How to configure Dell EMC Unity device as a File System Archiving (FSA) target for Enterprise Vault

Enterprise Vault supports Dell EMC Unity VSA as a file system archiving target. This document describes how to prepare and add a Unity device for File System Archiving.

Preparing a Unity device for FSA

Using Dell EMC Unity Unisphere VSA

1. Log on to Dell EMC Unity Unisphere VSA.
2. Add a Unity account for Enterprise Vault to use for authentication on the Unity device.
   1. Click Update System Settings.
   2. On the left-hand pane, click Users and Groups.
   3. Select User Management. Click the '+' icon to add a new user.
   4. In the Create User or Group dialog box, select Local User, and click Next.
      
   5. Enter the details of the new Unity account, and click Next.
      
   6. Select Storage Administrator and click Next.
      
   7. Click Finish, and then click Close.
   8. Click Close to close the Settings dialog box.
3. Enable Distributed Hierarchical Storage Management (DHSM) for the NAS server that will be used as the FSA target.
   1. On the left-hand pane, click Storage > File, and then click the NAS Servers tab.
   2. Select the NAS server and edit the properties.
   3. In the properties window, click the Protection and Events tab.
   4. In the left-hand pane, click DHSM.
   5. Select the Enable DHSM check box.
   6. Enter the details of the Unity Storage Administrator account created in the earlier step.
   7. Clear the Enforce HTTP Secure checkbox. HTTPS is not supported.
   8. Click Apply to complete this step.
   9. Click Close to close the properties dialog box.
      
4. Edit the properties of all the file systems that corresponding to the NAS server that you want to archive from.
   1. Select a File system and edit the properties.
   2. Click the Advanced tab.
   3. Select the Sync Writes Enabled, Oplocks Enabled, Notify On Write Enabled ,and Notify On Access Enabled check boxes.
      
   4. Click Apply to save the settings.
   5. Click Close to close the properties dialog box.
5. In the left-hand pane, click System > Service, and click the Service Tasks tab. Make sure that SSH is enabled.
6. Connect to EMC Unity using SSH (use Management IP and username should be service account name)
7. Configure a DHSM connection to use for recall requests.
   1. Run the following command:
      uemcli -u Local/admin -p <Unity_Admin_Account_Password> /net/nas/dhsmconn create  -fs <fs_id> -secondaryUrl http://<EV_Server_FQDN>/EnterpriseVault -mode enabled -readPolicy full -secondaryUsername <User>@<Domain> -secondaryPassword <Password>
      
      For example,
      uemcli -u Local/admin -p p4ssw0rd /net/nas/dhsmconn create  -fs fs_1 -secondaryUrl http://evserver.example.local/EnterpriseVault -mode enabled -readPolicy full -secondaryUsername vsa@example.local -secondaryPassword p@ssw0rd
      
      Where:

      - p4ssw0rd is the password of the Unity administrator account.

      - fs_1 is the ID of file system attached to the NAS server. To get the ID of the file system use the following as the URL in a web browser: https://<Unity_IP_Or_FQDN>/api/types/filesystem/instances?fields=id,name. The output will contain the list of file systems along with their name and IDs. Look for the ID for your file system.

      - http://evserver.example.local/EnterpriseVault is the URL of Enterprise Vault Web Access application.

      - vsa@example.local is the Vault Service account that will have access to all the archives from which files are restored.

      - p@ssw0rdd is the password to the Vault Service account.

   2. On the remote certificate prompt, choose Accept and store.
8. Verify that the settings are correctly applied using the following command:

   uemcli -u Local/admin -p <Unity_Admin_Password> /net/nas/dhsmconn -fs <fs_id> show
   
   For example:
   uemcli -u Local/admin -p Admin123# /net/nas/dhsmconn -fs fs_1 show
   
   The following is an example output:
   Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection
1: ID = DHSMConnection_1
File system = fs_1
Secondary url = http://evserver.example.local/EnterpriseVault
Secondary port = 80
Secondary username = vsa@example.local
Local port =

9. Add the Vault Service account as a member of the Administrators group of the Dell EMC Unity server:
   1. In Windows, start Computer Management.
   2. In the Computer Management console, select Action > Connect to another computer. Enter the name of the NAS server.
   3. Add the Vault Service account to the Administrators group.

Using SSH

1. Connect to EMC Unity using SSH (use Management IP and username should be service account name)
2. Add a Unity account for Enterprise Vault to use for authentication on the Unity device, using this command:
   uemcli -u Local/admin -p <Unity_Admin_Password> /user/account create -name <Account_Name> -type local -passwdSecure -role storageadmin
   
   Example:
   uemcli -u Local/admin -p p4ssw0rd /user/account create -name unityaccount -type local -passwdSecure -role storageadmin
   
   Where:

   - p4ssw0rd is the password of the Administrator account on Unity.
   - unityaccount is the name of the local Storage Administrator account.
   local is the type of the user account. The new Unity account must be a local user.
   -passwdSecure Prompts you to specify the password and confirm the password when the command runs.
   storageadmin is the role for the new account. The new Unity account must be assigned to the Storage Administrator role.

   The following is an example output:

   Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection
[Secure] For local users, type the user password.
Password:
Confirm password:
ID = user_unityaccount
Operation completed successfully.
    
3. Enable Distributed Hierarchical Storage Management (DHSM) for a NAS server.
   1. Get the ID of the file system by using the following as the URL in a web browser: https://<Unity_IP_Or_FQDN>/api/types/filesystem/instances?fields=id,name. The output will contain the list of file systems along with their name and IDs. Look for the ID for your file system.
   2. Enable DHSM on the NAS server, using following command:
      uemcli -u Local/admin -p <Unity_Admin_Password> /net/nas/dhsm -server <NAS_id> set -state Enabled -username <Storage_Admin_User> -passwdSecure -enableHTTPS no
      
      For example:
      uemcli -u Local/admin -p p4ssw0rd /net/nas/dhsm -server nas_1 set -state Enabled -username unityaccount -passwdSecure -enableHTTPS no
      
      Where:
      - p4ssw0rd is the password of the Administrator account on Unity.
      - nas_1 is the ID of the associated NAS server.
      - unityaccount is the name of the local Storage Administrator account.
      local is the type of the user account. The new Unity account must be a local user.
      -passwdSecure Prompts you to specify the password and confirm the password when the command runs.
      
      The following is an example output:

      Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection
[Secure] The advanced storage access password.
Password:
Confirm password:
Operation completed successfully.

   3. Verify that DHSM is configured correctly, by using the following command:
      uemcli -u Local/admin -p <Unity_Admin_Password> /net/nas/dhsm -server <NAS_id> show
      
      For example:
      uemcli -u Local/admin -p Admin123# /net/nas/dhsm -server nas_1 show
      The following is an example output:
      Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection
1: NAS server = nas_1
State = Enabled
4. Configure a DHSM connection to use for recall requests.
   1. Run the following command:
      uemcli -u Local/admin -p <Unity_Admin_Account_Password> /net/nas/dhsmconn create  -fs <fs_id> -secondaryUrl http://<EV_Server_FQDN>/EnterpriseVault -mode enabled -readPolicy full -secondaryUsername <User>@<Domain> -secondaryPassword <Password>
      
      For example,
      uemcli -u Local/admin -p p4ssw0rd /net/nas/dhsmconn create  -fs fs_1 -secondaryUrl http://evserver.example.local/EnterpriseVault -mode enabled -readPolicy full -secondaryUsername vsa@example.local -secondaryPassword p@ssw0rd
      
      Where:

      - p4ssw0rd is the password of the Unity administrator account.

      - fs_1 is the ID of file system attached to the NAS server. To get the ID of the file system use the following as the URL in a web browser: https://<Unity_IP_Or_FQDN>/api/types/filesystem/instances?fields=id,name. The output will contain the list of file systems along with their name and IDs. Look for the ID for your file system.

      - http://evserver.example.local/EnterpriseVault is the URL of Enterprise Vault Web Access application.

      - vsa@example.local is the Vault Service account that will have access to all the archives from which files are restored.

      - p@ssw0rdd is the password to the Vault Service account.

   2. On the remote certificate prompt, choose Accept and store.
5. Verify that the settings are correctly applied using the following command:

   uemcli -u Local/admin -p <Unity_Admin_Password> /net/nas/dhsmconn -fs <fs_id> show
   
   For example:
   uemcli -u Local/admin -p Admin123# /net/nas/dhsmconn -fs fs_1 show
   
   The following is an example output:
   Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection
1: ID = DHSMConnection_1
File system = fs_1
Secondary url = http://evserver.example.local/EnterpriseVault
Secondary port = 80
Secondary username = vsa@example.local
Local port =

6. Edit the properties of all the file systems that corresponding to the NAS server that you want to archive from, using the following command:

   uemcli -u Local/admin -p <Unity_Admin_Password> /stor/prov/fs -name <File_System_Name> set -cifsOpLocks yes -cifsNotifyOnWrite yes -cifsNotifyOnAccess yes -cifsSyncWrites yes

   For example:
   uemcli -u Local/admin -p Admin123# /stor/prov/fs -name TESTFS set -cifsOpLocks yes -cifsNotifyOnWrite yes -cifsNotifyOnAccess yes -cifsSyncWrites yes

   The following is an example output:
   Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection
ID = res_1
Operation completed successfully.
    

Configuring Unity pass-through behavior for placeholder shortcuts

You can use the Dell EMC Unity read policy with placeholder recalls, if required. The Unity -readPolicy parameter determines how a read request is handled for a file in secondary storage. For example, you can opt to pass a file directly through to the client without recalling it to the Unity device. Unity then recalls the file only if a write request is received.

For pass-through, Unity uses the same cache on the Enterprise Vault server that you set up for Enterprise Vault to use when retrieving files for the Unity device.

Note:     If you configure Unity pass-through, do not configure the Enterprise Vault option to delete archived files on placeholder deletion, as this combination can lead to data loss.

To configure the Unity pass-through behavior, include the -readPolicy parameter in one of the following commands:

• The dhsmconn create command to define the DHSM connection that the Unity device uses for recall requests. This method sets the pass-through behavior for all the placeholders that are created through the connection.
• The dhsmconn modify command to configure a Unity device. This method sets the pass-through behavior for all the placeholders on the file system.

The syntax of the -readPolicy parameter is as follows:
-readPolicy [full | passthrough | partial | none]

The effect of the values is as follows:
•    full. Recall the whole file to Unity on read request before the data is returned.
•    passthrough. Retrieve the data without recalling the data to Unity.
•    partial. Retrieve only the blocks that are required to satisfy the client read request.
•    none (the default value). The setting has no effect.

For example, the following command syntax configures pass-through for a file system:
uemcli -u Local/admin -p Admin@123 /net/nas/dhsmconn -id <DHSMConnection_ID> modify -readPolicy passthrough
Where <DHSMConnection_ID> is the DHSM connection identifier of the file system on Unity.

Adding the Unity device as an archiving target

After you have prepared the Unity device for FSA, you can use the New File Server wizard or the New-EVFSAFileServer PowerShell cmdlet to add the Unity device as an archiving target.

Note:     If you want to use FSA Reporting with Unity, you can configure FSA Reporting when you add the device as an archiving target.

To add a Unity device as an archiving target, follow these steps:

1. In the Administration Console, expand the Enterprise Vault site until the Targets container is visible.
2. Expand the Targets container.
3. Right-click the File Servers container and, on the shortcut menu, click New and then File Server. The New File Server wizard starts.
4. Work through the wizard to finish adding the file server:
   1. On the first page of the wizard, click Next.
   2. On the second page, enter the fully qualified domain name of the Unity device. Do not select the option to install the FSA Agent. Then click Next.
   3. On the third page, choose whether to use placeholder shortcuts.
      If you are using placeholder shortcuts, enter the details of the account you configured on Unity that has permission to use DHSM, and the Unity port number on which the Data Mover services are configured. Clear the Celerra device is connected on HTTPS checkbox. HTTPS is not supported.
      You can change these details later if required, by editing the target file server properties.
      Click Next to continue.
   4. On the summary page, click Next to add the Unity device.
   5. On the final page, click Finish to exit from the wizard.

Before you add target volumes for the Unity device, ensure that the Enterprise Vault server that archives from the Unity has its cache location configured.

Troubleshooting

• Enterprise Vault FSA Placeholder recall fails intermittently on Dell EMC Unity file servers. For more information, see https://www.veritas.com/docs/100043978.
• Enterprise Vault FSA placeholder shortcuts created on Dell EMC Unity file servers get recalled automatically. For more information, see https://www.veritas.com/docs/100045259.

Known issues

The Deployment Scanner fails to check whether the Vault Service account belongs to the local Administrators group on the Unity device. The 'File Server Permissions' check fails with the following message:
The user domainName\EVAdminUser is not a member of the local Administrators group on file server: FQDN. The user domainName\EVAdminUser should have full control to the files & shares you wish to archive.
You can ignore this error message.