Apsara File Storage NAS:FAQ about advanced management features

• Lifecycle management

  • When can I enable the lifecycle management feature?

  • Why am I unable to enable the lifecycle management feature for my file system?

  • How do I configure lifecycle policies?

  • Which files can be dumped to the IA storage medium?

  • What happens if I configure multiple lifecycle policies for a single directory?

  • What happens if I configure two different lifecycle policies for a directory and its subdirectory?

  • Is a lifecycle policy valid for all data in the specified directory?

  • How long does a file that matches a lifecycle policy require to be dumped to the IA storage medium?

  • What happens if I rename a directory for which a lifecycle policy is configured?

  • What happens if a lifecycle policy is deleted?

  • Are the files in a directory repeatedly dumped to the IA storage medium if I delete the existing lifecycle policy and then reconfigure a lifecycle policy for the directory?

  • Are the files in the IA storage medium accessible?

  • Which files in my file system are stored in the IA storage medium?

  • Is the latency when I read data from and write data to a file in the IA storage medium longer than the latency when I read data from and write data to a file in a Performance NAS or Capacity NAS file system?

  • How am I charged if my files are dumped to the IA storage medium?

  • Can cold data that is dumped to the IA storage medium be automatically converted to hot data after the cold data is accessed?

  • How do I create a data retrieval task to retrieve files from the IA storage medium?

  • Is the read or write performance of a file system affected when a data retrieval task is running?

  • Am I charged for a data retrieval task?

  • How am I charged when I back up files that are stored in the IA storage medium?

  • How am I charged when I use a security service to scan files in the IA storage medium?

• Access permissions

  • Why do I need to use RAM to grant the required permissions when I create a mount target in the classic network?

  • How do I obtain an AccessKey pair?

  • Why am I unable to view a file system after I log on to the NAS console as a RAM user that has full access permissions on the file system?

  • What do I do if the time that is used to grant permissions on an SMB mount directory to a new user in a Windows AD domain is longer than expected?

  • How do I verify the correctness of a keytab file?

• Data encryption

  • How can I use the server-side encryption feature of NAS?

  • Can I enable the server-side encryption feature for an existing file system?

  • Can I disable the server-side encryption feature on a file system for which this feature is enabled?

  • Can I change the key that is used to encrypt a file system?

  • Which data encryption method do I need to select, NAS-managed keys or custom keys?

  • If a CMK that is applied to a NAS file system is accidentally disabled or deleted, how can I resume access to the data of the NAS file system?

  • After I enable the server-side encryption feature, do I need to use an application to decrypt data each time I access the data?

  • Is the performance of a file system affected after the server-side encryption feature is enabled for the file system?

  • Is the available storage capacity of a file system reduced if I enable server-side encryption at rest for the file system?

• Recycle bin

  • Are deleted files temporarily stored in a recycle bin?

  • Can I restore a file from a recycle bin to the original directory of the file system if the directory is renamed?

  • Which way is faster, restoring files from the recycle bin or restoring files from a backup of the files?

  • Am I charged when I use the recycle bin feature?

  • How do I query files in the recycle bin?

  • Can I read data from or write data to the files in the recycle bin?

  • Does the deleted General-purpose NAS files in the recycle bin occupy the file quantity or storage space of a NAS file system?

• File backup and restoration

  • Does NAS support the inotify subsystem?

  • If I cancel a file backup job, are the backup files of the job still retained?

  • If I cancel a restore job, are the restored files of the job retained after the restore job is canceled?

  • How is the free-trial period for backing up NAS files calculated?

• Monitoring

  Why did an error occur when I called a CloudMonitor API operation to query the monitoring data of a NAS file system?

When can I enable the lifecycle management feature?

If the files in a General-purpose NAS file system are accessed less than twice a month, we recommend that you enable the lifecycle management feature. After you enable the feature, the files that meet a specified lifecycle policy are automatically dumped to the Infrequent Access (IA) storage medium. This helps reduce storage costs.

Why am I unable to enable the lifecycle management feature for my file system?

If your General-purpose NAS file system was created before June 1, 2020, you cannot enable the lifecycle management feature or configure lifecycle policies for the file system. The lifecycle management feature is unavailable for file systems for which the data encryption feature is enabled.

How do I configure lifecycle policies?

To configure lifecycle policies, you can use the NAS console or OpenAPI Explorer. For more information, see Manage a lifecycle policy and CreateLifecyclePolicy.

Which files can be dumped to the IA storage medium?

What happens if I configure multiple lifecycle policies for a single directory?

If the files in the directory meet a rule in one of the lifecycle policies, the files are dumped to the IA storage medium.

What happens if I configure two different lifecycle policies for a directory and its subdirectory?

The files in the subdirectory are dumped to the IA storage medium based on both policies.

For example, a policy whose atime threshold is 60 days is configured for a directory and a policy whose atime threshold is 14 days is configured for the subdirectory. In this case, the files in the subdirectory that are not accessed in the previous 14 days are dumped to the IA storage medium. The files in the IA storage medium are skipped when the lifecycle management feature checks for infrequently accessed files based on the policy of the parent directory.

Is a lifecycle policy valid for all data in the specified directory?

Yes, if the file data in the directory meets the lifecycle policy, the data is automatically dumped to the IA storage medium.

How long does a file that matches a lifecycle policy require to be dumped to the IA storage medium?

If the lifecycle management feature is enabled, a file that meets a specified lifecycle policy is dumped to the IA storage medium in 2 to 24 hours. The time that is required to dump the file to the IA storage medium varies based on the storage usage of the file system and the size of the file. Subsequent file dumps are performed at a specific point in time every week.

What happens if I rename a directory for which a lifecycle policy is configured?

If you rename a directory for which you configure a lifecycle policy, the policy no longer takes effect on the files in the directory. The files that are dumped to the IA storage medium remain in the IA storage medium.

If you configure a lifecycle policy for the renamed directory, the files in the directory that meet the policy are dumped to the IA storage medium.

What happens if a lifecycle policy is deleted?

The files in the directory for which the policy is configured are no longer dumped to the IA storage medium. The files that are dumped to the IA storage medium remain in the IA storage medium.

Are the files in a directory repeatedly dumped to the IA storage medium if I delete the existing lifecycle policy and then reconfigure a lifecycle policy for the directory?

No, after you reconfigure a lifecycle policy, the lifecycle management feature checks for files that meet the policy. The files in the IA storage medium are skipped during the check. This prevents repeated file dumps.

Are the files in the IA storage medium accessible?

Yes, you can read data from and write data to the files in the IA storage medium the same way you read data from and write data to other files in a file system.

Which files in my file system are stored in the IA storage medium?

You can query the files that are stored in the IA storage medium in the NAS console or by calling API operations. For more information, see Manage the files in the IA storage medium and ListDirectoriesAndFiles.

Is the latency when I read data from and write data to a file in the IA storage medium longer than the latency when I read data from and write data to a file in a Performance NAS or Capacity NAS file system?

It depends. The latency when you read data from a file in the IA storage medium for the first time may be longer than the latency when you read from a file in a Performance NAS or Capacity NAS file system. After the file is read, the latency when you read data from the file is almost the same as the latency when you read data from a file in a Performance NAS or Capacity NAS file system.

The latency when you write data to a file in the IA storage medium is almost the same as the latency when you write data to a file in a Performance NAS or Capacity NAS file system.

How am I charged if my files are dumped to the IA storage medium?

If your files are dumped to the IA storage medium, you are charged based on the billing method of the IA storage medium. For more information, see Billing of General-purpose NAS file systems.

Can cold data that is dumped to the IA storage medium be automatically converted to hot data after the cold data is accessed?

No, after cold data is dumped to the IA storage medium, the cold data is stored in the IA storage medium. If you access cold data in the IA storage medium, you are charged for the read and write traffic of the cold data. For more information, see Billing of General-purpose NAS file systems.

If you need to frequently access data in the IA storage medium, we recommend that you create a data retrieval task to retrieve specific files or data in a directory to a General-purpose NAS file system. If you run the data retrieval task to read the required data, you are charged for the read traffic. For more information, see Manage the files in the IA storage medium.

How do I create a data retrieval task to retrieve files from the IA storage medium?

You can create a data retrieval task in the NAS console or by using OpenAPI Explorer. For more information, see Manage the files in the IA storage medium or CreateLifecycleRetrieveJob.

Is the read or write performance of a file system affected when a data retrieval task is running?

No, the read or write performance of a file system is not affected. You can read or write data as expected when a data retrieval task is running.

Am I charged for a data retrieval task?

Yes, you are charged for a data retrieval task. When you run a data retrieval task, the system reads data from the specified file. You are charged for reading the file from the IA storage medium based on the size of the file. If a data retrieval task is successful, the file is moved to the related General-purpose NAS file system and occupies storage space. In this case, you are charged for the storage space based on the size of the file. For more information, see Billing of General-purpose NAS file systems.

How am I charged when I back up files that are stored in the IA storage medium?

If you use Hybrid Backup Recovery (HBR) to back up files that are stored in the IA storage medium of a General-purpose NAS file system, you are charged for using HBR resources. For more information, see Billable items and billing methods.

During the backup process, HBR reads data from the files. Therefore, you are also charged for the traffic that is generated when HBR accesses the IA storage medium. For more information, see Billing of General-purpose NAS file systems.

How am I charged when I use a security service to scan files in the IA storage medium?

When a security service such as the anti-ransomware service of Security Center scans files in the IA storage medium of a General-purpose NAS file system, the security service reads data from the files. You are charged for the traffic that is generated when you access the IA storage medium. The traffic fees are included into your NAS bills. For more information, see Billing of General-purpose NAS file systems.

Why do I need to use RAM to grant the required permissions when I create a mount target in the classic network?

Why am I unable to view a file system after I log on to the NAS console as a RAM user that has full access permissions on the file system?

• Issue

  After you log on to the NAS console as a RAM user that has full access permissions on a file system, an error message appears when you go to the File System List page.

• Cause

  The permissions on tags are not granted to the RAM user. You must configure the permissions of tag:ListTagKeys.

• Solution

  Use a custom policy to grant the RAM user the permissions on the tags of the file system that you want to access. For more information, see Perform access control based on RAM policies.

  {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "nas:*",
              "Resource": "acs:nas:*:*:filesystem/0ddaf487b2"
          },
          {
              "Effect": "Allow",
              "Action": "nas:CreateMountTarget",
              "Resource": "acs:vpc:*:*:vswitch/*"
          },
          {
              "Effect": "Allow",
              "Action": "cms:Describe*",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "nas:DescribeFileSystems",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "tag:ListTagKeys",
              "Resource": "*"
          }
      ],
      "Version": "1"
  }

What do I do if the time that is used to grant permissions on an SMB mount directory to a new user in a Windows AD domain is longer than expected?

When you grant permissions on an SMB mount directory to a new user, Windows traverses all files in the SMB mount directory, and then grants the required permissions. This issue may occur due to network latency. To resolve the issue, run a command to grant permissions on multiple files at a time. For example, run the iacls or Set-Acl command. The Set-Acl command is available only in PowerShell. For more information, see icacls or Set-Acl.

How do I verify the correctness of a keytab file?

Before verification, you must regenerate a keytab file and enable the -mapuser parameter.

ktpass -princ cifs/file-system-id.region.nas.aliyuncs.com@EXAMPLE.com -ptype KRB5_NT_PRINCIPAL -mapuser alinas@example.com -crypto All -out c:\nas-mount-target.keytab -pass tHeP****d123

Procedure

1. Log on to a client where the kinit tool is installed.

   Note

   The client must be able to access the AD domain or to configure the DNS as an AD domain server.

2. Add the following content to the /etc/krb5.conf file:

    [realms]
    EXAMPLE.COM = {
        kdc = iZisovkei9i*****.example.com
        admin_server = iZisovkei9i****.example.com
    }
   [domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

   In the preceding content, iZisovkei9i*****.example is an AD domain server. Replace it with the actual value.

   Note

   If your client runs CentOS, you must also configure the following content:

       default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
       default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
       permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

3. Run the following command to verify that the client can connect to the AD domain server:

   kinit aliyun.nas@example.com

   If the command output contains the account information, the Kerberos configuration of the client is correct.

4. Optional. Run the following command to verify that the mount target in the keytab file is the mount target of your file system:

   klist -k -t <keytab file name>.keytab

5. Run the following command to verify the keytab file:

   kinit -k -t <keytab file name>.keytab cifs/file-system-id.region.nas.aliyuncs.com@EXAMPLE.COM

   In the preceding command, file-system-id.region.nas.aliyuncs.com is the mount target of the file system. Replace it with the actual value. EXAMPLE.COM is the name of the AD domain. Replace it with the actual uppercase name.

   If no error occurs, the keytab file is correct.

How do I obtain an AccessKey pair?

1. Log on to the Alibaba Cloud Management Console by using your Alibaba Cloud account.
2. Move the pointer over the profile picture in the upper-right corner of the page that appears and click AccessKey Management.
3. In the Note dialog box, click Use Current AccessKey Pair or Use AccessKey Pair of RAM User.
   
   • Obtain the AccessKey pair of the Alibaba Cloud account
     1. Click Use Current AccessKey Pair.
     2. On the AccessKey Pair page, click Create AccessKey.
     3. In the View Secret dialog box, view the AccessKey ID and AccessKey secret. You can click Download CSV File to download the AccessKey pair or click Copy to copy the AccessKey pair.
   • Obtain the AccessKey pair of a RAM user
     1. Click Use AccessKey Pair of RAM User. Then, you are redirected to the Users page of the RAM console.
     2. On the Users page of the RAM console, find the RAM user whose AccessKey pair you want to obtain.
        Note If you do not have a RAM user, create one first. For more information, see Create a RAM user.
     3. Click the name of the RAM user in the User Logon Name/Display Name column.
     4. In the User AccessKeys section of the Authentication tab, click Create AccessKey.
     5. In the View Secret dialog box, view the AccessKey ID and AccessKey secret. You can click Download CSV File to download the AccessKey pair or click Copy to copy the AccessKey pair.
        Note

        • An AccessKey secret is displayed only after you click Create AccessKey. You cannot query the AccessKey secret in subsequent operations. Therefore, you must back up your AccessKey secret.
        • If your AccessKey pair is leaked or lost, you must create another AccessKey pair. You can create a maximum of two AccessKey pairs for each RAM user.

How can I use the server-side encryption feature of NAS?

When you create a file system, you can set the Encryption Type parameter to NAS-managed Key or User-managed Key (KMS) based on your business requirements. For more information, see Create a General-purpose NAS file system in the NAS console and Create an Extreme NAS file system in the NAS console.

Can I enable the server-side encryption feature for an existing file system?

No, you can enable the server-side encryption feature only when you create a file system.

Can I disable the server-side encryption feature on a file system for which this feature is enabled?

No, the server-side encryption feature takes effect immediately after it is enabled. You cannot disable the feature.

Can I change the key that is used to encrypt a file system?

No, when you create a file system, a key is specified to encrypt the file system. The key cannot be changed.

Which data encryption method do I need to select, NAS-managed keys or custom keys?

Both data encryption methods use Key Management Service (KMS) to host keys and use envelope encryption to prevent unauthorized data access.

If a CMK that is applied to a NAS file system is accidentally disabled or deleted, how can I resume access to the data of the NAS file system?

• If you disable a customer master key (CMK), re-enable the CMK.

• If you have scheduled a task to delete a key, cancel the scheduled task. For more information, see Schedule a key deletion task.

• If the key material of a BYOK key is deleted, re-upload the original key material. For more information, see Import key material.

• If a CMK is deleted, the CMK cannot be restored. In this case, the data of the related file system cannot be accessed.

After I enable the server-side encryption feature, do I need to use an application to decrypt data each time I access the data?

No, you do not need to use an application to decrypt data after you enable the server-side encryption feature. Data is automatically encrypted and decrypted by NAS. You do not need to perform these operations by using an application.

Is the performance of a file system affected after the server-side encryption feature is enabled for the file system?

Yes, the performance of the file system is affected. After the server-side encryption feature is enabled for a file system, NAS encrypts data that is written to the file system. When you read data from the file system, the data is automatically decrypted. The read and write performance of a file system is affected by the size of the data block that is accessed during each read or write operation. For example, you have two file systems of the same type and specifications. The performance of the file system for which the server-side encryption feature is enabled decreases by 5% to 25% compared with the performance of the other file system. For more information, see FAQ about the performance of NAS file systems.

Is the available storage capacity of a file system reduced if I enable server-side encryption at rest for the file system?

No, the available storage capacity of the file system is not reduced. The Advanced Encryption Standard (AES) is a block cipher that uses the automatic padding mechanism. Data that is encrypted at rest with automatic padding does not occupy the available storage capacity of the file system.

Does NAS support the inotify subsystem?

No, NAS does not support the inotify subsystem. The inotifywait and rsync commands are commonly used together to back up and synchronize data in real time. However, the inotifywait command cannot be run as expected on NAS file systems due to the implementation of the inotify subsystem.

• How inotifywait works

  The inotifywait command is a user-mode interface of the Linux inotify subsystem that is implemented at the Virtual File System (VFS) layer. After you run the inotifywait command, file changes are monitored at the VFS layer. If a file is created, deleted, or modified, the name of the file and the type of the operation are returned to the user-mode inotifywait process. Then, the inotifywait command returns the information about the operation.

• Known issues

  The inotify subsystem is implemented at the VFS layer of the kernel. Therefore, the inotifywait process on a Network File System (NFS) client of an NFS file system cannot detect the operations that other clients perform on the file system. For example, a NAS file system is mounted on Client A and Client B at the same time. On Client A, when you start an inotifywait process to listen to the mount directory, the following issues may occur:

  • The inotifywait process can detect the operations that Client A performs on the files of the file system.

  • The inotifywait process cannot detect the operations that Client B performs on the files of the file system.

• Alternative solution

  You can use the Family Assets Management (FAM) subsystem as an alternative solution to resolve the issues. The FAM subsystem is a repository that is used to listen to files or directories. FAM is implemented in user mode. An FAM daemon scans the directories in a file system on schedule to detect file changes. However, the FAM subsystem has the following drawbacks:

  • You must write code to call the required FAM operation on your client.

  • If you want to monitor a large number of files, the performance of the FAM subsystem may be compromised. A large number of resources may be consumed and the timeliness of file monitoring cannot be ensured.

If I cancel a file backup job, are the backup files of the job still retained?

No, if you cancel an ongoing backup job, all the backup files of the job are deleted from the backup vault. If you still need to back up these files, create another backup job.

Backup files in completed backup jobs are not affected.

If I cancel a restore job, are the restored files of the job retained after the restore job is canceled?

Yes, if you cancel a restore job, the restored files of the job are still stored in a specified directory. Other files of the job are no longer restored.

How is the free-trial period for backing up NAS files calculated?

You can use the backup feature free of charge for 30 days, starting from the day on which you create the first backup plan for a NAS file system.

For example, if you created a backup plan named backup01 for File System A on May 1, 2021, you can use the backup feature free of charge until May 30, 2021. After the free-trial period expires, you can delete the backup plan. If you want to continue using the backup plan, you must pay for the plan. For more information, see Billing methods and billable items.

Are deleted files temporarily stored in a recycle bin?

Can I restore a file from a recycle bin to the original directory of the file system if the directory is renamed?

Yes, you can restore a file from a recycle bin to its original directory regardless of whether the directory is renamed. This is because a restore job is performed based on the FileId of the original directory. For example, after the recycle bin feature is enabled, you delete the file1.txt file from the dir1 directory and change the directory name from dir1 to dir2. In the recycle bin of the NAS console, the directory tree indicates that the file1.txt file resides in the dir2 directory. After you restore the file from the recycle bin, the directory tree indicates that the file1.txt file is stored in the dir2 directory on the compute node.

Which way is faster, restoring files from the recycle bin or restoring files from a backup of the files?

When you restore files from the recycle bin, NAS migrates only the metadata of the files but not copy the files. Therefore, restoring files from the recycle bin is faster than restoring files from a backup of the files.

Am I charged when I use the recycle bin feature?

No, you are not charged when you use the recycle bin feature. However, you are charged for the used storage space of the temporary files in the recycle bin based on the pricing of the original storage type. For example, after you delete a file from a Capacity NAS file system, you are charged for the file based on the unit price of storage in Capacity NAS. After you delete a file from the IA storage medium, you are charged for the file based on the unit price of storage in the IA storage medium. For more information, see Billing of General-purpose NAS file systems. Before you delete a file from a Capacity NAS file system, you are charged for the file based on the storage unit price of Capacity NAS.

How do I query files in the recycle bin?

You can use the NAS console to query the files that are temporarily stored in the recycle bin and the time at which the files are deleted. For more information, see the "Query files in the recycle bin" operation described in the "What to do next" section in Recycle bin.

Can I read data from or write data to the files in the recycle bin?

No, you cannot read data from or write data to the files or directories in the recycle bin. You can only query deleted files and directories. If you enable the recycle bin feature, deleted files are temporarily retained in the recycle bin. Before you can read data from or write data to the files in the recycle bin, you must restore the files from the recycle bin. For more information, see Recycle bin.

Does the deleted General-purpose NAS files in the recycle bin occupy the file quantity or storage space of a NAS file system?

No, the file quantity of a NAS file system does not include the number of deleted files that are temporarily stored in the recycle bin. The deleted files do not occupy the storage space of the file system either. For more information about the storage capacity and file quantity supported by each NAS file system, see Limits.

Why did an error occur when I called a CloudMonitor API operation to query the monitoring data of a NAS file system?