SRM: Permissions needed to monitor NetApp Filers and gather data

This article contains the list of permissions needed for Storage Resource Monitor to monitor and gather data for NetApp Filers. NetApp calls individual permissions to execute API calls or "capabilities." Any user being used for monitoring has to be assigned a role with all the required API capabilities.

Supported Firmware:
7.x, 8.x, 9.x

Required API capacities 

The following API capabilities are required for 7-Mode, versions 7.x and later:

• api-aggr-list-info
• api-cifs-share-list-iter-end
• api-cifs-share-list-iter-next
• api-cifs-share-list-iter-start
• api-diagnosis-status-get
• api-disk-list-info
• api-fcp-adapter-list-info
• api-fcp-node-get-name
• api-iscsi-node-get-name
• api-license-list-info
• api-license-v2-list-info
• api-lun-list-info
• api-lun-map-list-info
• api-lun-get-occupied-size
• api-nfs-exportfs-list-rules
• api-nfs-exportfs-list-rules-2
• api-options-list-info
• api-perf-object-get-instances
• api-quota-report
• api-quota-report-iter-end
• api-quota-report-iter-next
• api-quota-report-iter-start
• api-snapshot-list-info
• api-system-get-info
• api-system-get-version
• api-vfiler-get-status
• api-vfiler-list-info
• api-volume-list-info
• login-http-admin
• api-perf-object-get-instances-iter-end
• api-perf-object-get-instances-iter-next
• api-perf-object-get-instances-iter-start
• perf-object-counter-list-info
• security-api-vfiler

The following additional API capabilities are required for versions 8.x:

• api-nfs-exportfs-list-rules-2
• api-license-v2-list-info
• api-diagnosis-status-get

Steps in details

1. Log into the NetApp CLI and use the following procedure to create a read-only user with sufficient privileges for monitoring the device in SRM.

2. Creating the group:

You can use an existing group, or create a new group using the following command: 

useradmin group add [group_name]

For example:

lan-netappv82> useradmin group add srmgroup

Group added.

lan-netappv82> Tue Dec 9 22:37:52 GMT [lan-netappv82:useradmin.added.deleted:info]: 

The group 'srmgroup' has been added.

3. Creating a monitoring user:

You can use an existing user or create a new one. The user will be read-only and used for monitoring. You can create a new user using the following command: 

useradmin user add [user_name] -g [group_name]

For example: 

lan-netappv82> useradmin user add srmuser -g srmgroup

New password:

Retype new password:

User added.

lan-netappv82> Tue Dec 9 22:38:27 GMT [lan-netappv82:useradmin.added.deleted:info]: The user 'srmuser' has been added.

4. Creating a role and assigning it all required API capabilities:

The set of capabilities is version specific. If you do not know the version of your device, just type "version" to display it. Use following commands to:

1. Create a new role and assign it all capabilities: 

useradmin role add [rolename] -a [list_of_capabilities]

For example, for versions 7.3.x: 

useradmin role add srmrole -a api-aggr-list-info,api-cifs-share-list-iter-end,api-cifs-share-list-iter-next,api-cifs-share-list-iter-start,api-disk-list-info,api-fcp-adapter-list-info,api-iscsi-node-get-name,api-license-list-info,api-lun-list-info,api-lun-map-list-info,api-lun-get-occupied-size,api-nfs-exportfs-list-rules,api-options-list-info,api-perf-object-get-instances,api-quota-report,api-quota-report-iter-end,api-quota-report-iter-next,api-quota-report-iter-start,api-snapshot-list-info,api-system-get-info,api-system-get-version,api-vfiler-get-status,api-vfiler-list-info,api-volume-list-info,login-http-admin,api-perf-object-get-instances-iter-end,api-perf-object-get-instances-iter-next,api-perf-object-get-instances-iter-start,security-api-vfiler

Role will be created successfully.

For example, for versions 8.x or later: 

useradmin role add srmrole -a api-aggr-list-info,api-cifs-share-list-iter-end,api-cifs-share-list-iter-next,api-cifs-share-list-iter-start,api-diagnosis-status-get,api-disk-list-info,api-fcp-adapter-list-info,api-iscsi-node-get-name,api-license-list-info,api-license-v2-list-info,api-lun-list-info,api-lun-map-list-info,api-lun-get-occupied-size,api-nfs-exportfs-list-rules,api-nfs-exportfs-list-rules-2,api-options-list-info,api-perf-object-get-instances,api-quota-report,api-quota-report-iter-end,api-quota-report-iter-next,api-quota-report-iter-start,api-snapshot-list-info,api-system-get-info,api-system-get-version,api-vfiler-list-info,api-vfiler-get-status,api-volume-list-info,login-http-admin,api-perf-object-get-instances-iter-end,api-perf-object-get-instances-iter-next,api-perf-object-get-instances-iter-start,security-api-vfiler

Role will be created successfully.

2. To modify an existing role and add a new capability use the following command: 

useradmin role modify [role] -a [capability_to_add]

For example: 

useradmin role modify srmrole -a api-diagnosis-status-get

Role modified.

Note: Invalid capabilities
If you mistype a capability name or a specific API that is not supported by that version of ONTAP, an error is displayed when you try to create the role. For example, if you run:

useradmin role add srmrole -a api-aggr-list-info, api-cifs-share-list, api-perf-object-get-instances

and your version of ONTAP does not support api-cifs-share-list, then you will encounter an error that states:

api-cifs-share-list Could not add role [roletest]. Error: Invalid capability

To resolve this error, remove the invalid capability api-cifs-share-list and re-run the command to create the role. 

useradmin role add srmrole -a api-aggr-list-info, api-perf-object-get-instances

5. Assign the created role to an existing group using the following command:

useradmin group modify [group_name] -r [role_name]
useradmin group modify srmgroup -r srmrole
Group modified.
lan-netappv82> Tue Dec 9 22:39:51 GMT [lan-netappv82:useradmin.added.deleted:info]: The group 'srmgroup' has been modified.

You can check the list of allowed capabilites running:

useradmin group list [group_name]

For example:

useradmin group list srmgroup

Name: srmgroup

Info:

Rid: 131073

Roles: srmrole

Allowed Capabilities: api-aggr-list-info,api-cifs-share-list-iter-end,api-cifs-share-list-iter-next,api-cifs-share-list-iter-start,api-disk-list-info,api-fcp-adapter-list-info,api-iscsi-node-get-name,api-license-list-info,api-license-v2-list-info,api-lun-list-info,api-lun-map-list-info,api-lun-get-occupied-size,api-nfs-exportfs-list-rules,api-options-list-info,api-perf-object-get-instances,api-quota-report,api-quota-report-iter-end,api-quota-report-iter-next,api-quota-report-iter-start,api-system-get-info,api-system-get-version,api-vfiler-list-info,api-volume-list-info,login-http-admin,api-perf-object-get-instances-iter-end,api-perf-object-get-instances-iter-next,api-perf-object-get-instances-iter-start,security-api-vfiler

Known fixed issues on NetApp permissions

NetApp (vendor) changed units from mili seconds to micor seconds, so if you upgraded ONTAP from version 9.5 or earlier to version 9.7 or later, you must modify your role to support the new unit of LUN latency. 

1. Log into the NetApp CLI.

2. Enter this command in the following pattern:

useradmin role modify [role] -a [capability_to_add]

For example:

useradmin role modify srmrole -a perf-object-counter-list-info