcp.enable
When enabled, the NFS server supports NFS over TCP. By default, the feature is disabled since some clients which support NFS over TCP do so with performance inferior to UDP. It can be enabled if this is not an issue in your environment. Valid values for this option are on or off. The default value for this option is off.

nfs.ifc.xmt.high
NFS goes into transmit flow control when the send window is full and the number of outstanding requests increases beyond nfs.ifc.xmt.high. At that time NFS will stop reading from the TCP input window. The default value for this option is set to 16. Its maximum limit is 64. This is a persistent option.

nfs.ifc.xmt.low
NFS comes out of flow control when the number of outstanding requests goes below nfs.ifc.xmt.low. The default value for this option is set to 8. Its minimum value is 0. This is a persistent option.

nfs.hide_snapshot
This is off by default and is persistent across reboots. This is effective only when nosnapdir is disabled. Setting this option to on allows snapshots to be hidden in the NFS directory listings. The .snapshot directory itself is visible, but the actual snapshots will be hidden. At the same time, an explicit access to snapshots is allowed even though they are not visible in the directory listings.

NOTE: When this option is on and if you have mounted a path ending with ".snapshot", `pwd' may not work correctly in such a mounted path and its directory tree on the client. As a result, any applications that depend on obtaining the current working directory using the standard UNIX library calls like getpwd(3C) may not function correctly. The exact result reported when asked for current working directory is dependent on the client's `pwd' implementation.

nfs.udp.xfersize
The maximum transfer size (in bytes) that the NFS mount protocol will negotiate with the client for UDP transport. Larger transfer sizes often result in better NFS performance. Prior to 5.3.5, this defaulted to 8192 due to a FDDI bug. For 5.3.5 and later the default is 32768. The maximum value for this option is 57344 (56K).

nfs.v2.df_2gb_lim
Causes the filer to return replies to the "file system statistics" NFS version 2 request that shows no more than (2**31)-1 (or 2,147,483,647) total, free, or available bytes (i.e., 2GB) on the file system.

Some NFS clients require this option because, if they get return values from the "file system statistics" request with more than the specified number of bytes, they'll incorrectly compute the amount of free space on the file system, and may think that there's no free space on a file system that has more than 2GB free. Valid values for this option are on or off. The default value for this option is off.

nfs.v3.enable
When enabled, the NFS server supports NFS version 3. Disable this option if there is a problem with some client when using NFS version 3, and that client cannot be configured to use NFS version 2. Valid values for this option are on (enabled) or off (disabled). The default value for this option is on.

nfs.v4.enable
When enabled, the NFS server supports NFS version 4. NFS version 4 support is only over the TCP protocol. Valid values for this option are on (enabled) or off (disabled). The default value for this option is on.

nfs.v4.read_delegation
Read delegations allow NFS version 4 clients to do read operations locally without contacting the server. These include open for read, read locks and file read operations. Both the server and client must support read delegations for this feature to work. When enabled, read delegations are supported for NFS version 4. This feature is not supported for NFS versions 2 and 3. The default value for this option is off.

nfs.v4.write_delegation
Write delegations allow NFS version 4 clients to do write operations locally without contacting the server. These include open for write, write locks and writing to files. Both the server and client must support write delegations for this feature to work. When enabled, write delegations are supported for NFS version 4. This feature is not supported over NFS versions 2 and 3. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off.

nfs.v4.id.domain
This option controls the domain portion of the string form of user and group names as defined in the NFS version 4 protocol. The domain name is normally taken from the NIS domain in use, or otherwise from the DNS domain. However if this option is set, it will override this default behavior.

nfs.v4.acl.enable
When enabled, ACLs are supported for NFS version 4. The ACL option controls setting and getting NFSV4 ACLs. It does not control enforcement of these ACLs for access checking. This feature is not supported over NFS versions 2 and 3. The default value for this option is off.

nfs.webnfs.enable
When enabled, the NFS server supports WebNFS lookups. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off.

nfs.webnfs.rootdir
Specifies the WebNFS rootdir. Once the rootdir is set, WebNFS clients can issue lookups relative to the rootdir using the public filehandle. The default value for this option is `XXX'. This option is only used when nfs.webnfs.rootdir.set is on, and nfs.webnfs.rootdir.set can only be on if this option contains the fully qualified pathname to a valid, existing directory.

nfs.webnfs.rootdir.set
This option needs to be enabled for the rootdir setting to take effect. Disabling this option disables the existing rootdir setting. Valid values for this option are on (enabled) or off (disabled). The default value for this option is off. Note that this option can only be enabled if the nfs.webnfs.rootdir option contains a fully qualified pathname to a valid, existing directory.

nis.domainname
Sets the NIS domain to the specified domainname. The default for value for this option is the null string.

nis.enable
Enables NIS client on the filer. The NIS domain must be set prior to enabling NIS. Valid values for this option are on or off. The default value for this option is off.

nis.group_update.enable
Enables the local caching of the NIS group files. Valid values for this option are on or off. The default value for this option is off.

nis.group_update_schedule
Specifies the hours of the day when the local NIS group cache has to be updated. `now' will update the cache immediately. The valid value for this option is a comma separated list of hours, in the range of 1 to 24. The default value for this option is 24.

nis.netgroup.domain_search.enable
Specifies whether netgroup entry comparisions will consider the domainnames in the search directive from /etc/resolv.conf. The default for value for this option on.

nis.servers
Specifies the list of preferred NIS servers. Valid values for this option is `*' or a comma separated list of ip addresses. The default value for this option is `*'.

nis.slave.enable
Enables NIS slave on the filer. Valid values for this option are on or off. The default value for this option is off.

pcnfsd.enable
Enables/disables the PCNFSD (PC)NFS authentication request server (see na_pcnfsd(8)). Valid values for this option are on or off. The default value for this option is off.

pcnfsd.umask
Specifies the default umask for files created by (PC)NFS clients. The value of this option is a threedigit octal number, and the digits correspond to the read, write, and execute permissions for owner, group, and other, respectively. The default value for this option is 022, which means that files normally created with mode 666 effectively will have mode 644. (``644'' means that the file owner has read and write permissions, but the members of the group and others have only read permission.)

raid.background_disk_fw_update.enable
Determines the behaviour of automatic disk firmware update. Valid values for this option are on or off. The default value for this option is on. If the option is set to on, firmware updates to spares and filesystem disks within RAID-DP, mirrored RAID-DP and mirrored RAID4 volumes is performed in a non-distruptive manner via a background process. Firmware updates for disks within RAID4 volumes will however be done at boot. If the option is turned off automatic firmware update will occur in a manner similar to that for previous releases, namely at boot or during disk insertion. More information can be found within disk_fw_update man pages.

raid.disk.copy.auto.enable
Determines the action taken when a disk reports a predictive failure. Valid values for this option are on or off. The default value for this option is on.

Sometimes, it is possible to predict that a disk will fail soon based on a pattern of recovered errors that have happened on the disk. In such cases, the disk will report a predictive failure to Data ONTAP. If this option is set to on, Data ONTAP will initiate Rapid RAID Recovery to copy data from the failing disk to an available spare. When data is copied, the disk will be failed and placed in the pool of broken disks. If a spare is not available, the filer will continue to use the prefailed disk until the disk fails.

If the option is set to off, the disk will be failed immediately and placed in the pool of broken disks. A spare will be selected and data from the missing disk will be reconstructed from other disks in the RAID group. The disk will not be failed if the RAID group is already degraded or reconstructing so that another disk failure would lead to a failure of the whole RAID group.

raid.media_scrub.enable
Enables/disables continuous background media scrubs for all aggregates (including those embedded in traditional volumes) in the system. Valid values for this option are on or off. The default value for this option is on. When enabled, a low-overhead version of scrub which checks only for media errors runs continuously on all aggregates in the system. Background media scrub incurs negligible performance impact on user workload and uses aggressive disk and CPU throttling to achieve that.

raid.media_scrub.spares.enable
Enables/Disables continuous background media scrubs for all spares drives within the system. Valid values for this option are on or off. The default value for this option is on. When enabled a low overhead version of scrub which checks only for media errors runs continuously on all spare drives of the system. Background media scrub incurs negligible performance impact on user workload and uses aggressive disk and CPU throttling to achieve that. This option is used in conjunction with raid.media_scrub.enable which enables/disables media_scrub on a system-wide basis. The value for this option has no effect if the systemwide option is set to off.

raid.media_scrub.rate
Sets the rate of media scrub on an aggregate (including those embedded in traditional volumes). Valid values for this option range from 300 to 3000 where a rate of 300 represents a media scrub of approximately 512 MBytes per hour, and 3000 represents a media scrub of approximately 5 GBytes per hour. The default value for this option is 600, which is a rate of approximately 1 GByte per hour.

raid.reconstruct_speed
This option is obsolete. See raid.reconstruct.perf_impact for the option that controls the effect of RAID reconstruction.

raid.reconstruct.perf_impact
Sets the overall performance impact of RAID reconstruction. When the CPU and disk bandwidth are not consumed by serving clients, RAID reconstruction consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option allows control over how much of the CPU and disk bandwidth will be taken away for reconstruction, and hence how much of a negative performance impact it will be to the serving of clients. As the value of this option is increased, the speed of reconstruction will also increase. The possible values for this option are low, medium, and high. The default value is medium. There is also a special value of default, which will use the current default value. When mirror resync and reconstruction are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

raid.reconstruct.wafliron.enable
Enables starting wafliron (see na_vol(1)) when reconstruction encounters a medium error. Valid values for this option are on and off. The default value for this option is on. When a medium error is encountered in an aggregate during reconstruction, access to the volume(s) it contains is temporarily restricted and reconstruction proceeds bypassing media errors. If this option is enabled, wafliron is started automatically, thus bringing the aggregate and its volume(s) back online. If this option is disabled, the volume(s) stay restricted.

raid.resync.perf_impact
Sets the overall performance impact of RAID mirror resync (whether started automatically by the system or implicitly by an operator-issued command). When the CPU and disk bandwidth are not consumed by serving clients, a resync operation consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option controls how much of the CPU and disk bandwidth will be taken away for resync operations, and hence how much of a negative performance impact it will be to the serving of clients. As the value of this option is increased, the speed of resync will also increase. The possible values for this option are low, medium, and high. The default value is medium. There is also a special value of default, which will use the current default value. When RAID mirror resync and reconstruction are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

raid.rpm.ata.enable
Enforces separation of ATA disks by uniform rotational speed (RPM). If you set this option to on, Data ONTAP always selects ATA disks with the same RPM when creating new aggregates or when adding disks to existing aggregates. If you set this option to off, Data ONTAP does not differentiate between ATA disks based on rotational speed. For example, Data ONTAP might use both 5400 RPM and 7200 RPM disks in the same aggregate. The default value is off.

raid.rpm.fcal.enable
Enforces separation of FC-AL disks by uniform rotational speed (RPM). If you set this option to on, Data ONTAP always selects FC-AL disks with the same RPM when creating new aggregates or when adding disks to existing aggregates. If you set this option to off, Data ONTAP does not differentiate between FC-AL disks based on rotational speed. For example, Data ONTAP might use both 10K RPM and 15K RPM disks in the same aggregate. The default value is on.

raid.scrub.duration
Sets the duration of automatically started scrubs, in minutes. If this is not set or set to 0, it defaults to 6 hours (360 minutes). If set to `-1', all automatic scrubs will run to completion.

raid.scrub.enable
Enables/disables the RAID scrub feature (see na_disk(1)). Valid values for this option are on or off. The default value for this option is on. This option only affects the scrubbing process that gets started from cron. This option is ignored for userrequested scrubs.

raid.scrub.perf_impact
Sets the overall performance impact of RAID scrubbing (whether started automatically or manually). When the CPU and disk bandwidth are not consumed by serving clients, scrubbing consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option controls how much of the CPU and disk bandwidth will be taken away for scrubbing, and hence how much of a negative performance impact it will be to the serving of clients. As the value of this option is increased, the speed of scrubbing will also increase. The possible values for this option are low, medium, and high. The default value is low. There is also a special value of default, which will use the current default value. When scrub and mirror verify are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

raid.scrub.schedule
Specifies the weekly schedule (day, time and duration) for scrubs started automatically by the raid.scrub.enable option. The default schedule is Sunday 1 a.m. for the duration specified by the raid.scrub.duration option. If an empty string ("") is specified as an argument, it will delete the previous scrub schedule and add the default schedule. One or more schedules can be specified using this option. The syntax is duration[h|m]@weekday@start_time,[duration[h|m]@weekday@start_time,...] where duration is
the time period for which scrub operation is allowed to run, in hours or minutes ('h' or `m' respectively). If duration is not specified, the raid.scrub.duration option value will be used as duration for the schedule.

weekday
is the day when scrub operation should start. Valid values are sun, mon, tue, wed, thu, fri, sat.

start_time
is the time when scrub should start, specified in 24 hour format. Only the hour (0-23) needs to be specified.

raid.timeout
Sets the time in hours, as a number greater than or equal to 1, that the system will run after a single disk failure has caused the system to go into degraded mode. The default is 24. If the raid.timeout option is specified after the system is already in degraded mode, the timeout is set to the value specified and the timeout restarted.

raid.verify.perf_impact
Sets the overall performance impact of RAID mirror verify. When the CPU and disk bandwidth are not consumed by serving clients, a verify operation consumes as much as it needs. If the serving of clients is already consuming most or all of the CPU and disk bandwidth, this option controls how much of the CPU and disk bandwidth will be taken away for verify, and hence how much of a negative performance impact it will be to the serving of clients. As you increase the value of this option, the verify speed will also increase. The possible values for this option are low, medium, and high. The default value is low. There is also a special value of default, which will use the current default value. When scrub and mirror verify are running at the same time, the system does not distinguish between their separate resource consumption on shared resources (like CPU or a shared disk). In this case, the resource utilization of these operations taken together is limited to the maximum of their configured individual resource entitlements.

rmc.setup
If LAN settings have been provided for a remote management controller, this will be set to on and the presence of its dedicated LAN interface and external power supply is periodically verified.

rpc.nlm.tcp.port
This option allows the NLM rpc service over TCP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.nlm.udp.port
This option allows the NLM rpc service over UDP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.nsm.tcp.port
This option allows the NSM rpc service over TCP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.nsm.udp.port
This option allows the NSM rpc service over UDP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.mountd.tcp.port
This option allows the MOUNTD rpc service over TCP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.mountd.udp.port
This option allows the MOUNTD rpc service over UDP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.pcnfsd.tcp.port
This option allows the PCNFSD rpc service over TCP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.pcnfsd.udp.port
This option allows the PCNFSD rpc service over UDP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. The results are undefined if more than one RPC services are registered on the same port.

rpc.rquotad.udp.port
This option allows the RQUOTAD rpc service over UDP to be registered on a port other than the default. nfs off followed by nfs on is required to re-register the service on the new port. This is a per host option and is persistent across reboots. This service is only registered over UDP. The results are undefined if more than one RPC services are registered on the same port.

rsh.access
Restricts rsh access to the filer. For valid values, see na_protocolaccess(8).

rsh.enable
Enables the RSH server on the filer. Valid values for this option are on or off. The default value for this option is on.

security.passwd.firstlogin.enable
This option controls whether all admins (except for root) must change their passwords upon first login. A value of on means that newly created admins, or admins whose passwords were changed by another admin, may only run the passwd command until the password is changed. Default value is off.

security.passwd.lockout.numtries
This option controls how many attempts an admin can try a login before the account is disabled. This account may be reenabled by having a different admin change the disabled admin's password. If this value is default, then failing to login will never disable an account. The default value for this option is 4294967295.

security.passwd.rules.enable
This option controls whether a check for password composition is performed when new passwords are specified. See na_useradmin(1) for additional information on relevant effected functionality. A value of on means that the check will be made, and the password rejected if it doesn't pass the check. A value of off means that the check won't be made. The default value for this option is on. By default, this option does not apply to the users "root" or "Administrator" (the NT Administrator account).

security.passwd.rules.everyone
This option controls whether a check for password composition is performed for all users, including "root" and "Administrator". A value of off means that the checks do not apply to "root" or "Administrator" (but still may apply to all other users). The default value value for this option is off. security.passwd.rules.enable must have the value on or this option is ignored.

security.passwd.rules.history
This option controls whether an administrator can re-use a previous password. A value of 5 means that the appliance will store 5 passwords, none of which an admin can re-use. A value of 0 means that an admin is not restricted by any previous password. Default value is 0. security.passwd.rules.enable must have the value on or this
option is ignored. To prevent administrators from abusing this option by cycling through the password history, see the `-m' option in na_useradmin(1).

security.passwd.rules.maximum
This option controls the maximum number of characters a password can have. Though there is no default value for this option, only the first 16 characters are saved. Users with passwords greater than 14 characters will not be able to log in via the Windows interfaces, so if you are using Windows, we recommend this value to be 14.) security.passwd.rules.enable must have the value on or this
option is ignored.

security.passwd.rules.minimum
This option controls the minimum number of characters a password must have. The default value for this option is 8. security.passwd.rules.enable must have the value on or this option is ignored.

security.passwd.rules.minimum.alphabetic
This option controls the minimum number of alphabetic characters a password must have. (IE: A password cannot be just digits and symbols.) These are capitol and lowercase letters from a to z. The default value for this option is 2. security.passwd.rules.enable must have the value on or this
option is ignored.

security.passwd.rules.minimum.digit
This option controls the minimum number of digit characters a password must have. These are numbers from 0 to 9. The default value for this option is 1. security.passwd.rules.enable must have the value on or this
option is ignored.

security.passwd.rules.minimum.symbol
This option controls the minimum number of symbol characters a password must have. These are whitespace and punctuation characters. The default value for this option is 0. security.passwd.rules.enable must have the value on or this
option is ignored.

snapmirror.access
This option determines which SnapMirror destination filers may initiate transfers, and over which network interfaces. When set to "legacy", SnapMirror uses the older snapmirror.allow to determine access. The option value is a string containing an expression which provides the access filter. An example of the options command for snapmirror.access is options snapmirror.access host=toaster,fridge. The default value is "legacy". See na_snapmirror.allow(5) and na_protocolaccess(8) for more details.

snapmirror.checkip.enable
Enables IP address based verification of SnapMirror destination filers by source filers. Valid values are on or off. The default value is off. See na_snapmirror.allow(5) for more details.

snapmirror.delayed_acks.enable
Enables TCP/IP delayed acknowledgements. Disabling this can improve performance of SnapMirror network connections in high latency networks. Valid values are on or off. The default value is on.

This uses the slow start and congestion avoidance algorithms as described in RFC 2581. Do note that disabling this option can be disruptive to other clients on the same network as the SnapMirror connection.

snapmirror.enable
Enable or disable SnapMirror operations. Valid values for this option are on or off. The default value for this option is off. When on (SnapMirror must be licensed), SnapMirror data transfers and SnapMirror scheduler are enabled. The command snapmirror on and snapmirror off has the same effect as this option. See na_snapmirror(1) for more details.

snapmirror.log.enable
Determines whether SnapMirror activity is logged to the SnapMirror log file. The setting does not affect syslog output from SnapMirror. Valid values for this option are on or off. The default value for this option is on. When on, all the SnapMirror activities will be logged in /etc/log/snapmirror. See na_snapmirror(5) for more details.

snapvault.access
Restricts/allows client and server access to snapvault from a different filer. The default value is "none" For valid values, see na_protocolaccess(8).

snapvault.enable
Enable or disable snapvault operation. Valid values for this option are on or off. The default value for this option is off.

snapvault.lockvault_log_volume
Configures the LockVault Log Volume. Valid values for this option are online SnapLock volume names. See na_snapvault(1) for details.

snmp.access
Restricts SNMP access to the filer. For valid values, see na_protocolaccess(8).

snmp.enable
Enables the SNMP server on the filer. Valid values for this option are on or off. The default value for this option is on.

ssh.access
Restricts ssh access to the filer. For valid values, see na_protocolaccess(8).

ssh.enable
Enables or disables the SSH 2.0 protocol on the filer. Valid values for this option are on or off. The default value for this option is off.

ssh.idle.timeout
Timeout value for ssh sessions in seconds. The default value for this option is 600 seconds.

ssh.passwd_auth.enable
Enables or disables the password authentication on the ssh server. Valid values for this option are on or off. The default value for this option is on.

ssh.pubkey_auth.enable
Enables or disables the public key authentication on the ssh server. Valid values for this option are on or off. The default value for this option is on.

ssh1.enable
Enables or disables the SSH 1.x protocol on the filer. Valid values for this option are on or off. The default value for this option is off.

ssh2.enable
Enables or disables the SSH 2.0 protocol on the filer. Valid values for this option are on or off. The default value for this option is off. This option is equivalent to the ssh.enable option.

tape.persistent_reservations
Enables the use of SCSI persistent reservations for fibre channel attached tape drives and medium changers. This option applies to all fibre channel attached tape drives and medium changers and cannot be enabled or disabled on an individual device basis. Persistent reservations provide a method for a device to only accept commands from one initiator. In an environment with multiple initiators using the same device, persistent reservations prevent the initiators from accessing the device at the same time.

Some tape drives and medium changers do not implement SCSI persistent reservations correctly. This option is disabled by default to prevent problems from occurring with these devices.

Enabling this option may cause problems if tape drives or medium changers do not work properly. If tape commands report the device is reserved when no other initiators are using the device, this option should be disabled.

Valid values for this option are on or off. The default value for this option is off.

telnet.access
Restricts telnet access to the filer. For valid values, see na_protocolaccess(8). If this value is set, trusted.hosts is ignored for telnet.

telnet.enable
Enables the Telnet server on the filer. Valid values for this option are on or off. The default value for this option is on.

telnet.distinct.enable
Enables making the telnet and console separate user environments. If it is off, then telnet and console share a session. The two sessions view each other's inputs/outputs and both acquire the privileges of the last user to login. (If this option is toggled during a telnet session, then it goes into effect on the next telnet login.) Valid values for this option are on or off. The default value for this option is off.

telnet.hosts
Deprecated option, use trusted.hosts instead.

tftpd.enable
Enables the tftp (Trivial File Transfer Protocol) server on the filer. Valid values for this option are on or off. The default value for this option is off. When enabled, the filer's tftp server allows get requests, but does not allow put requests.

tftpd.logging
Enables console logging of accesses for files via tftp. Valid values for this option are on or off. The default value for this option is off.

tftpd.rootdir
Specifies the tftpd rootdir. All relative accesses to files via tftp are considered relative to this directory. All absolute accesses via tftp can only access a file if it lies in the filesystem tree rooted at this directory. A valid value for this option is the fully qualified pathname to a valid, existing directory on any volume on the filer. The default value of this option is /etc/tftpboot.

timed.enable
If on and a remote protocol ("ntp" or "rdate") is specified the time daemon (timed) synchronizes to an external source. If off, time is synchronized to the internal Real-Time Clock chip, just as it would with the protocol set to "rtc." Valid values for this option are on or off. The default value for this option is on.

Cluster considerations: Regardless of the setting of this option, we always attempt to keep the time on the two nodes synchronized. One node plays the role of "time master" and the other node plays the role of "time slave." The determination of time master and time slave is automatic and can not be controlled by the administrator. The time slave always attempts to synchronize with the time master using the sntp protocol over the cluster interconnect. If that attempt fails, this option determines whether the time slave will then try to synchronize with a time source or sources specified by timed.proto and timed.servers.

timed.log
Specifies whether time changes initiated by timed should be logged to the console.

Cluster considerations: Specifies whether time changes initiated by the time slave should be logged to the console.

timed.max_skew
Specifies the maximum amount of skew between the time reported by the time server and the filer's time that we will allow when synchronizing the time. If the difference in the time reported by the server and the filer's time is greater than this value, the filer will not synchronize to the time reported by the time server. The maximum skew is specified in seconds (suffix s), minutes (suffix m), or hours (suffix h). Defaults to "30m".

Cluster considerations: Specifies the maximum amount of skew between the time reported by the time master and the time slave's time.

timed.min_skew
Specifies the minimum amount of skew between the time reported by the time server and the filer's time that you allow when synchronizing the time. If the difference in the time reported by the server and the filer's time is less than this value, the filer will not synchronize to the time reported by the time server. The minimum skew is specified in milliseconds. Defaults to "10" (10 milliseconds). This option only applies when timed.proto is set to "sntp" or "rtc".

Cluster considerations: Specifies the minimum amount of skew between the time reported by the time master and the time slave's time.

timed.proto
Specifies the protocol used to synchronize time. Valid values for this option are rdate, sntp or rtc. rdate specifies the rdate (RFC 868) protocol. sntp specifies the Simple Network Time Protocol (RFC 2030). rtc specifies the internal Real-Time Clock chip. The default value for this option is rtc.

Note that ntp is the displayed value for the sntp setting, and can also be used as a valid alias for sntp in this option.

Cluster considerations: The time slave always uses the sntp protocol when synchronizing to the time master.

timed.sched
Specifies the timed synchronization schedule. There are several pre-defined schedules:

hourly
synchronize every hour (the default)

multihourly
synchronize every 6 hours

daily
synchronize every day at midnight.

Custom schedules may also be specified by giving the number of minutes or hours between time synchronization. Minutes are specified by digits followed by an "m"; hours are specified by digits followed by an "h". For example, options timed.sched 2h will cause time to be synchronized every two hours.

To avoid overburdening the time server, the filer randomly selects the exact time of the synchronization within a window specified by timed.window.

After timed.sched is set, timed.window is capped at ten percent of timed.sched.

Cluster considerations: specifies the time synchronization schedule for the time slave.

timed.servers
Specifies up to five time servers used by the time daemon. Time servers are contacted in the order specified; if a server can't be contacted, the time daemon tries the next one in the list. The default value for this option is the null string.

Cluster considerations: the time slave always attempts to synchronize with the time master. If that attempt fails and timed.proto is rdate or sntp, this option specifies the time servers used by the time slave.

timed.window
Specifies a window around the synchronization time set by timed.sched. The actual synchronization time is randomly chosen from within this window. timed.window is specified in seconds (suffix s) or minutes (suffix m). The value may be 0, but it may not exceed ten percent of timed.sched. timed.window defaults to "0s".

Cluster considerations: Specifies a window around the synchronization time set by timed.sched for the time slave.

trusted.hosts
Specifies up to 5 clients that will be allowed telnet, rsh, and administrative HTTP (i.e. FilerView) access to the server. The host names should be entered as a comma-separated list with no spaces in between. Enter a "*" to allow access to all clients; this is the default. Enter a "-" to disable access to the server. NOTE: this option used to be called telnet.hosts, and in fact that is still an alias for this option. This value is ignored for telnet if telnet.access is set, and is ignored for administrative HTTP if httpd.admin.access is set. See na_protocolaccess(8) for more details.

vol.copy.throttle
Specifies the default speed of all volume copy operations. The speed can be a number in the range from 1 to 10, with 10 being the highest speed and the default. When a vol copy operation is started, its throttle is set to this value. See na_vol(1) for more details on the vol copy command.

wafl.default_nt_user
Specifies the NT user account to use when a UNIX user accesses a file with NT security (has an ACL), and that UNIX user would not otherwise be mapped. If this option is set to the null string, such accesses will be denied. The default value for this option is the null string.

wafl.default_security_style
Specifies the default security style assigned to a new volume. All qtrees created on the volume get this as their security style. Legal values for this option are `unix', `ntfs', or `mixed'. The default value for this option is `unix', unless the filer is an NTFS-only filer, in which case the default is `ntfs'.

wafl.default_unix_user
Specifies the UNIX user account to use when an authenticated NT user did not match an entry in the usermap.cfg file. If this option is set to the null string, NT users which are not matched in the usermap.cfg file will not be allowed to log in. The default value for this option is `pcuser'.

wafl.nt_admin_priv_map_to_root
When on (the default), an NT administrator is mapped to UNIX root.

wafl.root_only_chown
When enabled, only the root user can change the owner of a file. When disabled, non-root users can change the owner of files that they own. When a non-root user changes the owner of a file they own, both the set-UID and set-GID bits of that file are cleared for security reasons. A non-root user is not allowed to give away a file if it would make the recipient overrun its user quota. wafl.root_only_chown is enabled by default.

wafl.wcc_minutes_valid
Specifies the number of minutes a WAFL credential cache entry is valid. The value can range from 1 through 20160. The default is 20.

webdav.enable
Enables WebDAV access to the filer. Valid values for this option are on or off. The default value for this option is off.

   options nfs.tcp.enable on nfs.v2.df_2gb_lim on raid.timeout 48

Turns on the logging for all CIFS login related activities.

options cifs

Prints all the options that start with cifs .

However, a few options must have the same setting for both filers in a cluster for takeover to work properly. If you change the setting for one of these options on one filer, the filer displays a message reminding you to make the same change on the other filer. In takeover mode, the same option values are used for both filers.

The following list of options must have the same value on both filers in a cluster:

  snmp.enable
  telnet.enable
  trusted.hosts

  timed.enable
  timed.log
  timed.max_skew
  timed.min_skew
  timed.proto
  timed.sched
  timed.servers
  timed.window

The following list of options are overwritten by the live filer's values during takeover:

  auditlog.enable
  auditlog.max_file_size
  autologout.telnet.enable
  autologout.telnet.timeout
  dns.domainname
  dns.enable
  httpd.log.format
  httpd.timeout
  httpd.timewait.enable
  ip.match_any_ifaddr
  ip.path_mtu_discovery.enable
  nfs.per_client_stats.enable
  nfs.v2.df_2gb_lim
  nfs.v3.enable
  nis.domainname
  nis.enable
  nis.group_update.enable
  nis.group_update_schedule
  nis.servers
  nis.slave.enable
  pcnfsd.enable
  raid.default_raidtype
  raid.disk.copy.auto.enable
  raid.media_scrub.enable
  raid.media_scrub.deadline
  raid.reconstruct.perf_impact
  raid.reconstruct.wafliron
  raid.resync.perf_impact
  raid.rpm.ata.enable
  raid.rpm.fcal.enable
  raid.timeout
  raid.verify.perf_impact
  rmc.setup
  vol.copy.throttle
  wafl.root_only_chown
  wafl.wcc_minutes_valid

  cifs.audit.enable
  cifs.audit.file_access_events.enable
  cifs.audit.logon_events.enable
  cifs.audit.logsize
  cifs.audit.saveas
  cifs.bypass_traverse_checking
  cifs.comment
  cifs.guest_account
  cifs.home_dir_namestyle
  cifs.homedirs_public_for_admin
  cifs.idle_timeout
  cifs.max_mpx
  cifs.netbios_aliases
  cifs.netbios_over_tcp.enable
  cifs.nfs_root_ignore_acl
  cifs.oplocks.enable
  cifs.oplocks.opendelta
  cifs.perm_check_ro_del_ok
  cifs.perm_check_use_gid
  cifs.restrict_anonymous.enable
  cifs.save_case
  cifs.scopeid
  cifs.search_domains
  cifs.show_snapshot
  cifs.shutdown_msg_level
  cifs.sidcache.enable
  cifs.sidcache.lifetime
  cifs.snapshot_file_folding.enable
  cifs.symlinks.cycleguard
  cifs.symlinks.enable
  cifs.trace_login
  cifs.universal_nested_groups.enable
  dns.domainname
  dns.enable
  nfs.mount_rootonly
  nfs.per_client_stats.enable
  nfs.require_valid_mapped_uid
  nfs.tcp.enable
  nfs.udp.xfersize
  nfs.v2.df_2gb_lim
  nfs.v3.enable
  nfs.webnfs.enable
  nfs.webnfs.rootdir
  nfs.webnfs.rootdir.set
  nis.domainname
  nis.enable
  nis.group_update.enable
  nis.group_update_schedule
  nis.servers
  nis.slave.enable
  pcnfsd.enable
  pcnfsd.umask
  rsh.access
  rsh.enable
  security.passwd.rules.enable
  wafl.default_nt_user
  wafl.default_unix_user
  wafl.nt_admin_priv_map_to_root
  wafl.wcc_max_entries
  wafl.wcc_minutes_valid