teejay Posted July 1, 2009 Posted July 1, 2009 Now you're making me jealous It's been around 12 months hard work developing the philisophy and plan for moving forward and selling it to Teachers, SLT and Governors. Just in absolute shock at the moment that everything has finally been agreed and signed off, defo pint or two tonight:drunken_smilie:
Soulfish Posted July 1, 2009 Posted July 1, 2009 It's been around 12 months hard work developing the philisophy and plan for moving forward and selling it to Teachers, SLT and Governors. Just in absolute shock at the moment that everything has finally been agreed and signed off, defo pint or two tonight:drunken_smilie: Currently working on a similar plan for us. Here's hoping I eventually get my plans approved!
sev9756 Posted July 2, 2009 Posted July 2, 2009 Hi, I just got my nice shiny new Storage 7110 delivered last Friday but I'm having some trouble getting it bound to our AD. I've applied the latest update 2009.04.10.3.0,1-1.16 but I'm still having problems. Basically our organisation has two active directory forests. The first is our primary live domain and the 7110 doesn't even acknowledge it's existence - when i try to join it I get the error: "The specified domain controller could not be contacted, or the domain is invalid for the controller." That domain is pretty non-standard though - The realm name is the same as our DNS root, but the DNS root is not handled by AD - the DNS is handled by BIND with only the necessary AD zones (_ldap._tcp etc) being delegated to the AD DC's... I was more hopeful with our test/development domain - this is more of a standard AD setup - Windows server 2008 and the DNS root for this domain is fully delegated to the AD DC's. However I still get the error: "The specified domain controller could not be contacted, or the domain is invalid for the controller." After reading some advice on Sun forums I tried dropping the LAN Manager compatibility level from 4 to 2. This had no effect on our live domain but on our test/development domain I now get a different error: "The attempt to join the Active Directory domain failed either because the clocks of the appliance and the domain controller are skewed or the administrative user does not have the appropriate permissions to create a computer account in Active Directory. It is recommended that NTP be used to keep clocks synchronized when using Active Directory." The clocks are within seconds of each other so clock skew isn't the problem and I have full domain admin rights in the test/devel AD so permissions shouldn't be an issue. Looking in the eventvwr of the DC I occasionally see NETLOGON errors when I'm attempting these joins of: "The session setup from the computer XXXX-YYYY failed to authenticate. The name(s ) of the account(s) referenced in the security database is XXXX-YYYY$. The foll owing error occurred: Access is denied." The 7110 is setup to use the AD DC as it's DNS server and it's NTP server. I'm kind of stuck as to what to try next. Can anyone help? Cheers Alan.
teejay Posted July 2, 2009 Posted July 2, 2009 I think its the format you are using for your ad username that may be causing the problem, try using username@domain format.
Butuz Posted July 2, 2009 Posted July 2, 2009 It's been around 12 months hard work developing the philisophy and plan for moving forward and selling it to Teachers, SLT and Governors. Just in absolute shock at the moment that everything has finally been agreed and signed off, defo pint or two tonight:drunken_smilie: Know exactly how you feel mate! Last two years we have only had £5k per year to spend on IT so to finally get the go ahead from SMT/Govenors to order the 7110s and Fire servers was like a breath of fresh air! Butuz
Duke Posted July 2, 2009 Posted July 2, 2009 Yay, just had our full server infrastructure replacement project approved. Means we are getting a 22TB 7310 with 1x read and 2x write accelerators, plus some Dell servers which will attach to our existing 7110's for the virtualisation project. Those SSD flash accelerators really fly! It's really cool to get the disk hierarchy graphs up and highlight each disk individually, you can then see usage on the SSD followed by a flush to the disks every 30-odd seconds. If you read Brendan Gregg's blog on Sun he reckons you'd need HDD's spinning at 100K RPM or faster to compete with the SSDs. Chris
teejay Posted July 2, 2009 Posted July 2, 2009 Those SSD flash accelerators really fly! It's really cool to get the disk hierarchy graphs up and highlight each disk individually, you can then see usage on the SSD followed by a flush to the disks every 30-odd seconds. If you read Brendan Gregg's blog on Sun he reckons you'd need HDD's spinning at 100K RPM or faster to compete with the SSDs. Chris Yeah, can't wait. Must admit the 7110's have done a great job for CIFS shares, but they are too small and with the current changes taking place in our curricullum and delivery strategy we wanted something with massive storage and performance.
sev9756 Posted July 2, 2009 Posted July 2, 2009 I think its the format you are using for your ad username that may be causing the problem, try using username@domain format. Nope that's not it - if I try username@realm all i get is the "could not find domain controller" error. Looking in the 7110 logs - for our 2008 AD I get: 2009-7-2 11:47:44 smbd[667] error smbd: failed joining (UNSUCCESSFUL) and for our primary 2003 AD: 2009-7-2 11:52:19 smbd[667] error smbd: failed locating domain controller for
Ric_ Posted July 2, 2009 Author Posted July 2, 2009 @sev9756: Have you completed the DC information within the CIFS services page first? You may also need to restart that service.
sev9756 Posted July 2, 2009 Posted July 2, 2009 @sev9756: Have you completed the DC information within the CIFS services page first? You may also need to restart that service. Yep tried that Ric - I've entered the name of our DC with the PDC emulator role into the CIFS service and restarted it (indeed I've bounced the entire box!) Still no joy I'm afraid.... Cheers Alan.
sjl Posted July 2, 2009 Posted July 2, 2009 I’ve managed to get our 7110 and 2 SunFire x4140’s up and running today with VMWARE ESXi 4 - it was pretty painless (with a few expletives – but i blame the heat). I’ve been happy as Larry moving VMs about from one ESX host to the other and messing about with snapshots – all good stuff! Has anyone used a snapshot to restore a SIMS server after a botched upgrade say? I suppose it would be a bit dodgy with SQL would it not – and it’s not like SIMS upgrades often go wrong sev9756: I had a problem at first joining the 7110 to our domain and i think what solved it was using the FQDN of our DC.
Hebdenlad Posted July 6, 2009 Posted July 6, 2009 Hi, I just got my nice shiny new Storage 7110 delivered last Friday but I'm having some trouble getting it bound to our AD. I've applied the latest update 2009.04.10.3.0,1-1.16 but I'm still having problems. Basically our organisation has two active directory forests. The first is our primary live domain and the 7110 doesn't even acknowledge it's existence - when i try to join it I get the error: "The specified domain controller could not be contacted, or the domain is invalid for the controller." That domain is pretty non-standard though - The realm name is the same as our DNS root, but the DNS root is not handled by AD - the DNS is handled by BIND with only the necessary AD zones (_ldap._tcp etc) being delegated to the AD DC's... I was more hopeful with our test/development domain - this is more of a standard AD setup - Windows server 2008 and the DNS root for this domain is fully delegated to the AD DC's. However I still get the error: "The specified domain controller could not be contacted, or the domain is invalid for the controller." After reading some advice on Sun forums I tried dropping the LAN Manager compatibility level from 4 to 2. This had no effect on our live domain but on our test/development domain I now get a different error: "The attempt to join the Active Directory domain failed either because the clocks of the appliance and the domain controller are skewed or the administrative user does not have the appropriate permissions to create a computer account in Active Directory. It is recommended that NTP be used to keep clocks synchronized when using Active Directory." The clocks are within seconds of each other so clock skew isn't the problem and I have full domain admin rights in the test/devel AD so permissions shouldn't be an issue. Looking in the eventvwr of the DC I occasionally see NETLOGON errors when I'm attempting these joins of: "The session setup from the computer XXXX-YYYY failed to authenticate. The name(s ) of the account(s) referenced in the security database is XXXX-YYYY$. The foll owing error occurred: Access is denied." The 7110 is setup to use the AD DC as it's DNS server and it's NTP server. I'm kind of stuck as to what to try next. Can anyone help? Cheers Alan. There were some early issues around cross-forest and AD. Update your appliance to the latest firmware version and this should be fixed. Cheers, Phil
cookie_monster Posted July 7, 2009 Posted July 7, 2009 If you have iSCSI/NFS traffic on a seperat IP range to your normal traffic and your servers and SAN are all plugged into the same switch is it still necessary to VLAN the ports as well?
sjl Posted July 7, 2009 Posted July 7, 2009 Are you not using a separate switch for your NFS/iSCSI traffic to the SAN? If they were on the same switch I would of thought using VLANs would be best if only for security. Also if they are on separate VLANs they are in different broadcast domains so you don’t get all the chatter from your other network.
cookie_monster Posted July 7, 2009 Posted July 7, 2009 We have a dedicated switch for these servers and the iSCSI and SAN connections, they won't have the entire switch to themselves though. I probably will VLAN them I was just wondering if it was completly necessary.
Butuz Posted July 7, 2009 Posted July 7, 2009 Yes better to seperate them with vlans. If you just reply on subnetting and you make a mistake with the subnet masks you could potentially reveal all your storage by accident to the rest of the network. Butuz
cookie_monster Posted July 8, 2009 Posted July 8, 2009 Is the ILOM the same accross the range? I've just downoaded V3.0 of the ILOM and installed it on my X4150 but I can't seem to find a version for the 7110 can the same image be used or does it have a specific version?
Ric_ Posted July 8, 2009 Author Posted July 8, 2009 @cookie_monster: IIRC the 7110 is a X4150 chasis. The ILOM (Service Processor in Sun speak) is fully flashed out the box... just SSH or navigate to the web page.
Butuz Posted July 8, 2009 Posted July 8, 2009 X4240 AMD type chassis - the 4150 is 1u and Xeon. Butuz
Duke Posted July 8, 2009 Posted July 8, 2009 Hey all, got a couple of S7000 questions I'm hoping someone might be able to shed some light on... First the simple one - Has anyone had any issues with Firefox 3.5 and the S7000 BUI? I'm on the previous firmware release rather than the very latest one and I get in-BUI errors that are handled by the interface (box drops down from the top of the screen). It doesn't hang the BUI but is worrying as I've also had one with IE8. I can replicate it with FF3.5 so I know it's not a one-off, does anyone know if the latest release fixes these or do I need to file a bug report? Second is the complicated one - We have two domains here (thanks, Capita!) and I need users on the admin domain to be able to access CIFS shares on the S7000, even though the box itself is joined to the curriculum domain. If I try to add permissions on the share or root-level ACL on the S7000 as [email protected] it tells me it's an unknown or invalid user. Our Windows servers allow us to add a group from a different domain to a folder ACL, anyone know how can I do this on the Sun box? Many thanks in advance, Chris
Ric_ Posted July 8, 2009 Author Posted July 8, 2009 @Duke: 1. I've noticed the error boxes you mentioned in IE8. Sun say that IE8 isn't a supported browser so I thought it was something to do with that. 2. I assume you have a trust in place between your domains. Could you not create a user group on the curriculum domain containing users from the admin domain?
sev9756 Posted July 8, 2009 Posted July 8, 2009 Hi Phil, There were some early issues around cross-forest and AD. Update your appliance to the latest firmware version and this should be fixed. Cheers, Phil Tried that but still no joy - appliance is now running Version 2009.04.10.3.0,1-1.16 but still running into the same problems. I've got a support case open with Sun at the moment about this. I'll PM you the case number if you want to take a look at it. Cheers Alan.
cgorms Posted July 8, 2009 Posted July 8, 2009 Hi, I am new to all this but I recently purchased a X4150 and am very happy with the build quality and performance. I have been reading through this thread and I am wanting to purchase a couple of 7110's to consolidate all my data from various servers. 1. I currently run DFS with the data coming from 2 servers, am I able to still run DFS with the data being held on the 7110's? 2. Which protocol is best suited to DFS - NFS or iSCSI - performance will play a part in this? 3. I am also considering moving my SIMS Database, etc onto the 7110 and having a cluster setup at the front end for fault tolerance is this viable? 4. As I said before I use DFS this obviously kept my data replicated a cross servers, is it still okay to do that with the 7110 or are you able to use the built in replication to do this better? Sorry for all the questions I might have more, but any help would be greatly appreciated. Craig
Duke Posted July 8, 2009 Posted July 8, 2009 (edited) @Duke: 1. I've noticed the error boxes you mentioned in IE8. Sun say that IE8 isn't a supported browser so I thought it was something to do with that. 2. I assume you have a trust in place between your domains. Could you not create a user group on the curriculum domain containing users from the admin domain? 1) Oddly IE8 is actually working better for me than FF3.5 right now! In Firefox, if I go to a shares page then the access page then mouseover the 'ACL Behaviour' area I get: Exception type: Error Native message: Permission denied to access property 'akl_list' from a non-chrome context Mapped file: https://hostname:215/lib/ak/akList.js line 1581 Mapped stack trace: /lib/ak/akList.js:1581 @akListReferenceFromObject([object SystemOnlyWrapper]) /lib/ak/akList.js:2170 @(1,[object MouseEvent]) /lib/ak/akList.js:2179 @([object MouseEvent]) /lib/ak/akSubr.js:86 @([object MouseEvent]) I'll upgrade to the latest release later and test it. EDIT: Bug still exists with the latest release and FF3.5. I know they might not officially support it yet, but everyone's going to be upgrading from FF3 to FF3.5 pretty quickly. Anyone know how to file a bug report with Sun's storage/hardware team? 2) Well I certainly though so... I can add admin groups and users to an ACL on a curriculum server with no problem (admindomain\username) so I assume there is some trust between the domains, but if I try to make a group in the curriculum AD and add an admin user it can't find it or see that domain, so perhaps not? Cheers, Chris Edited July 8, 2009 by Duke
Duke Posted July 9, 2009 Posted July 9, 2009 UPDATE: The latest firmware release doesn't provide a solution to the FF3.5 bugs or the two-domain issue, but I do have a workaround for the latter if it affects anyone else: We have full trust between our two domains, but the S7000 still won't see user accounts or groups on Domain B if it's joined to Domain A. As Ric_ points out, the most obvious solution would be to create a group in Domain A and add users from Domain B to it. However, this doesn't appear to be possible, at least not for us and other people I found online. What you can do however is add a group from one domain to a group on another domain, so the solution is to create a group in Domain A called Domain B Users and give Domain B's admin account control of it. Then go onto Domain B, pick a group that contains all your Domain B users, to go 'Member Of' and select Domain B Users from Domain A. You can now go onto the S7000 and add Domain B Users@Domain A from the same domain that the SAN is on, and it will apply the permissions to the users on Domain B. Anyone know about submitting bugs to Sun regarding the FF3.5 issues? Cheers, Chris
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now