Sun Storage 7410 Unified Storage System
 
Sun Storage 7310 Unified Storage System
 
Sun ZFS Storage 7120
 
Sun Storage 7110 Unified Storage System
 
Sun ZFS Storage 7320
 
Sun ZFS Storage 7420
 
Sun Storage 7210 Unified Storage System
 

PLA-Support>Sun Systems>DISK>ZFS Storage>SN-DK: 7xxx NAS
 
_Old GCS Categories>Sun Microsystems>Storage - Disk>Unified Storage
 

In this Document

Symptoms

Cause

Solution

References

Created from <SR 3-3740498461>

Applies to:

Symptoms

Files or directories written by Windows clients appear inaccessible to NFSv4 clients. When the access from the client fails, a message similar to this is displayed:

Cause

This issue is caused by an unresolvable entry in the ACL. The UNIX naming service on the appliance cannot resolve the ACL entry to a user name, and therefore access to read the ACL is denied by rule.
By far the most common cause of this is the "SYSTEM" group on the Windows system. This entry will be added to an ACL created by Windows when there is no inheritance set for the parent directory.

Solution

For affected files and directories, the only solution is to remove the unresolvable ACL entry. This is most easily done from a Windows client for obvious reasons.
If the unresolvable user is not the Windows SYSTEM group but is instead a normal Windows user or group, then resolve this by simply adding a mapping to a known UNIX user with the identity mapping utility.

Internal note:  To verify this issue, run ls -V (or -Vd for a directory) on the file at the system shell.

"group:214783648" is the mapping for the SYSTEM group. It is possible that the issue could be seen with another account. Verify the state of the mapping with this command:

In this case, because it's a hard-coded mapping, it is not possible to map it to a UNIX user, so the only resolution is to delete the entry. Given the above file.ext example, the command chmod A1- file.ext would remove the entry for the SYSTEM group.

It is important to note that the chmod command should not be used, especially recursively to a large dataset, unless the Support Engineer is very comfortable with the chmod syntax and knows exactly what the result of the command will be. Also explicit permission from the customer should be gained before doing this. Proceed with extreme caution as customer data is being modified at this point. As this is a Solaris shell operation, the customer should not be asked to do this.

To prevent the SYSTEM entry from being added to ACLs, it is generally sufficient to ensure that the system software is updated to at least 2010.08.17.4.0. This version added a feature that assumes that file and directory inheritance should be enabled for files and directories which exactly match a traditional UNIX permission set, such as 755.

If the SYSTEM entry was added while running with a previous version of the system software, manually remove the entry or rewrite the permissions from a Windows client.

Back to <Document 1428753.1> Sun Storage 7000 Unified Storage System: How to Troubleshoot Identity Mapping and cross-platform file sharing issues.

References

This solution has no attachment