Purpose	Character encoding is the mapping between binary numbers and written characters. Some character-encoding schemes use only a single byte for each character; these typically support alphabets without any Asian characters. Multi-byte encoding schemes encompass Asian character sets. Unicode (such as UTF-8) can also use more than one byte per character, and encompasses most character sets and languages. Use the character-encoding command to set the namespaces character encoding for NFS file names. Use no character-encoding to reset NFS file names back to the single-byte default.
Modes	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	character-encoding nfs {utf8 | shift-jis | cp932 | euc-jp | ksc5601 | iso88591} no character-encoding nfs   utf-8 specifies UTF-8 (Unicode) character encoding. shift-jis specifies Shift_JIS (Japanese) character encoding. cp932 is Code Page 932, or Windows-31J (Japanese) character encoding. This is the Microsoft version of Shift_JIS. euc-jp specifies EUC-JP (Extended Unix Code - Japanese) character encoding. ksc5601 is KSC5601 (Korean) character encoding. iso-8859-1 is ISO 8859-1 (Latin1, single-byte) character encoding.
Default(s)	ISO 8859-1 (Latin1)
Guidelines	NFS character encoding determines the character encoding for file names. Any NFS server and client must be set for the same NFS character encoding to communicate properly. The NFS character encoding should be well-established at any site before the ARX is installed. CIFS uses Unicode, which can support any character set, so it does not require this command. A multi-protocol (NFS and CIFS) namespace does not allow a CIFS client to name a file or directory with characters that are not supported by NFS character encoding. If NFS names support only single-byte characters, the namespace enforces the same restriction on CIFS names. During the initial import of multi-protocol shares, the volume uses the NFS-side name of each file (possibly a filer-generated name), and renames each directory so that it is valid in NFS. (You can use no import rename-directories to prevent directory renames on import.) We recommend UTF-8 character encoding for multi-protocol namespaces and the filers behind them. The no form of the command returns the namespace to default character encoding. If a single front-end nfs service has exports from more than one namespace, this setting must be the same for all of the exported namespaces. The export (gbl-nfs) command exports a namespace volume through NFS.
Sample	bstnA(gbl-ns[wwmed])# no character-encoding nfs resets the character encoding for NFS file names to the default.
Related Commands	namespace

Purpose	Some scanners and photocopiers have a Save As feature that allows the client to save a copy of a scanned file onto a remote CIFS server. Many scanners and copiers make queries to the CIFS servers hidden IPC$ share before they save the file. These devices make their queries as the anonymous Windows-user account. To allow anonymous queries to the current namespaces IPC$ share, use the cifs anonymous-access command. Use no cifs anonymous-access in a namespace that does not support connections to the IPC$ share.
Modes	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	cifs anonymous-access no cifs anonymous-access
Default(s)	no cifs anonymous-access
Guidelines	This command does not apply to an NFS-only namespace. There are only a small set of photocopiers that require this access before they save files to the namespace. The F5 Data Solutions Compatibility Matrix (included with this doc set) lists all the photocopiers that are known to require this feature. The cifs anonymous-access command permits anonymous queries to the virtual IPC$ share, but does not permit scanners and photocopiers to actually save files to any of the namespaces volumes. As always, the scanner/copier must provide a valid Windows username and password to perform the file-save operation. Certain CIFS-client operating systems, such as Mac OS X v10.4, also require anonymous access to make certain queries. If a single front-end cifs service has exports from more than one namespace, this setting must be the same for all of the exported namespaces. (The export (gbl-cifs) command exports a namespace volume through CIFS.) Therefore, if this command makes the current namespace inconsistent with the other namespace(s) behind the same CIFS service, the CLI prompts with an opportunity to make the same change in the other namespace(s). Enter yes to allow the CLI to propagate the change to the other namespace(s).
Samples	provA(gbl-ns[provMed])# cifs anonymous-access allows certain scanners and copiers to perform anonymous queries in the provMed namespace. This is a necessary first step to supporting the Save As feature from those scanners.   bstnA(gbl-ns[insur])# no cifs anonymous-access Synchronize conflicting parameter(s) for all the namespaces exported along with this namespace in a service and continue? [yes/no] yes denies any anonymous access to the IPC$ share in the insur namespace. Scanners and copiers cannot save files to volumes in this namespace. The CLI also disables this option in all other namespaces behind the same CIFS service.
Related Commands	namespace

Purpose	Use the cifs authentication command to enable an authentication protocol (Kerberos, NTLM, and/or NTLMv2) for the namespaces CIFS clients. Use no cifs authentication to disable a CIFS-authentication protocol for this namespace.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	cifs authentication {kerberos | ntlm | ntlmv2} no cifs authentication {kerberos | ntlm | ntlmv2}
Default(s)	all CIFS-authentication protocols are disabled by default
Guidelines	This applies only to namespaces that support CIFS. You can run this command once for each supported protocol. A namespace can support all three authentication protocols, or any combination of them. Each CIFS client negotiates an authentication protocol from this set. The protocol is chosen during the client-side negotiation. CIFS clients access namespace storage through a front-end CIFS service. If a single CIFS service has exports from more than one namespace, the authentication settings must be the same for all of the exported namespaces. (The export (gbl-cifs) command exports a namespace volume through CIFS.) Therefore, if this command makes the current namespace inconsistent with the other namespace(s) behind the same CIFS service, the CLI prompts with an opportunity to make the same change in the other namespace(s). Enter yes to allow the CLI to propagate the change to the other namespace(s).
Guidelines: Kerberos	The namespaces front-end CIFS service must join a Windows domain to support Kerberos authentication. Use the domain-join command to enable Kerberos for a front-end cifs service.
Guidelines: NTLM and NTLMv2	The domain-join command can also enable a CIFS service for NTLM or NTLMv2. If you (or an authorized Domain Administrator) go to the domain controller (DC) and set up constrained delegation for the CIFS service, clients can authenticate with NTLM, NTLMv2, or Kerberos. No further configuration is required. In this case, the namespace software connects to its back-end filers with Kerberos, whether or not the client uses a variant of NTLM.
Guidelines: Secure Agent	A CIFS service that is configured for unconstrained delegation, or is not even joined to its domain, requires more configuration to support NTLM or NTLMv2. For these configurations, you must install an application onto one or more DCs. This DC application, called the Secure Agent, enables the namespace to authenticate a client once and then access storage on multiple back-end filers. See the ARX Secure Agent Installation Guide for instructions on installing a Secure Agent onto a DC. Then you can use ntlm-auth-server and ntlm-auth-server (gbl-ns) to connect the namespace software to the Secure Agent application. For the namespace to support NTLMv2 as well as NTLM, you must have a version of the Secure Agent software that also supports NTLMv2. This command issues a prompt to inform you of the minimal version required. If the namespace is configured for both NTLM and NTLMv2, it prefers NTLMv2 in its connections with back-end servers. This is true even for client connections where the client connects through NTLM.
Samples	bstnA(gbl-ns[ns1])# cifs authentication kerberos bstnA(gbl-ns[ns1])# cifs authentication ntlmv2   % INFO: To use NTLMv2 with the Acopia Secure Agent, all agent instances must support NTLMv2 (requires agent version 5.1.0 or later). enables Kerberos and NTLMv2 for clients of the ns1 namespace.   bstnA(gbl-ns[insur])# no cifs authentication ntlm Synchronize conflicting parameter(s) for all the namespaces exported along with this namespace in a service and continue? [yes/no] yes disables NTLM for clients of the insur namespace.
Related Commands	namespace domain-join ntlm-auth-server

Purpose	Use the cifs filer-signatures command to enable (or perhaps require) SMB signing between this namespace and the external filers behind it. SMB signing is the process of placing a digital signature into each Server Message Block (SMB) exchanged between a CIFS server (each filer) and client (the namespace software). SMB signing prevents man-in-the-middle attacks at the cost of slower performance. Use no cifs filer-signatures to disable SMB signing between the namespace and its filers. This breaks all CIFS communication with any filers that require SMB signing.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	cifs filer-signatures [required] no cifs filer-signatures   required (optional) obligates all CIFS filers to use SMB signing in their communication with the namespace. If any of the namespaces filers refuse to support SMB signing, the namespace cannot make any CIFS connections to the filer.
Default(s)	no cifs filer-signatures
Guidelines	This applies only to namespaces that support CIFS. Use the protocol command to set the file-access protocols for the namespace. Without SMB signing, the default for the namespace, the namespace cannot access the CIFS storage on any of its filers that require it. If you use this command with the required option, the namespace can only connect to filers that support SMB signing. The namespace refuses to make a CIFS connection to any filer that does not support SMB signatures. The least-restrictive setting is to enable SMB signing without requiring it (using the cifs filer-signatures syntax). The namespace can then connect to any filer, whether it requires or refuses SMB signing. If the namespace software has a choice, it prefers not to use SMB signing for performance reasons. To control the SMB-signing policy between the ARX and its clients, you can use the signatures command in gbl-cifs mode. To see the number of filers and/or clients who have used SMB signing, along with some success and failure statistics, use the show fastpath cifs-signatures command.
Samples	bstnA(gbl-ns[insur])# cifs filer-signatures allows SMB signing for any filer behind the insur namespace. If a filer requires SMB signing, the namespace will comply. Otherwise, to improve CIFS performance, the namespace negotiates for no SMB signing.   bstnA(gbl-ns[ns1])# cifs filer-signatures required requires SMB signing for all filers behind the ns1 namespace. If any filer behind the namespace refuses SMB signing, the namespace cannot connect to any of its CIFS shares.   bstnA(gbl-ns[ns4])# no cifs filer-signatures disables SMB signing for the ns4 namespace. If any filer requires SMB signing for its CIFS connections, the namespace cannot access that filers CIFS shares.
Related Commands	namespace signatures show fastpath cifs-signatures

Purpose	Use the optional description command to set a descriptive string for the current namespace, volume, or share. This appears in the show namespace command. Use the no form of the command to delete the description.
Modes	gbl-ns gbl-ns-vol gbl-ns-vol-shr
Security Role(s)	storage-engineer or crypto-officer
Syntax	description text no description   text (1-255 characters) is your description. Surround the text with quotation marks () if it contains any spaces.
Default(s)	no description
Guidelines	Either description appears in the output for show global-config namespace and show namespace.
Samples	bstnA(gbl-ns[wwmed])# description namespace for World-Wide Medical network specifies a description for the current namespace.   bstnA(gbl-ns-vol-shr[medarcv~/rcrds~rx])# description prescriptions since 2002 specifies a description for the current ARX share, medarcv~/rcrds~rx.
Related Commands	namespace -> volume -> share show global-config namespace show namespace

Purpose	Use the enable command to activate the current namespace or volume, or its shares. Use no enable to stop access to the current namespace or volume.
Mode	gbl-ns gbl-ns-vol
Security Role(s)	storage-engineer or crypto-officer
Syntax	enable [shares [take-ownership]] no enable [shares]   shares (optional) causes all of the namespaces or volumes shares to be enabled. take-ownership (optional) causes the namespace or managed volume to take ownership of all back-end shares. Use this option only if you are sure that the shares are not in active use by a managed volume on another ARX. For example, some sites use filer applications to replicate all data from one site to another; if an ARX had managed volumes at the primary site, the ARXs ownership marker (a file) would be copied to the second site. An ARX at the second site could only import the share if you use the take-ownership option. The option has no effect on a direct volume, or on any direct volumes in the namespace.
Important: This option could possibly remove a share from another managed volume that is in service. Use the take-ownership option only for cases where some shares are spuriously marked by another ARX. The CLI prompts for confirmation if you use this option; enter yes to proceed.
Default(s)	Disabled
Guidelines	You must enable a volume for it to be accessible by clients. When you enable a namespace, the CLI enables all volumes in the namespace. The enable command causes a managed volume to import external files and directories into its shares. For large directory structures, this takes some time. If there are any name collisions, they occur when you issue the enable command. The import happens asynchronously; you can monitor its progress with the show namespace or show namespace status commands.
Important: For shares backed by NetApp or EMC, you may need to access the filer directly and pre-create some qtrees or EMC tree quotas. This rare configuration issue only occurs if: - this is a managed volume, - you want to support both free-space quotas (freespace cifs-quota), and - you also want to support filer-subshares in this volume. In this case, a NetApp share requires one qtree per subshare, and an EMC import share must be an EMC File System with one quota tree per subshare. Pre-create the NetApp qtrees and/or EMC quota trees before you enable the share. See the Guidelines: Subshare Replication with Free-Space Quotas section of the filer-subshares documentation.
Guidelines (Cont.)	Each volume belongs to a volume group, which shares a memory pool as well as CPU time. The volume group is associated with several resource limits that are enforced as soon as the volume is enabled. Refer to the volume-group and reserve files commands for details. The no enable command makes the volume(s) inaccessible to clients. When a volume is disabled, client applications get no response from it. Different applications react to this in different ways; some hang, others log error messages to an internal log. The shutdown is cleaner for your clients if you first perform no export (gbl-nfs), no export (gbl-cifs), and no browsing for all NFS and/or CIFS services that export the volume.
Guidelines: Direct Volume	A direct volume is a collection of directory attach points that is easier to configure than a managed volume but does not offer any policy features. Each attach-point directory in the direct volume is attached to an actual directory on a back-end filer. A direct volume keeps no metadata. You use the direct command to declare a volume to be a direct volume. The enable command does not trigger an import in a direct volume, since there is no metadata to construct. The enable operation is therefore much faster. Also, the take-ownership option has no effect on a direct volume.
Guidelines: Sync Reports	A CIFS volume with filer-subshares or cifs access-based-enum enabled performs some additional processing during import. Specifically, the volume software discovers CIFS subshares (shares under the imported shares) and ABE settings, and it makes these settings consistent at every back-end filer. This process produces a report to show its results, named syncSshrNewStorageReport_timestamp.rpt. You can use show reports to get a list of reports, and show reports report-name to read a particular report. If the sync-subshare process fails for any reason, you can use the report to diagnose the problem. You can then rerun the sync process with the sync subshares from-namespace or sync subshares from-namespace commands.
Samples	bstnA(gbl-ns-vol[archives~/eng])# enable enables the current volume, archives~/eng.   bstnA(gbl-ns[ns])# enable shares take-ownership This command allows the switch to virtualize shares that are used by other Acopia switches. Allow switch to take ownership of all the shares in this namespace? [yes/no] yes enables all shares in the current namespace, ns. For all managed volumes in the namespace, this takes ownership of any filer shares that appear to be managed by another ARX.   bstnA(gbl-ns-vol[unused-ns~/vol2])# no enable disables the unused-ns~/vol2 volume. Clients can no longer access this volume.
Related Commands	namespace show namespace

Purpose	Use the metadata cache-size command to specify how much cache memory (in MB) to reserve for managed-volume metadata. This size is used for each volume-group domain used by the current namespace. Use the no form of this command to revert to the default cache size.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	metadata cache-size cache-size no metadata cache-size   cache-size (64-1750) is the size, in megabytes (MB), of memory to reserve for the current namespaces metadata cache(s).
Default(s)	512
Guidelines	Use this command only under the guidance of authorized F5 personnel. The total cache requirement is the number of simultaneous file accesses multiplied by the amount of memory required for each file (approximately 300 bytes at press time). The cache size should therefore be small if users access only a small segment of files at a given time, and it should be large if clients access many different files. The proper size for your site can vary widely depending on a number of configuration settings (number of shares per volume, front-end-service configuration, and so forth). In most cases, this can only be determined by experimentation and close monitoring by trained F5 personnel. Each of the namespaces volume groups has a separate memory cache, shared by all managed volumes assigned to the domain. Use the volume-group command to assign a volume to a group. On the ARX-500, you can increase the maximum number of volume groups. The memory and CPU resources are more scarce on this platform than its newer counterparts, so it is shipped with a lower volume-group maximum. If you increase the maximum number of volume groups (using the max-volume-groups command), you should also consult with F5 to change this metadata cache size. The total memory used for this namespace is the total number of volume groups times this cache size. All platforms can use swap space (from their internal disks) to add to memory size if memory gets low. You can use the show processors usage command to monitor memory and swap-space usage on the system. You must disable and re-enable the namespace for this command to take effect; use the [no] enable (gbl-ns, gbl-ns-vol) command in gbl-ns mode.
Sample	bstnA(gbl-ns[wwmed])# metadata cache-size 500 allocates 500 MB cache memory for each volume group used by the wwmed namespace.
Related Commands	enable (gbl-ns-vol-shr) volume-group max-volume-groups show global-config namespace show processors usage

Purpose	Use the namespace command to create a new namespace, or edit an existing one. Use the no form of the command to delete a namespace.
Mode	gbl
Security Role(s)	storage-engineer or crypto-officer
Syntax	namespace name no namespace name   name (1-30 characters) is a name you choose for the namespace. The name all is reserved and cannot be used.
Default(s)	None
Guidelines	The CLI prompts for confirmation before creating a namespace; enter yes to continue. (You can use terminal expert to eliminate confirmation prompts for creating new objects.) This places you in gbl-ns mode, where you must establish one or more managed volumes and/or direct volumes for the namespace. Each managed volume is like a file system in the namespace; it is composed of files and directories from various back-end filers. A direct volume contains shares with attach points, which are analogous to NFS mount points and mapped CIFS shares. A managed volume contains metadata and supports policy rules, a direct volume does not. Use the volume command to create either type of volume. From gbl-ns mode, you must also set the file-access protocol (NFSv2, NFSv3 (over UDP), and/or CIFS), and you must configure any security parameters to properly authenticate clients. Use the protocol command to set the file-access protocol(s). Use the enable (gbl-ns, gbl-ns-vol) command to enable the namespace.
Guidelines: no namespace	You must remove all of the namespaces volumes before you can remove the namespace with no namespace. Removing a volume is a complex process, described in the documentation for the volume command. The remove namespace command removes all volumes for you; best practices dictate that you use that command instead. The remove service command removes the namespace and all other configuration objects that are exclusively dedicated to the namespace, such as external filers and global servers.
Samples	bstnA(gbl)# namespace ns This will create a new namespace.   Create namespace 'ns'? [yes/no] yes bstnA(gbl-ns[ns])# creates a namespace called ns.   bstnA(gbl)# no namespace myNameSpace deletes the myNameSpace namespace.
Related Commands	volume protocol enable (gbl-ns, gbl-ns-vol) volume-group show namespace show global-config namespace remove namespace remove service

Purpose	This command is only necessary behind a cifs service that uses unconstrained delegation (or is not joined to its domain). Best practices dictate that you use constrained delegation, as described in the domain-join documentation, and avoid this CLI command. Use the ntlm-auth-db command to assign an NTLM-authentication database to the current namespace. Use the no form of the command to remove an NTLM authentication database.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	ntlm-auth-db name no ntlm-auth-db name   name (1-64 characters) is the name of an NTLM authentication database. Use the show ntlm-auth-db command for a list of configured NTLM databases.
Default(s)	None
Guidelines	This feature is designed for demonstrations with limited CIFS-service offerings. This is for CIFS services that either do not support Kerberos or support Kerberos with unconstrained delegation. For a namespace behind a non-Kerberos service, or a service with unconstrained delegation, the ntlm-auth-server is designed for long-term use. Use this command only under the guidance of F5 personnel. This command assigns an NTLM authentication database to a namespace. One database can be used in multiple namespaces. Use the gbl-mode ntlm-auth-db command to create an NTLM authentication demo database. You must also use cifs authentication ntlm and/or cifs authentication ntlmv2 for the namespace to support NTLM or NTLMv2 authentication. If a single front-end cifs service has exports from more than one namespace, this group of NTLM-Authentication DBs must be the same for all of the exported namespaces. (The export (gbl-cifs) command exports a namespace volume through CIFS.) If this command makes the current namespace inconsistent with the other namespace(s) behind the same CIFS service, the CLI prompts with an opportunity to make the same change in the other namespace(s). Enter yes to allow the CLI to propagate the change to the other namespace(s). Use the show ntlm-auth-db command to display a list of configured NTLM authentication databases.
Sample	bstnA(gbl-ns[ns1])# ntlm-auth-db DEMO assigns the NTLM authentication database, DEMO, to the current namespace.
Related Commands	namespace cifs authentication ntlm-auth-db show ntlm-auth-db

Purpose	This command is only necessary behind a cifs service that uses unconstrained delegation (or is not joined to its domain). Best practices dictate that you use constrained delegation, as described in the domain-join documentation, and avoid this CLI command. Use the ntlm-auth-server command to assign an ARX Secure Agent (ASA) server to the current namespace. To support clients from multiple Windows domains, you can use this command multiple times. Use the no form of the command to remove an ASA from the namespace. This prevents clients in the ASAs Windows Domain from using NTLM or NTLMv2 authentication.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	ntlm-auth-server name no ntlm-auth-server name   name (1-128 characters) is the name of an ASA.
Default(s)	None
Guidelines	Use this command to assign an ARX Secure Agent (ASA) server to a namespace. The ASA facilitates NTLM and/or NTLMv2 authentication for the namespaces clients. Each ASA runs on a Windows-Domain Controller (DC) for a single Windows Domain. See the ARX Secure Agent Installation Guide for more information. After you install the ASA on a DC, use the ntlm-auth-server command to configure it on the ARX. Then use this command to make it available to the current namespace. Use the show ntlm-auth-server command to display the configured ASAs along with connection statistics.
Note: If the namespaces front-end CIFS Service uses constrained delegation, introduced with Windows Server 2003, the Secure Agent (and this command) is unnecessary. An administrator with Domain Administrator privileges can go to the DC and configure constrained delegation for this CIFS service. You can use the probe delegate-to command to find all back-end filers behind a CIFS service, which the DC administrator adds to the CIFS services delegate-to list. Once the CIFS service is set up this way at the DC, the services NTLM/NTLMv2 clients can authenticate without help from a Secure Agent.
Guidelines: Multi-Domain Support and Redundant ASAs	A single namespace can support NTLM/NTLMv2 for clients from multiple Windows domains. For each supported domain, install an ASA on at least one DC. Additionally, you can assign multiple ASAs from the same domain to a namespace, for redundant coverage. If the namespace has two or more ASAs for the same domain, it selects the ASA running the highest version of software.
Guidelines: Co-Existence with Kerberos	A namespace can authenticate its clients with NTLM, NTLMv2, and Kerberos concurrently. This facilitates network transitions from NTLM to Kerberos. Use cifs authentication to configure NTLM, NTLMv2, Kerberos, or any combination of those authentication protocols. Each client chooses a protocol from that set.
Guidelines: Same Set of ASAs for All Namespaces Behind a CIFS Service	If a single front-end cifs service has exports from more than one namespace, this group of ASAs must be the same for all of the exported namespaces. (The export (gbl-cifs) command exports a namespace volume through CIFS.) If this command makes the current namespace inconsistent with the other namespace(s) behind the same CIFS service, the CLI prompts with an opportunity to make the same change in the other namespace(s). Enter yes to allow the CLI to propagate the change to the other namespace(s).
Guidelines: Removing an ASA	Removing an ASA (with no ntlm-auth-server) may stop NTLM and NTLMv2 support for the ASAs Windows domain; if this is the only ASA for the domain, clients from that domain can no longer authenticate through NTLM. This may also affect Kerberos clients in the domain if they drop down to NTLMv2 or NTLM. You can add a new ASA to the namespace at any time to support NTLM and/or NTLMv2 in a new Windows domain. This is not an issue if the cifs services in from of the namespace all support constrained delegation. You can use show cifs-service all to see all CIFS services, the namespace behind each service, and whether or not the service supports constrained delegation.
Guidelines: An Alternative NTLM-Authentication Option	For demonstration purposes, there is an alternative to configuring an external ASA: you can use ntlm-auth-db to map a small group of clients to a single set of valid NTLM credentials. The switch uses the back-end credentials to authenticate to CIFS filers.
Sample	bstnA(gbl-ns[insur])# ntlm-auth-server server1 NFS and CIFS services may export volume paths from multiple namespaces subject to certain restrictions. Parameter 'NTLM auth servers' for namespace 'insur' conflicts with that for namespace 'medarcv' in service 'ac1.medarch.org'. Synchronize conflicting parameter(s) for all the namespaces exported along with this namespace in a service and continue? [yes/no] yes assigns the ASA, server1, to the current namespace.
Related Commands	namespace show ntlm-auth-server cifs authentication ntlm-auth-server

Purpose	Use the protocol command to establish the protocol for accessing the files in this namespace (NFSv2UDP, NFSv3UDP, CIFS, or NFSv3TCP).
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	protocol {nfs2 | nfs3 | cifs | nfs3tcp} no protocol {nfs2 | nfs3 | cifs | nfs3tcp}   nfs2 | nfs3 | cifs | nfs3tcp is a required choice: nfs2 is NFS version 2 over UDP, nfs3 is NFS version 3 over UDP, cifs is CIFS, and nfs3tcp is NFS version 3 over TCP.
Default(s)	None
Guidelines	You can repeat this command to configure multiple protocols for the namespace. All of the namespaces shares must support all of the file-access protocols you set for the namespace. For example, if you set nfs2 for the namespace, all of the shares in this namespace must support NFSv2. After the first share is imported, the CLI only allows protocol changes that do not affect client service. Any of the following changes interrupt service: converting a single-protocol namespace to a multi-protocol namespace, removing CIFS, removing NFS2, or removing both of NFS3 and NFS3/TCP. To make any of the above changes after the volume is imported, you must use nsck ... destage, change the protocol with this command, then bring the volume back online with enable (gbl-ns, gbl-ns-vol). For other protocol changes, such as adding NFSv2 to a running NFSv3 namespace, you must disable the volume (no enable (gbl-ns, gbl-ns-vol)) and its front-end service (no enable (gbl-cifs, gbl-nfs)), change the protocol, then re-enable both. This causes a shorter service outage. A namespace cannot support both nfs2 and nfs3tcp unless it also supports nfs3.
Samples	bstnA(gbl-ns[ns])# protocol nfs2 sets the current namespace to support NFSv2 UDP.   bstnA(gbl-ns[ns1])# protocol cifs sets the current namespace to support CIFS shares.
Related Commands	namespace

Purpose	Use this command to assign Windows credentials (username, password, and Windows domain) to the current namespace. The namespaces managed volumes use these credentials to import CIFS shares, periodically check their health, and migrate files between them. Use the no form of the command to remove a proxy-user configuration from this namespace.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	proxy-user name no proxy-user   name (1-32 characters) is the Windows proxy user to associate with the current namespace.
Default(s)	None
Guidelines	From gbl mode, use the proxy-user command to add a proxy-user configuration to the ARX. If the proxy user has an FQDN for its windows-domain (gbl-proxy-user), it uses Kerberos to authenticate with back-end filers. If it fails to get a Kerberos ticket, it drops down to NTLMv2, and then (if that fails, too) NTLM. Use the show proxy-user command to view all configured proxy-users and their associated usernames and Windows domains.
Note: This has no relationship to the proxy-user (gbl-filer) command, which a snapshot-supporting volume uses to log into the filers CLI. This command supports CIFS imports and policy migrations, and the gbl-filer command supports coordinated snapshots. You must assign both types of proxy users to support both features.
Sample	bstnA(gbl-ns[medarcv])# proxy-user acoProxy2 associates proxy user acoProxy2 with the current namespace.
Related Commands	proxy-user show global-config namespace show proxy-user

Purpose	Use the remove namespace command to remove a namespace or volume, along with all of its associated metadata and front-end exports.
Modes	priv-exec
Security Role(s)	storage-engineer or crypto-officer
Syntax	remove namespace name [volume volume] [timeout seconds] [sync]   name (1-30 characters) identifies the namespace. volume (optional, 1-1024 characters) focuses on a single volume. seconds (optional, 300-10,000) sets a time limit for the removal of each namespace (or volume) component. sync (optional) shows the operations progress at the command line. With this option, the CLI prompt does not return until all components have been removed.
Default(s)	None.
Guidelines	The CLI prompts for confirmation before removing any configuration objects or metadata; enter yes to proceed. This removes the following objects from a namespace or volume: all policy (rules, share farms, and filesets) all shares and metadata shares all front-end exports that reference the volume(s) all metadata behind the volume(s) By default, this command generates a report to show all of the actions it takes to remove the volume(s), in order. The CLI shows the report name after you issue the command, and then returns. You can enter CLI commands as the namespace software removes the objects in the background. Use tail to follow the report as it is written. Use show reports file-name to read the report. You can search through the report with grep. To copy or delete it, use the copy or delete commands. Use the sync option to send the status to the command line instead; the command does not generate a report if you use the sync option. To remove a namespace and all other configuration objects dedicated to the namespace (including global servers and external filers), use remove service. To remove a share from a volume, use remove-share migrate or remove-share nomigrate. Use the remove namespace ... policy-only command to remove all policy objects (rules, share farms, and/or filesets) from a namespace or volume. The remove namespace ... volume ... exports-only command finds all front-end exports for a volume and removes them, leaving the volume itself intact.
Sample	prtlndA# remove namespace insur_bkup sync   Remove namespace 'insur_bkup'? [yes/no] yes % INFO: Removing service configuration for namespace insur_bkup % INFO: Removing CIFS browsing for namespace insur_bkup % INFO: Removing volume policies for namespace insur_bkup % INFO: destroy policy insur_bkup /insurShdw % INFO: Removing shares for namespace insur_bkup % INFO: no share backInsur % INFO: Removing volume metadata shares for namespace insur_bkup % INFO: no metadata share nas-p1 path /vol/vol1/mdata_B % INFO: Removing volumes for namespace insur_bkup % INFO: Removing NFS services for namespace insur_bkup % INFO: Removing CIFS services for namespace insur_bkup % INFO: no volume /insurShdw % INFO: Removing namespace metadata shares for namespace insur_bkup % INFO: Removing namespace insur_bkup % INFO: no namespace insur_bkup removes the insur_bkup namespace, showing progress on the command line instead of in a report.
Related Commands	remove service remove-share migrate remove-share nomigrate remove namespace ... policy-only remove namespace ... volume ... exports-only wait-for remove

Purpose	A properly-empowered CIFS client can edit the list of users and groups who are permitted to access a file. For example, the owner of a file can allow read-access for a trusted group. A Windows server keeps a list of all available groups in its Security Account Management (SAM) database; a namespace proxies all of its SAM requests to one of the CIFS servers behind it. For installations that use Local Groups on some filers, it is possible for the switch to choose a filer that is unaware of all groups in the namespace. You can use the sam-reference command to choose the filer manually. This command is unnecessary unless at least one of the filers uses Local Groups. Use no sam-reference to allow the namespace to choose the SAM-reference filer. This is appropriate to an installation that only uses globally-defined groups.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	sam-reference ext-filer [cluster cluster-name] no sam-reference   ext-filer (1-64 characters) identifies the external filer to use. For a list of configured external filers, use show external-filer. cluster-name (optional, 1-64 characters) is only relevant if the ARX is part of a disaster-recovery (DR) configuration. In a DR configuration, there is an active ARX cluster with one set of filers and a backup cluster with a mirrored set of filers. This determines which cluster uses this ext-filer for its SAM queries. Run the sam-reference command twice per namespace if you use DR: once to designate the SAM-reference filer for the active cluster, and again to determine the SAM-reference filer at the backup cluster. Use show cluster for a list of configured clusters. If you omit this option, the command assumes that this is the local cluster.
Default(s)	The switch chooses one of the namespaces filers as a SAM reference.
Guidelines	This command does not apply to an NFS-only namespace. This only affects CIFS clients who want to add group access to one of their files. The namespace must query a SAM database on a back-end filer to offer the list of available groups and users. Each CIFS filer has its own SAM database, with its own names for groups and users. The namespace chooses one filer for all of its SAM queries. For installations that use Global Groups, this is not an issue. For installations that use Local Groups at one or more filers, it is possible for the namespace to choose a filer that does not support all possible groups.
Note: SAM-database queries are not associated in any way with the file (per the standard CIFS and SAM protocols), so the client does not provide the information to determine which CIFS filer should respond to each query. The namespace therefore chooses one CIFS filer for all SAM queries.
Guidelines (Cont.)	For installations where Local Groups differ amongst the CIFS filers, one of the filers must define all of the groups for the namespace. If necessary, you may need to define some Local Groups at one of the back-end filers to create a superset. Use this command to identify that filer. Conversely, this command is not needed if every filer behind the namespace supports the same set of local groups. This is a recommended configuration. If a single front-end cifs service has exports from more than one namespace, this SAM-reference filer must be the same for all of the exported namespaces. By extension, the single SAM-reference filer must define all the Local Groups behind all of the namespaces behind the CIFS service. (The export (gbl-cifs) command exports a namespace volume through CIFS.) The currently chosen SAM-reference filer (if any) appears in the output of the show global-config namespace command.
Samples	bstnA(gbl-ns[medarcv])# sam-reference fs2 establishes fs2 as the SAM-reference filer for the medarcv namespace.   bstnA(gbl-ns[medarcv])# no sam-reference allows the namespace to choose any CIFS filer behind the namespace as its SAM reference.
Related Commands	namespace show sid-translation show global-config namespace show cluster

Purpose	Use the show namespace command to show summaries of all namespaces, or to include a single namespace name to view configuration details for that namespace.
Mode	(any)
Security Role(s)	crypto-officer, storage-engineer, network-engineer, network-technician, or operator
Syntax	show namespace show namespace name [volume vol-path [share share-name]] show namespace all   name (optional, 1-30 characters) identifies the namespace. If you omit this, the output lists all namespaces on the switch. vol-path (optional, 1-1024 characters) is the name of the volume. share-name (optional, 1-64 characters) is the name of the share. all lists details for all configured namespaces.
Guidelines	This shows the full configuration and status of a namespace. For status only (to monitor the progress of an import), you can use the smaller show namespace status command. The show namespace output displays the following fields: Description is set with the description (gbl-ns, gbl-ns-...) command. Metadata Cache Size is the internal cache size in MB (512 MB is the default). To change the cache size, use the metadata cache-size command. Proxy User is the username/password used by the ARX to access back-end CIFS shares. Use the proxy-user (gbl-ns) command to set this. Filer SMB Signatures describes this namespaces setting for SMB signing, a CIFS security feature. This is Enabled (use SMB signing if and only if the filer requires it), Required (only connect to CIFS filers that agree to use SMB signing), or Not Enabled (only connect to filers that do not require SMB signing). You can change this with the cifs filer-signatures command. NFS Character Encoding only appears in a namespace that supports NFS. This shows the character encoding used for all file and directory names sent to NFS clients. You can change this with the character-encoding nfs command. SAM Reference Filer only appears if explicitly set with the sam-reference command. This shows the CIFS filer used to answer all CIFS-client queries to the Security Account Management (SAM) database. Supported Protocols lists the protocols (NFSv2, CIFS, and so on) supported by the namespace. This is set with the protocol command.
Guidelines (Cont.)	CIFS Authentication appears only for a namespace that supports CIFS: Protocols is a list of the authentication used (NTLM, NTLMv2, and/or Kerberos). Use cifs authentication to change this setting. Anonymous Access (IPC$ only) may also appear in this list. This indicates that CIFS clients can access the namespaces IPC$ volume with the anonymous Windows-user account; some scanners/photocopiers require this access for saving files to the namespaces CIFS volumes. You can use the cifs anonymous-access command to change this setting. None indicates that CIFS clients cannot authenticate to this namespace, and therefore cannot access any of the namespaces storage. NTLM Servers (only appears if configured) is a list of external authentications servers, set by ntlm-auth-server (gbl-ns). NTLM Database (only appears if configured) is set by ntlm-auth-db (gbl-ns). Participating Switches is a list of ARXes that support the namespace. For each switch, the volume groups are shown in parenthesis; this is where the namespace software runs. Before you enable a volume (not after), you can specify its volume group with the volume-group command.
Guidelines: Metadata Shares (Namespace)	Metadata shares is shown only if the namespace uses a metadata-only share. Use the metadata share command to use a metadata-only share for the namespace. This is a table with the following columns (one row per configured share): Filer is the IP address or DNS name for the filer, Backend Path is the filers share name or NFS-export path, Contains Metadata is yes for the one export that holds metadata, and Status is the current status of the share. For possible status values, see Guidelines: Import Status below.
Guidelines: Windows Management Authorization	Windows Management Authorization Policies appears for namespaces that support CIFS and management by authorized Windows clients. The Microsoft Management Console (MMC) bundled with Windows is a typical interface for remote management. The windows-mgmt-auth (gbl-ns) command assigns a group of authorized clients to a namespace. If any Windows-management-authorization (WMA) groups are assigned to the namespace, they are listed in this table.
Guidelines: Volumes	Volumes is a list of managed volumes in the namespace. Use the volume command to create a volume. CIFS: is a list of supported CIFS options, if applicable. The following commands set these options: compressed-files, named-streams, persistent-acls, sparse-files, unicode-on-disk, cifs case-sensitive, and cifs file-system-name. Volume freespace is the amount of free space advertised to this volumes clients. After the free-space amount is the calculation method for free space: automatic, or manual, or clients use dir-master-only. automatic - Add up the free space from all shares behind the volume and present the sum to all clients. The namespace volume monitors the back-end-storage ID behind each share; if two or more shares have matching storage IDs (that is, they draw their free space from the same storage pool), only one of the shares has its free space counted. This is the default setting for a new volume. manual - Add up the free space from all shares, ignoring any shares that draw from the same back-end-storage pool. You can manually eliminate shares from this sum with freespace ignore. You can also adjust the free space that is counted for each share with freespace adjust. Use freespace calculation manual to set this. clients use dir-master-only - Give the client the free space for the master back-end share only, without adding any any free space from any of the stripe shares in the same volume. The volume chooses the master share when the client connects to the volume through a front-end share or subshare: the volume starts with the root directory of that front-end share, finds the master instance of that directory, and chooses the back-end share that hosts that master directory. This is useful for volumes where directory trees reside only on a single back-end filer most of the time. Use the freespace calculation dir-master-only command to set this. Volume total space is the sum of total space on all shares behind the volume. This is the actual space. The volumes clients may see different space settings, as determined by the settings above. CIFS quotas is Enabled if the volume supports path-based quotas on its back-end filers. This indicates that the volume shows free-space values based on these back-end quotas; each client sees his or her space quota, not the entire size of the volume. You can use the freespace cifs-quota command to enable or disable this feature.
	Auto Sync Files: Enabled appears only if the volume is permitted to synchronize metadata that is found to be incorrect. This means that certain client-access errors will trigger an auto-sync operation. Use the auto sync files command to enable or disable this feature.
Guidelines: Volumes (Cont.)	Auto Sync Options: Rename-Files appears only if the volume is permitted to rename files when auto-synchronizing. That is, if auto-sync discovers a file whose name is the same as an already-imported file, this feature allows the volume to rename the newly-discovered file. As above, use the auto sync files command to enable or disable this feature. Metadata size is the amount of metadata space allotted to this volume. Metadata free space is the amount of free space left on this volumes metadata share. This does not appear if metadata is stored on the internal disks. Filer Subshares: Enabled appears only if the filer-subshares flag is enabled. This applies only to managed volumes that support CIFS; it indicates that the volume can pass a client from a CIFS subshare at the front-end service through to the corresponding subshare at the back-end filer. This pass-through mechanism makes it possible to support share-level ACLs for the volumes subshares. The additional text, native-names-only, appears if the filer-subshares command was invoked with a flag of the same name. Oplock support appears only for volumes that support CIFS. This shows whether or not this volume supports CIFS opportunistic locks (oplocks). This can be Enabled, Disabled, or Automatic, as set by the cifs oplocks-disable command. Notify-change mode shows the degree of support for the CIFS change notification feature. This is Normal (tell clients only of changes in the top level of the directory requested, ignoring any request to track changes in its subtree), Use Subtree Flag (inform CIFS clients of all back-end file system changes that they request), or No changes sent (silently ignore all client requests for change notification). You can change this with cifs notify-change-mode.
	CIFS path cache only appears for volumes that support CIFS. This is Enabled or Not Enabled, depending on the cifs path-cache setting. If enabled, NSM processors keep a cache of the volumes CIFS paths as it learns them. This prevents repetitive queries to the volume process on an ACM processor. Otherwise, NSM processors query the volume process for each CIFS-client request. CIFS access based enum also appears only for volumes that support CIFS. This is Enabled or Not Enabled, possibly followed by some combination of Auto-Enable, Ignore Metadata Skew, and/or Full Autosync. This output depends on the cifs access-based-enum setting. If enabled, the volume changes its behavior for sending directory listings to its CIFS clients; if a back-end share omits some files or directories, the volume assumes that the omissions are caused by ABE, and makes no attempt at correction. Additionally, the volume only allows a share to import if the share has ABE enabled at its back-end filer; the volume rejects shares with ABE disabled, or automatically enables ABE if the Auto-enable flag is raised. If Not Enabled, the volume presumes that none of its filers have ABE enabled, and therefore may amend a directory listing with omissions. Snapshots is either Enabled or Not Enabled, depending on whether or not the volume contains at least one snapshot rule. Migration method: Direct is either Staged or Direct. This indicates the method for migrating files; either performing a network transfer to a staging area first, or performing the transfer directly to the final location. The direct method fails if the migration is interrupted by a snapshot. You can use the policy migrate-method command to change this setting.
	State is usually Enabled or Disabled, as set by the enable (gbl-ns, gbl-ns-vol) command. This cycles through several stages during import. The namespace imports the files and directories from back-end storage when you create and enable the volume and its share(s). See Guidelines: Volume State, below, for an explanation of all possible volume states. Host Switch is the ARX with the volume-group where this volume resides. This is typically the ARX peer where the volume was originally created. If you want to use show volume-group to show this volumes group, run the command on the ARX shown in this field. Instance is an integer ID for the volume processes. Volume Group is the volume group where this volumes processes run. Several volumes from the same namespace can run in a given volume group. The volume group is automatically assigned when the volume is enabled. You can optionally use the volume-group command to pre-set the volume group beforehand. Processor shows the physical CPU where the volume group is currently running. A volume group can fail over between peers in a redundant pair. The processor appears in slot.processor format. Files is the number of files in the volume, and the file credits that are remaining for the volume. This also shows the maximum possible number of file credits if auto reserve files is set. The auto-reserve feature adds file credits as the volume grows. The volumes metadata shares appear next.
Guidelines: Metadata Shares (Volume)	Metadata shares is shown only if the volume uses a metadata-only share. Use the metadata share command to use a metadata-only share for the volume. This is a table with the same columns as shown above in Guidelines: Metadata Shares (Namespace).
Guidelines: Shares	Share name (s) are the configured shares in the volume. Use the share command to add a share to the volume.
Note: Instead of using show namespace for this information, you can use the shorter show namespace status or show share status command to display share, filer, path, and import status only.
Guidelines: Shares (Cont.)	If the share has been designated as a replica-snap share, a replica of one of the other shares that is dedicated to snapshots, [replica-snap] appears next to the share name. Many of the detailed fields (below) do not appear for replica-snap shares because they are irrelevant to snapshots. Description appears only if someone set a description (gbl-ns, gbl-ns-...) for the share. Filer is the filer that hosts the back-end share. This is set by the filer command. If [Acopia Namespace] appears after the filer name, the filer is a managed-volume in a direct volume; this shows the namespace name and the Volume Path field (below) shows the volume name. Volume Path only appears for managed-volume shares in direct volumes. This is the name of the volume behind this direct share, as set by the managed-volume command. NFS Export is the name of the NFS export at the back-end filer. This is also set by the filer command. CIFS Share (also set by filer) is the name of the CIFS share at the filer. In a multi-protocol namespace, both the NFS Export and CIFS Share appear for each namespace share.
	Features is a list of multi-protocol features supported at the back-end share: cifs-acls, unix-perm, shared-attr, asymmetric-ro, no-trail-period (the filer creates a CIFS FGN for file/directory names that end in a period, so the volume will never migrate any such names to it), fgn-see-thru (the filer allows write access to files through their CIFS 8.3 names, so the share is not supported in a multi-protocol volume), ignore-unix (the share is backed by an NTFS qtree that ignores changes to Unix permissions without any error; the managed volume also quietly drops these changes), cifs-case-blind, and/or unix-acls (The filer is a NetApp with the cifs.perserve_unix_security option enabled. The NetApp converts Unix security flags into a special CIFS ACL, so that CIFS clients can change the Unix security settings. The volume software records this setting at import time so that it can support those CIFS clients.)
Guidelines: Shares (Cont.)	CIFS Maximum Request Size is the maximum size (in bytes) for a CIFS request (other than a write request). This is a maximum found at the back-end filer. This information is for internal use only. CIFS Access-based Enum is Exclude if someone issued cifs access-based-enum exclude for the share. Otherwise, this field does not appear in the output. The Exclude flag indicates that the filer behind the share cannot support access-based enumeration (ABE), so this share is excluded from the volumes ABE-consistency checking. SID Translation only appears for a CIFS volume that translates Security IDs (SIDs) for all files migrated to or from this share. This indicates that the filer uses Local Group support, so the SID for each group name is unique at this filer. Use the sid-translation command to enable SID translation for a share. Ignore SID errors only appears for a volume that supports CIFS. A Yes indicates that the back-end server is configured to return an error for a file or directory with an unknown SID, but accept the file/directory anyway. A No indicates that SID errors from the filer indicate a rejection of the file or directory. You can change this with the ignore-sid-errors command. Status is the current status of the share. This cycles through several stages during import. The namespace imports the files and directories from back-end storage when you create and enable the share. See Guidelines: Share-Import Status, below. Volume Root Backing appears if the share is designated to hold new files created in the root of the volume. This is the first share imported into the volume, which is typically the first share configured. Critical Share appears if the share has been tagged with the critical command. If a redundant switch loses contact with a critical share, it may fail over to its peer switch.
	Migrate Retain Files: Yes only appears the share is set to keep copies of all files migrated away from it. The copies are kept in a hidden directory at the root of the share. Use migrate retain-files to edit this setting. Strict Attr Consistency: No only appears if you disable strict-attribute consistency. This is recommended for multi-protocol (CIFS and NFS) shares, which may have directories with different CIFS-side and NFS-side names. If the volume cannot find the CIFS-side name of a directory, it may not be able to find all of its CIFS attributes. The volume must either rename these directories (see below) or be allowed to operate without strict-attribute consistency; it cannot import the share otherwise. You can use no strict-attribute-consistency to set this.
	Import Sync Attributes: Yes only appears if (during import) the volume is allowed to synchronize the attributes of colliding directories in this share. That is, if a directory in this share has the same name as an already-imported directory but different file attributes (such as read/write permissions), the volume can change the attributes. This is strongly recommended for shares in multi-protocol namespaces. Use import sync-attributes to change this. Import Rename Files: No only appears if (during import) the volume is prevented from renaming collision files in this share. A file is said to collide if it has the same name and path as an already-imported file or directory. Use modify to allow the volume to change files at all during import, and use no import rename-files to disallow file-name changes in this particular share.
Guidelines: Shares (Cont.)	Import Skip Managed Check: Yes is another import option. This only appears if someone used import skip-managed-check on this share. It means that the volume will not run a time-consuming test on any of the shares directories during import. The test confirms that the directory is not already managed by another ARX volume. Import Rename Directories: No only appears if (during import) the volume is prevented from renaming collision directories in this share. Use modify to allow the volume to change directories at all during import, and use no import rename-directories to disallow directory-name changes in this particular share. Import Rename Non Mappable Directories: Yes only appears if the volume is allowed to rename a multi-protocol directory with a CIFS-side name that is unmappable to the NFS character-encoding. Filers create unintelligible NFS-side names for these files; this indicates that the volume is allowed to rename these directories during import. Use import rename-directories unmapped-unicode to set this. Import Priority shows the priority for this share over other shares in the same volume. If two shares have a conflicting file or directory and their import priorities are different, the share with the higher priority wins the conflict. The file or directory on the winning share is the master, and the other file or directory may have to change according to one of the import settings above. You can use the import priority command to change the import priority for any given share.
	Free space on storage is the remaining space on the share. The expression, (excluded from volume), appears after the number if someone used the freespace ignore command in this share; it means that this shares free space is not being counted toward the volumes free space. Freespace adjustment only appears if someone used freespace adjust to change the advertised free space for this share. This is the adjustment to the free space advertised for this back-end share. For example, if this is 1024 bytes, the volume adds 1024 bytes to the shares current free space. Total space on storage is the sum of the shares free space (above) and used space. Apparent size of storage is the size of the share that is advertised to clients. You can change this with the freespace apparent-size command; this field only appears if that command is set. Policy Maintain Freespace is the amount of free space to maintain on the share. The policy engine does not migrate files to this share if it drops below this amount of free space. You can change this with the policy freespace (gbl-ns, gbl-ns-vol) command. Policy Resume Freespace is another free-space threshold for this share. If the share drops below the free-space to maintain (above), the share is ineligible for any more migrations until it rises back up to this resume value. You can change this threshold with the same policy freespace (gbl-ns, gbl-ns-vol) command that you use for the maintain threshold. Free files on storage (NFS shares only) is the maximum number of files that can be added to the back-end export. All file systems impose a limit on the maximum number of files on a share. Virtual inodes (NFS direct shares only) is the total number of inodes (files) that can be supported at the direct share.
Guidelines: Shares (Cont.)	Transitions shows the number of times that the share has changed from offline to online, or from online to offline. Last Transition is the date of the last transition. Last Probe Status only appears if the most-recent probe of the share resulted in a failure. The volume probes the share at regular intervals to confirm its health; if this field appears, the share failed the latest probe and the failure status appears here. This often indicates a problem with the back-end filer or filer connection; contact F5 Support if you see this field and require any guidance.
Guidelines: Volume State	In the Volumes State field, any of the following messages may appear: Enabled - Someone used enable (gbl-ns, gbl-ns-vol) to enable the volume. If nothing appears after this, the volume is capable of processing client requests. Otherwise, one of the following messages appears in parenthesis, indicating an interim and/or degraded state: Waiting for available metadata location - The volume is looking for an available share amongst its configured metadata shares (metadata share). Metadata free space low, Metadata free space very low, and Insufficient metadata free space all indicate a progressively-worse problem with free space on the volumes metadata share: the free space is below 512 M, 256 M, or 128 M. Each volume requires multiple Gigabytes of space for its metadata. Choose another metadata share for the volume (using nsck ... migrate-metadata), or connect to the metadata share and clear any space outside of any .acopia directories. Metadata filer failed - The volumes metadata share is offline. The volume cannot function without this share. Check and correct the share at the file server itself. If necessary, use nsck ... migrate-metadata to move the volumes metadata to a new share. Metadata starting - Volume processing is starting (perhaps after an ARX reboot), and the volume is re-connecting to its metadata share. No enabled shares - The volume is ready for processing, but none of its shares are running. Use enable (gbl-ns-vol-shr) to enable a share. Read Only - The volume allows reads but no writes. This might be because it is configured as a shadow volume, or because no one has set the modify flag. Instance not responding - Volume processing has failed. Starting - The volumes enabled shares are currently importing files and directories from back-end filers. Stopping - Someone has issued a no enable (gbl-ns, gbl-ns-vol) command to stop processing in this volume, and the volume is in the process of stopping. You cannot change the volumes configuration until the volume reaches the Disabled state.
Guidelines: Volume State (Cont.)	Disabled - The volume is fully stopped after someone has issued a no enable (gbl-ns, gbl-ns-vol) command. Clients cannot access this volume. You can make changes to the volumes configuration. Offline (Migrating Metadata) - The volumes metadata is migrating from one filer to another. The volume comes back online after the migration finishes. You can use the nsck ... migrate-metadata command to migrate the volumes metadata.
Guidelines: Share-Import Status	In the Shares Status field, the following messages show the progress of a successful import: Pending (Uninitialized) - The share is configured, but either the volume or the share is not yet enabled. Use the enable (gbl-ns, gbl-ns-vol) command to enable the volume. For a new share in an already-enabled volume, use the enable (gbl-ns-vol-shr) command to enable the share. Pending Import - Scheduled for import. If this volume supports CIFS and has filer-subshares or cifs access-based-enum enabled, the volume is synchronizing all of the subshares and/or ABE settings it can find on the filers behind it. Pending Import: Unavailable - The volume lost contact with the filer after the share was scheduled for import. You can use no enable (gbl-ns-vol-shr) on this share to send it to the Offline: Disabled status; this allows an nsck ... rebuild of the volume. Importing: a items scanned, b items imported - Actively inventorying the back-end storage. Both counters, a and b, are the sum of files and directories. Import Interrupted - The ARX unexpectedly lost contact with the back-end share/export, disrupting the import process. Import Paused: Volume Disabled - Someone issued the no enable command while the volume was importing. To restart the import, use the enable (gbl-ns, gbl-ns-vol) command. Pending Online - The share is nearly online. Online: Direct - This volume has direct shares, and is ready for client access (no import is required). Online - Import completed successfully, back-end storage is ready to be used.
Guidelines: Disable/Removal Status	These messages indicate the status of a share that has been disabled and/or removed: Offline: Disabled - either the share or the entire volume is disabled. Use the enable (gbl-ns-vol-shr) command to enable the share; use the enable (gbl-ns, gbl-ns-vol) command to enable the entire volume. Offline: Unavailable - the volume lost contact with the filer. Pending Remove - The share has been marked for removal by the no share command. See share. Preparing Remove: n records visited - The switch is scanning the volumes metadata, separating out the metadata for this particular share and retrieving all master-directory attributes from the back-end filer. The n is the number of files and directories scanned. Removing: n records visited - The switch is currently removing the share from the namespace. The n is the number of file/directory records that have been removed from the volumes metadata. Remove Paused: Volume Disabled - the volume was disabled after the removal started. Use the enable (gbl-ns, gbl-ns-vol) command to enable the volume and restart the share removal. Remove Interrupted - The ARX unexpectedly lost contact with the back-end share/export, disrupting the remove process.
Guidelines: Import Errors	An Error at the beginning of the message indicates the import failed. There are a large number of specific import errors, to help with diagnosis and recovery. See Table 21.1 on page 21-49 for a full list of possible errors and suggestions for troubleshooting each error. Once the error is corrected, you can use the no share command to remove the share, then share to re-import it. For metadata shares, the entire volume must be re-imported: use the nsck ... rebuild command for the volume.
Samples	bstnA# show namespace lists all namespaces. See Figure 21.1 for sample output.   bstnA# show namespace medarcv shows all volumes in a CIFS namespace; see Figure 21.2 on page 21-38.   bstnA# show namespace wwmed shows all volumes in an NFS namespace; see Figure 21.3 on page 21-43 for sample output.   prtlndA# show namespace nemed volume /acctShdw shows one volume with manual free-space calculations. See Figure 21.4 on page 21-45 for sample output.   bstnA# show namespace insur volume /claims shows one volume in a multi-protocol (NFS and CIFS) namespace. See Figure 21.5 on page 21-46 for sample output.   bstnA# show namespace medco volume /vol share generic shows one share in a direct volume. See Figure 21.6 on page 21-48 for sample output.
Related Commands	namespace enable (gbl-ns, gbl-ns-vol) enable (gbl-ns-vol-shr) ip address grep nsck ... rebuild

Table 21.1 Share Status Conditions (Continued)

Status Condition	Description/Action
Error: A directory was removed from the filer during import.	A directory was found during an early scan of the filer share, then later it was missing. Either a client or client application must have accessed the filer directly (that is, not through this managed volume) during the import. This ARX cannot support unexpected changes to the back-end shares during (or after) import. After you correct the problem, use nsck ... rebuild volume to reimport all shares in the volume.
Error: A filename/directory could not be mapped to the namespace character encoding.	One of the shares directories has a name with Unicode characters that are unsupported by the character-encoding nfs setting. CIFS file names are Unicode and can contain any character, but NFS servers and clients must each configure their character encoding for file names. The volume cannot import a directory with any un-mappable characters in its name. You can use the import rename-directories unmapped-unicode command to allow the volume to rename such directories during import, or you can rename them manually at the filer. Then restart the share import: enter gbl-ns-vol-shr mode and re use the enable (gbl-ns-vol-shr) command.
Error: a higher priority share failed to initialize import.	A share with a higher import priority has failed its import, so this share cannot import. If any share import fails, the managed volume cannot import any shares with lower import priorities. Find the import error for the failed share(s), look for the error in this table, and take action as directed. This error is resolved as soon as all higher-priority shares successfully import.
Error: Access denied by filer.	This indicates that the ARX does not have proper permissions to connect to the back-end filer, or to perform some operation in the filer share. For NFS exports, check your back-end filer configuration: the back-end share should allow root access to all of the ARXs proxy IP addresses. Use the show exports command examine all permission settings at the filer. Use the show ip proxy-addresses command to list all configured proxy IP addresses. For CIFS shares, the switch uses the namespaces proxy user (username and password). The proxy-user credentials must belong to the Administrators group at every filer behind the namespace. Use the probe exports command to check this. The proxy-user (gbl-ns) command sets the proxy user credentials for a namespace. This may also indicate that the ARX is examining a read-only directory, such as the ~snapshot directory in a NetApp filer. Such directories should be ignored during import. The gbl-filer ignore-name command identifies these types of directories. After you find and fix the error, you can restart the share import: enter gbl-ns-vol-shr mode for this share and re use the enable (gbl-ns-vol-shr) command.
Error: Another share in the volume failed to import.	All shares in the volume must import successfully for the volume to come online. Address the share that does not have this error, then restart this share import: enter gbl-ns-vol-shr mode for this share and re use the enable (gbl-ns-vol-shr) command.
Error: Attempted to import subdirectory which is also a managed root	This share is a parent to an already-imported share. Namespace shares cannot overlap. Use the filer command to change the path or share name. After you correct the problem, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Attributes of the share root are inconsistent.	The shares root directory has attributes (such as owner, group, and permission settings) that are inconsistent with those of the already-imported shares. You can access the back-end filer directly to change these attributes, or you can use the import sync-attributes command to allow the volume to change the attributes for you. Then re-enable the share (enable (gbl-ns-vol-shr)) to restart its import.
Error: Authentication error during import.	The ARX does not have proper permissions to connect to the back-end filer. For NFS exports, check your back-end filer configuration: the back-end share should allow root access to all of the ARXs proxy IP addresses. Use the show exports command examine all permission settings at the filer. Use the show ip proxy-addresses command to list all configured proxy IP addresses. For CIFS shares, the switch uses the namespaces proxy user (username and password). The proxy-user credentials must belong to the Administrators group at every filer behind the namespace. The proxy-user (gbl-ns) command sets the proxy user credentials for a namespace. After you find and fix this issue, you can restart the share import: enter gbl-ns-vol-shr mode for this share and re use the enable (gbl-ns-vol-shr) command.
Error: Bad Export Path/Share Name	The share cannot be found on the external filer. Use the filer command to change the path or share name for this share, then re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: CIFS ABE check failed.	(CIFS) The volume supports cifs access-based-enum (ABE), and attempted to replicate ABE settings between its back-end shares. This replication process failed. The same process also checks for CIFS subshares (filer-subshares), so you can use sync subshares from-namespace ... tentative to get a full report on this issue. This often occurs because the ARX does not have proper permissions to check for ABE support on this back-end share. The ARX uses the namespaces proxy user (username and password) as its identity when it checks for ABE support. The proxy-user credentials must belong to the Administrators group at this back-end filer. You can use the proxy-user (gbl-ns) command to choose new proxy user credentials for the namespace. After you find and fix this issue, use nsck ... rebuild volume to reimport all shares in the volume.
Error: CIFS error during import scan.	(CIFS) This is a CIFS error that is not an access or network error, but prevented the import. The syslog shows the specific error. Use show logs syslog to read the syslog, or grep string logs syslog to search for a specific string in the syslog. After you correct the error, re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: CIFS filer connection limit reached.	(CIFS) The back-end filer imposes a limit on CIFS connections, and the import requires more connections than the filer allows. Correct this at the back-end filer and then re-enable the share to retry the import.
Error: CIFS operation attempted on a symbolic link.	(multi-protocol) The volume software encountered an NFS symbolic link on this back-end share, and the volume has cifs deny-symlinks enabled. You can resolve this issue by using the no cifs deny-symlinks command to allow the volume software to follow these links. Alternatively, you can remove all NFS symbolic links from the back-end share. After you fix this issue, use nsck ... rebuild volume to reimport all shares in the volume.
Error: CIFS operation failed with an error during import.	(CIFS) The back-end filer returned an unexpected CIFS error during import. The syslog shows the specific error. Use show logs syslog to read the syslog, or grep string logs syslog to search for a specific string in the syslog. You may need to escalate to F5 Support. After you correct the error, re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: CIFS operation failed with an error indicating a filer fault.	(CIFS) The filer returned an unexpected error during the import, and the error indicates a problem at the filer itself. The syslog shows the specific error. (Use show logs syslog to read the syslog, or grep string logs syslog to search for a specific string in the syslog.) Check the filer itself and correct the problem there. After you correct the error, re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: CIFS operation returned an error indicating an unsupported option.	(CIFS) The back-end share returned an error indicating that it does not support a CIFS option that the ARX requires. Consult the F5 Data Solutions Compatibility Matrix (included in this doc set) to confirm that the filer has been qualified for use behind the ARX. If the share cannot possibly support CIFS behind an ARX, you can use no share to remove the share from the volume. After you fix this issue, use nsck ... rebuild volume to reimport all shares in the volume.
Error: CIFS proxy-user not privileged.	(CIFS) The namespace software attempted to write a test file to the share and failed. Go to the filer and check permissions for the namespaces proxy-user (gbl-ns); the proxy user must be part of the Backup Operators and/or Administrators group on the filer. After you correct the error, re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: CIFS subshare check failed.	(CIFS) The volume supports filer-subshares and/or cifs access-based-enum (ABE), and attempted to replicate subshares, subshare ACLs, and/or ABE settings between its back-end shares. This replication process, also known as subshare synchronization, failed. As a result, any front-end export of the failed subshare will be degraded. The output of show cifs-service fqdn shows all of the degraded subshares in a given fqdn service. Use sync subshares from-namespace ... tentative to get a full report on this issue. To repair it, use the sync subshares from-namespace or sync subshares from-service command without the tentative option.
Error: Cannot find credentials for connection to filer.	(CIFS) Proxy user credentials have not been properly configured for the CIFS share. These credentials must be a username and password from the Administrators group. Use the proxy-user command to add or edit these credentials, and use the proxy-user (gbl-ns) command to apply them to a namespace. After you correct the error, re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: Collision rename failed due to open file on share.	(CIFS) The share had a file that collided with an already-imported file, and the volume failed to rename it because a CIFS application has it open and locked. You can use show cifs-service open-files to find the open file, close cifs file to close it, and then retry the share import (with enable (gbl-ns-vol-shr)).
Error: Could not update attributes on a file/directory during import.	Failure to update file attributes can be caused by loss of connectivity during the import. Use the show exports command and/or ping to check the connection to the filer. For CIFS shares, this may indicate permissions problems. Proxy-user credentials may not have been properly configured for the CIFS share. These credentials must be a username and password from the Administrators group. Special, immutable directories can also cause this. The .snapshot directory (on some systems) is an example of an immutable directory, though .snapshot directories are properly ignored by the import software. To ignore other directories on this filer, use the gbl-ext-filer ignore-name command. After you correct the error, re-enable the share (enable (gbl-ns-vol-shr)) to retry the import.
Error: Detected collisions/inconsistencies during no modify import.	Two or more of the volumes shares had common file names that either collided or had NFS/CIFS naming inconsistencies, and this volume disallows import if it encounters either of these problems. As an example of a collision, suppose share A and share B had the same file in the same path, \docs\index.htm: these files would collide. A naming inconsistency can only occur for a directory in a multi-protocol (NFS and CIFS) namespace; the CIFS-side directory name has unicode characters that are inexpressible on the NFS-side (see the documentation for the character-encoding nfs command). The volume must be allowed to modify the directory (or one of the colliding files) for the import to succeed: the directory or file must be renamed. All duplicate files and naming inconsistencies are recorded in the import reports for each share. These reports are named import.job-id.share-name.share-id.rpt. Use show reports to list all import reports and read their contents. Using the import report for each share, resolve all file collisions and naming inconsistencies before re-importing. Go to the filers and rename the files, move them, and/or resolve that certain file renames are acceptable. Once the issues are cleared, use the gbl-ns-vol reimport-modify and modify commands to allow modification (renames) on import. (If any other shares are still importing, you must wait for their imports to finish before you can use the modify command.) To rename inconsistent NFS/CIFS directories, use the import rename-directories unmapped-unicode command, too. After you correct the problem, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Device Offline	The shares back-end filer went offline for an extended time in the middle of the import. You can remove the share from the volume, or resolve the issue at the filer and retry the import. To retry the import, you can use the enable (gbl-ns-vol-shr) command on this share.
Error: DFS links found on share during import.	Managed volumes do not support Distributed File System (DFS) links. To find all of the DFS links on all of a volumes shares, you can import the share(s) with no modify. Remove all DFS links from the back-end share. Then use the enable (gbl-ns-vol-shr) command to retry the import.
Error: Directory attribute collision detected during import.	A directory on this share has the same name and path as a directory on another share, but the attributes are different. (Directory attributes are permission settings for various users and groups, along with various other flags.) For example, suppose share A had a \docs\img directory and share B had a directory with the same name but different write permissions for the Everyone group. To allow the volume to modify directory attributes on import, you can use modify on the volume and import sync-attributes on the share. (If any other shares are still importing, you must wait for their imports to finish before you can use the modify command.) Then use the enable (gbl-ns-vol-shr) command to retry the import.
Error: Directory collision; Unable to guarantee strict-attribute-consistency.	(multi-protocol) A directory on this share has the same name and path as a directory on an already-imported share, but some of the CIFS attributes are obscured for at least one of them. Obscured CIFS attributes, due to filer-generated names for the directories, are common on a multi-protocol filer. The volume requires that all attributes (for CIFS and NFS) be synchronized for duplicate directories, and that is impossible under the circumstances. This can only occur for NFS-only directories, with names that are illegal in CIFS. If possible, change the directory name(s) so that they are accessible from CIFS. As an alternative, you can use no strict-attribute-consistency to remove the requirement for strict-attribute consistency; this reduces all undiscovered CIFS attributes to zero. Once the volume has stopped importing any shares, you can do this for all shares in the volume. Then restart this share import with the enable (gbl-ns-vol-shr) command.
Error: Directory name collision detected during import.	A directory on this share has the same name and path as a file on an already-imported share. For example, share B has a directory named /var/log but share A was already imported with a file named /var/log. To allow the volume to correct this by changing the directory name on import, you can use modify on the volume and import rename-directories on the share. Alternatively, you can directly access the filer(s) and correct the problem there. Retry this share import (with enable (gbl-ns-vol-shr)) after you address the issue.
Error: Dynamic Import operation failed due to a collision.	Two or more of the volumes shares had common file/directory names that somehow collided, causing one of the shares to fail its import. The following collisions can cause this failure: A file in share A has the same name and path as a file in share B. A directory in share A has the same name and path as a file in share B. A directory in share A has the same name and path as a directory in share B, and the directories have different attributes (such as permissions). If they had the same attributes, they would not collide. A file or directory in share A has a CIFS case collision with a file or directory on share B, and the volume is set for no cifs case-sensitive. For example, myDir/MYFILE.doc on share A could collide with myDir/myFile.doc on share B. All duplicate files and naming inconsistencies are recorded in the import reports for the share. These reports are named import.job-id.share-name.share-id.rpt. Use show reports type Imp to list all import reports, and use show reports report-name to read a report. Using the import report for this share, resolve all file collisions and naming inconsistencies before re-importing. Go to the filers and rename the files, move them, and/or resolve that certain file renames are acceptable. You can also use some share-import options to have the volume automatically rename files, rename directories, or reset directory attributes in this share during import (import rename-files, import rename-directories, or import sync-attributes). If you use any share-import options, use the gbl-ns-vol reimport-modify and modify commands to allow modification (renames) on import. Then re-import the share with the enable (gbl-ns-vol-shr) command.
Error: Dynamic Import operation failed.	The share import failed for an undetermined reason. Run the collect diag-info CLI command to collect diagnostic information, then contact F5 Support.
Error: Dynamic Import operation timed out.	An internal import operation timed out, possibly due to a filer-connectivity issue. Use the show exports command and/or ping to troubleshoot the connection to the filer.
Error: Encountered file(s) with more than 1024 hard links during import.	The managed volume software supports a maximum of 1024 hard links per file. One or more files on this back-end share exceed this limit. These files are recorded in the shares import report, named import.job-id.share-name.share-id.rpt. Use show reports type Imp to list all import reports, and use show reports report-name to read a particular report. Then access the filer directly to reduce the number of hard links for all of these files. After you correct the problem, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Export In Use By Another Switch	The filer share contains a hidden directory, .acopia, written by a different ARX. Two ARXes cannot import the same share. If the share is not imported by another switch anymore, remove the directory manually. If this happens to all shares after a switch replacement, the old switchs UUID was not properly applied to the replacement switch. Consult the appropriate Hardware Installation manual for switch-replacement instructions. After you correct the problem, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Export is read-only, cannot import.	Check the share configuration at the filer: the ARX requires read/write access throughout the shares directory tree. Use the show exports command to examine all permission settings at the filer. Use the following guidelines for permissions problems: For NFS exports, check your back-end filer configuration: the back-end share should allow root access to all of the ARXs proxy IP addresses. Use the show ip proxy-addresses command to list all configured proxy IP addresses. For CIFS shares, the switch uses the namespaces proxy user as its identity. The proxy user, created by the proxy-user command, must belong to the Administrators group. The proxy-user (gbl-ns) command sets the proxy user for a namespace. Once the permissions issue is resolved, you can re-import the share with the enable (gbl-ns-vol-shr) command.
Error: Failed import initialization due to filer full condition.	The back-end share is full, so the ARX volume could not create the .acopia directory and/or write some small files to mark the share. Go to the filer and clear out some disk space before you retry the import. Once some space is free, you can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Failed import initialization due to permissions or access error.	This indicates permissions problems at the back-end filer. Use the show exports command to examine all permission settings at the filer. Use the following guidelines for permissions problems: For NFS exports, check your back-end filer configuration: the back-end share should allow root access to all of the ARXs proxy IP addresses. Use the show ip proxy-addresses command to list all configured proxy IP addresses. For CIFS shares, the switch uses the namespaces proxy user as its identity. The proxy user, created by the proxy-user command, must belong to the Administrators group. The proxy-user (gbl-ns) command sets the proxy user for a namespace. Once the permissions issue is resolved, you can re-import the share with the enable (gbl-ns-vol-shr) command.
Error: Failed to Contact Filer.	The back-end device could not be located with the IP address configured for the filer. From gbl-ext-filer mode, use the ip address command to reset the filers address. Use the show exports command, expect traceroute, and/or ping to check the connection to the filer. After the filer connection is re-established, you can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Failed to contact filer for attribute lookup.	(NFS) These errors indicate an NFS-server problem at the filer. Once the filers NFS service is restored, you can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Failed to contact portmap service during import scan.
Error: Failed to create a file/directory on filer.	This may indicate a full disk on the back-end filer or permissions problems. Use the show exports command to examine all permission settings at the filer. Use the following guidelines for permissions problems: For NFS exports, check your back-end filer configuration: the back-end share should allow root access to all of the ARXs proxy IP addresses. Use the show ip proxy-addresses command to list all configured proxy IP addresses. For CIFS shares, the switch uses the namespaces proxy user as its identity. The proxy user, created by the proxy-user command, must belong to the Administrators group. The proxy-user (gbl-ns) command sets the proxy user for a namespace. Once the permissions issue or space issue is resolved, you can re-import the share with the enable (gbl-ns-vol-shr) command.
Error: Failed to create directory collision due to open CIFS file in path.	(multi-protocol) A directory on this back-end share has a case collision with an already-imported directory, and a CIFS client has a file open in the already-imported directory. For example, suppose the volume imports /vol/mydir from one share, a client connects and opens a file in that share (/vol/mydir/myfile.exe), and then the volume attempts to import a second share with /vol/MYDIR. The volume must mark the first share as NFS-only for the import to proceed, but cannot as long as the client holds myfile.exe open. The second share therefore fails its import. You can use show cifs-service open-files to find the open file, close cifs file to close it, and then retry the share import (with the enable (gbl-ns-vol-shr) command).
Error: Failed to find valid mount version during import scan.	(NFS) These errors indicate an NFS-server problem at the filer. Once the filers NFS service is fully restored, you can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Failed to mount filer during import scan.
Error: Failed to open NFS connection to filer during import scan.
Error: Failed to resolve IP address for filer.	The back-end device could not be located with the filer name or IP address configured for the filer. From gbl-ext-filer mode, use the ip address command to reset the filers address. Use the show exports command and/or ping to troubleshoot the connection to the filer. After the filer connection is re-established, you can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Failed to retrieve Kerberos information.	(CIFS) The namespace supports Kerberos authentication (see cifs authentication), but the namespace software is unable to confirm that the share is configured to support Kerberos, too. Check the connection to the back-end filer with show exports and/or ping. Restart the import (with enable (gbl-ns-vol-shr)) after you correct the problem.
Error: Failed to take pathlock due to internal operation in progress.	The share import failed due to an internal-software conflict, possibly due to a timing issue or a brief filer-connectivity issue. Retry the import by using the enable (gbl-ns-vol-shr) command on this share. If this error returns, contact F5 Support.
Error: Failed to unmount filer during import scan.	(NFS) Persistent errors from a back-end share caused the mount to fail. Check the NFS service at the back-end filer. Once the filers NFS service is fully restored, you can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: File collision detected during import.	A file on this share has the same name and path as a file on an already-imported share. To fix this, you can manually go to the filer and rename the file, or you can set the modify flag on this volume. By setting the modify flag, you allow the volume to rename the file on import. (If any other shares are still importing, you must wait for their imports to finish before you can use the modify command.) You must also have the default settings for import rename-files and import rename-directories on this share. Then restart the import with the enable (gbl-ns-vol-shr) command.
Error: File exists in CIFS, but not in NFS.	(multi-protocol) The share is configured for both NFS and CIFS, but a directory that is visible in the back-end-CIFS share is not found in the NFS export. The filer probably has two different names for the directory: one for CIFS clients and one for NFS clients. Check the directory at the back-end share, and rename it so that both versions have the same name. Alternatively, you can set the modify flag on this volume. By setting the modify flag, you allow the volume to rename the directory on import. (If any other shares are still importing, you must wait for their imports to finish before you can use the modify command.) You may also need to set import rename-directories unmapped-unicode for this share; this allows the volume to rename directories whose CIFS names do not map to the character encoding for NFS. Then restart the import with the enable (gbl-ns-vol-shr) command.
Error: filename collision.	A file on this share has the same name and path as a file on an already-imported share. To fix this, you can manually go to the filer and rename the file, or you can set the modify flag on this volume. By setting the modify flag, you allow the volume to rename the file on import. (If any other shares are still importing, you must wait for their imports to finish before you can use the modify command.) You must also have the default settings for import rename-files and import rename-directories on this share. Then retry the import.
Error: Filer does not have enough free space to perform import.	(NFS) The ARX creates a temporary database on each share during the import process: there is not enough room on this share to create the database. The database requires at least 100 MegaBytes of free space. Clear some free space at the filer share, then restart the import with the enable (gbl-ns-vol-shr) command.
Error: Filer does not provide an NFS filehandle for a file in its directory listing.	(multi-protocol) The filer provided a file name in an NFS READDIR call, but did not translate that file name into a filehandle in a subsequent LOOKUP call. Some multi-protocol filers behave this way when a CIFS file name has characters that are not supported by NFS; the filer returns the UTF-8 version of the file name for the READDIR call, which it later rejects in a subsequent LOOKUP call. The ARX can see the file in the directory listing, but cannot get access to the file itself. Rename the file at the filer share, then use nsck ... rebuild volume to reimport all shares in the volume.
Error: Filer does not support specified protocols.	The protocol(s) configured for the back-end share are not actually supported at the filer. Use the show exports command to check the protocols supported by the filer. Use the show global-config namespace command to view the required protocols for the namespace. The share must support all of the namespaces protocols. You can remove the share from the volume (with no share), or you can add protocol support at the back-end filer. If you add the protocol support to the filer, you can then restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Filer error during import.	This may indicate a disk failure at the external filer. Correct the filer issue and retry the import (with the enable (gbl-ns-vol-shr) command).
Error: Filer generated name collision is not supported by filer.	(multi-protocol) The share contains an entry whose filer-generated name (FGN) matches a real name in an already-imported share, or whose real name conflicts with an already-imported FGN. The volume is backed by a mix of Hitachi HNAS (BlueArc) filers and filers from other vendors, and this naming conflict is not supported for this vendor combination. The import report shows the name of the conflicting file or directory. The name appears with an FC notation. The report is named import.job-id.share-name.share-id.rpt. Use show reports to list all import reports and read their contents. Using the import report, resolve all of these name collisions before re-importing. Go to the filer to rename the files and/or directories. Then use enable (gbl-ns-vol-shr) to re-import the share.
Error: Filer operation returned an unexpected error, see logs for more information.	The back-end filer behind this share returned an error that the ARX does not recognize. You can use the show logs syslog command to view the system log and learn more about the circumstances around the failure. We recommend that you contact F5 Support if you see this import error. You may be requested to run the collect command, which assembles diagnostic information for F5 Engineering. After the issue is resolved, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Filer returned invalid link count for a file.	The import failed because the back-end filer returned a link count of zero or a negative number for a file, which is invalid. A files link count should be one or more. The ARX syslog contains the file with the invalid link count; use grep link count logs syslog to find the path. Use this path to help diagnose and correct the filer issue. Then use the enable (gbl-ns-vol-shr) command to retry the import.
Error: Hard Links Inconsistent	(NFS) One or more files in the exported directory have hard links from outside the directory. That is, the switch tried to import a hard link to file X but detected that there was at least one more hard link to file X in some other directory, not included in the NFS export. Remove the hard links from the external directories and retry the share import.
Error: Hard Links Not Supported	(CIFS) Hard-links exist in a CIFS share (not supported in CIFS by the ARX).
Error: I/O error encountered talking to filer.	Use the show exports command and/or ping to check the connection to the filer. Restart the import (with enable (gbl-ns-vol-shr)) after the connection is restored.
Error: Import database I/O failure.	(NFS) The ARX creates a temporary database during the import process. The database was deleted while the import was underway. This may indicate that other clients are bypassing the ARX to access the share, which is an unsupported configuration. You can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Insufficient files reserved for the volume.	This share contains more files than the volume can hold. Use the auto reserve files command to automatically increase the number of files that this volume can hold as the volume grows. If you prefer to manually set the maximum files for the volume, use reserve files to manually increase the maximum. Then restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Insufficient free space to store metadata.	A volumes metadata share requires gigabytes of free space; the one chosen for this volume has less than one-half gigabyte. Choose a metadata share with more free space: use the metadata share command to configure a new metadata share. After you choose another metadata share, or clear up several gigabytes of free space on the current metadata share, you can use the enable (gbl-ns-vol-shr) command to restart the import.
Error: Internal IPC communications failure during import.	These errors each indicate an internal software problem. Run the collect diag-info CLI command to collect diagnostic information, then contact F5 Support. Once the issue is understood, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Internal thread error during import.
Error: Maximum number of namehash collisions for a filename reached in a directory.	A directory in this share has too many entries (files and/or subdirectories) whose names differ only in case (for example, thisFile.txt, THISfile.txt, thisFILE.txt, and so on). The limit on case collisions for a single entry name is over 16,000. A client tried to create a new entry that would exceed the limit for a particular entry name, and the volume blocked the action with an access denied error. You can resolve this issue by accessing the volume as a client and moving as many of the file entries as possible. Create a new directory to hold many of them, or rename them to a non-matching name. For example, you could change the earlier examples to thatFile.txt, THATfile.txt, and so on to stop them from making a case-insensitive match with thisfile.txt. The specific directory and file name appears in a syslog message labeled ERROR_MAX_HASH_COLLISIONS. Use grep ERROR_MAX_HASH_COLLISIONS logs syslog to search for this error in the syslog. Note that the colliding names are usually case collisions, but not always. The collision occurs after a mathematical conversion of the file names, called a hash. After you clear enough colliding files from the directory, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Maximum Path Length Exceeded	A path to one of the files exceeds the maximum, 1024 characters. You must shorten the path(s) to import this share. Once all of the shares paths are below 1024 characters, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Metadata database I/O failure.	There was a database I/O failure for the share. This may be caused by a transient network error, or a filer problem. You can use the show exports command to check the filer and connection for common problems. Once the external problem is resolved, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Metadata filer configuration is invalid. Data written has been lost, corrupting the database.	This is not an import error: it typically occurs while the volume is providing service. This condition disables the volume. Some of this shares metadata was lost at the volumes metadata share. This indicates that the metadata share did not synchronously write its data; it wrote the data to a cache, told the ARX that the write succeeded, and then lost the data between the cache and the disk. This is only possible on an NFS export where either the async option was set, or async is the default for the NFS implementation (as with some releases of Linux) CIFS shares do not have this problem. At the filer, set the sync option for the NFS export. We also recommend that you specify the no_wdelay option. Use nsck ... rebuild volume to re-initialize the metadata share and reimport all shares in the volume.
Error: Metadata share unavailable during import.	The switch could not contact the metadata share. Use the show exports command and/or ping to check the connection to the metadata shares filer. The show export command also verifies that the share is accessible by root (for NFS shares) or the namespaces proxy-user (gbl-ns) (for CIFS shares). After the connection is re-established, restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Mismatched NFS filename encoding.	(multi-protocol) The NFS character-encoding setting for the namespace does not match the character encoding supported at the filer. If this share was imported, lost NFS files could result. Reset the namespace character encoding (using the character-encoding nfs command) and retry the import. You can use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Mount to filer failed.	(NFS) The switch was unable to NFS-mount the filer share. Check the NFS service at the back-end filer.
Error: Multi-protocol share is split.	(multi-protocol) The filer command specified an NFS export and a CIFS share over two different directory trees. This is unsupported. Retry the command with the correct share and export names, then retry the import with enable (gbl-ns-vol-shr).
Error: Multi-protocol user mapping error. (nfs read failure)	(multi-protocol) During import, the volume creates a test file through CIFS and then attempts to read it through NFS. The volume was unable to read the file as root. Check the NFS configuration at the back-end share, correct the problem, and retry the import (enable (gbl-ns-vol-shr)).
Error: Multi-protocol user mapping error. (nfs remove failure)	(multi-protocol) During import, the volume creates a test file through CIFS and then attempts to delete it through NFS. The volume could read and write the file (as root), but was unable to remove it. This may indicate a permissions problem in the top-level directory for the share. Check the NFS configuration at the back-end share, correct the problem, and retry the import (enable (gbl-ns-vol-shr)).
Error: Multi-protocol user mapping error. (nfs write failure)	(multi-protocol) During import, the volume creates a test file through CIFS and then attempts to write to it through NFS. The volume could read the file, but was unable to write to it (as root). Check the NFS configuration at the back-end share, correct the problem, and retry the import (enable (gbl-ns-vol-shr)).
Error: NFS connect failed.	(NFS) Persistent NFS errors from a back-end share caused the import to fail. Check the NFS service at the back-end filer. After the filers NFS service is fully restored, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: NFS error during import scan.
Error: NFS error occurred during import scan.
Error: NFS Error while scanning storage
Error: NFS Version Mismatch	(NFS) The back-end share does not support the NFS version(s) configured for the external filer. Use the show exports command to check the protocols supported by the filer. Use the filer command to change the configured NFS version(s) for the share/export.
Error: NFSv2 error during import scan.	(NFS) Persistent NFS errors from a back-end share caused the import to fail. Check the NFS service at the back-end filer. After the filers NFS service is fully restored, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: NFSv3 error during import scan.
Error: Network communications failure during import scan.	Use the show exports command, expect traceroute, and/or ping to troubleshoot the connection to the filer. After the filer connection is re-established, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Network error or timeout during CIFS attributes check.	(CIFS) A connection error occurred in the middle of a CIFS-permissions test. Use the show exports command, expect traceroute, and/or ping to troubleshoot the connection to the filer. Once the connection is fully restored, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Network error or timeout during CIFS privilege check.
Error: Network error or timeout during CIFS write check.
Error: No CIFS write access.	The namespaces proxy-user does not have adequate privileges to write to this CIFS share, so the import failed. The proxy user must belong to the Administrators group on this filer. You can choose new, more-privileged credentials for your proxy user, or you can go to the filer and add the current proxy user to a more-privileged group. The probe exports command can verify that the new proxy-user credentials pass this write test. Then restart the import with the enable (gbl-ns-vol-shr) command.
Error: No space left on share, or share unreachable	The ARX got an error writing a database that is created as part of the import process. This database is created on the filer share itself, so the error indicates a problem with the filer. Clear some free space at the filer share, then restart the import with the enable (gbl-ns-vol-shr) command.
Error: No space on back-end device.
Error: Operation aborted at user request.	An administrator issued the cancel import command to stop this share import. You can restart the import with the enable (gbl-ns-vol-shr) command.
Error: Permission Denied	This indicates that the ARX did not have proper permissions to connect to the back-end filer. For NFS exports, check your back-end filer configuration: the back-end share should allow access to all of the ARXs proxy IP addresses. Use the show exports command to check the filers permissions and configuration. Use the show ip proxy-addresses command to list all configured proxy IP addresses. For CIFS shares, the switch uses the proxy user for the namespace; the proxy-user (gbl-ns) command sets these credentials. The proxy user must belong to the Administrators group. After the permissions problem is corrected, you can restart the import with the enable (gbl-ns-vol-shr) command.
Error: Protocol specific error, see logs for more information.	(CIFS) The back-end filer returned an unexpected CIFS error during import. The syslog shows the specific error. Use show logs syslog to read the syslog, or grep string logs syslog to search for a specific string in the syslog. You may need to escalate to F5 Support. After you correct the error, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Proxy User does not map to root user via NFS.	(multi-protocol) The proxy user is a Windows username and password that the volume can use as its identity for share import and for policy operations. In a multi-protocol (CIFS and NFS) namespace, the proxy user on the Windows side must map to the root user on the UNIX side. You can select a new proxy user for the namespace with the command. If necessary, map the proxy user to root at the filer itself; the ARX Site Planning Guide has instructions for creating this mapping on common multi-protocol filers.
Error: Remove incomplete: found files on share.	An administrator failed to remove the share with no share because client-visible files are still present on the share. Use the remove-file-entries option to remove all of the file entries from the volume; this produces a client-visible effect, so do this with caution. Alternatively, you can use remove-share nomigrate.
Error: Root Squash is Enabled	(NFS) This indicates that the ARX did not have proper permissions to create files at the back-end filer. Check your back-end filer configuration: the back-end share should have no-root-squash set for all of the ARXs proxy IP addresses. (On some filers, you accomplish this by mapping the anonymous user to UID 0 (zero).) Use the show exports command to check the filers permission settings. Use the show ip proxy-addresses command to list all configured proxy IP addresses. Once the filers root-squash option is disabled, you can restart the import with the enable (gbl-ns-vol-shr) command.
Error: RPC error during import scan.	(NFS) Persistent NFS errors from a back-end share caused the import to fail. Check the NFS service at the back-end filer. After the filers NFS service is fully restored, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Share attributes incompatible with volume attributes.	(CIFS) The CIFS attributes set for the volume (with compressed-files, named-streams, persistent-acls, sparse-files, and/or unicode-on-disk) are not all supported at the back-end share. Use the show exports command to check the supported CIFS attributes for the share. You can remove the share from the volume (with no share) or disable the conflicting CIFS attribute(s) in the managed volume. If you elect to keep the share in the volume, use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Share does not support Kerberos authentication.	(CIFS) The namespace supports Kerberos authentication (see cifs authentication), but this share does not. The share must support extended security negotiations for the import to succeed. Also, the ARX needs the correct service-principal name (SPN) for the filer; you can use show exports ... capabilities to verify that the ARX has discovered the correct SPN for the filer, or you can use the spn command to set it manually. After you ensure that the filer support Kerberos and the ARX has the filers SPN, you can restart the import (enable (gbl-ns-vol-shr)). Alternatively, you can remove the share from the volume with no share.
Error: Share type does not match namespace supported protocols.	Each back-end share must support all of the namespaces configured protocols (any combination of NFSv2, NFSv3(/UDP), NFSv3/TCP, and CIFS). Use the show global-config namespace command to view the namespaces protocols. You can remove the share from the volume (with no share) or enable the missing service(s) at the filer. If you elect to keep the share in the volume, use the enable (gbl-ns-vol-shr) command to restart the share import.
Error: Specified export is not a directory.	The export name is incorrect in the external-filer configuration. Use the filer command to change the configured name for the share/export.
Error: Specified export is too long.
Error: Specified export not found on filer.
Error: Stat of a file/directory failed during storage init.	(NFS) The ARX was unable to access the attributes of a file or directory. Check the NFS service at the back-end filer. To check the ARXs connectivity to the filer and perceived permissions at the filer, use show exports. You can restart the share import with enable (gbl-ns-vol-shr) after you resolve the filer issue.
Error: Storage is already in use by this switch pair.	The share is already imported into another managed volume on this switch (or its redundant peer). Evidently, the back-end share has at least one alias and it was previously imported under another name. A share can only be managed by one volume at a time, under a single name. From gbl-ns-vol-shr mode in the CLI, use no filer to detach from the back-end share. Then choose another back-end path with the filer command, or use no share to remove the share from the volume. To restart the import (with or without this share), use nsck ... rebuild volume to reimport all shares in the volume.
Error: Storage remove failed because pending directory operations could not be flushed.	Someone attempted to remove a share (with no filer, no share, remove-share migrate, remove-share nomigrate, or remove service), and an internal error caused the removal to fail. Contact F5 Support if you see this message.
Error: Unable To Connect to CIFS Share.	The connection to the back-end CIFS share failed due to possible configuration errors or a broken connection to the back-end filer. Use the show exports command, expect traceroute, and/or ping to troubleshoot the connection to the filer. Once the connection is fully established, you can restart the share import with the enable (gbl-ns-vol-shr) command.
Error: Unable to read file due to stale filehandle.	(NFS) The filer provided a filehandle in response to an earlier NFS call, and is now pronouncing it stale. This is inconsistent filer behavior; it may indicate that NFS clients are bypassing the ARX to access the share. Check the filer share and correct the problem there. Once the filer issue is corrected, use nsck ... rebuild volume to reimport all shares in the volume.
Error: Unexpected CIFS privilege check failure.	A CIFS-permission test failed at the filer for an undetermined reason. This may be a filer issue or a connectivity issue. Check the filer and the connection, and retry the share import (with enable (gbl-ns-vol-shr)). If this error stops the import a second time, run the collect diag-info CLI command to collect diagnostic information and contact F5 Support.
Error: Unexpected CIFS write check failure.
Error: Unresolvable case-blind name collision.	(CIFS) A file on this share has the same name and path as a file on an already-imported share, based on a case-blind comparison, and the volume is configured with no cifs case-sensitive. That is, some of the characters have differing cases, but the characters match (for example, index.htm matches index.HTM). If the volume is not case-sensitive, it cannot see the difference between the two names. You have three options to address this error: Manually go to the filer and rename the file. Set the modify flag on this volume. By setting the modify flag, you allow the volume to rename the file on import. You must wait for all the volumes shares to finish importing before you can use this command. Use cifs case-sensitive to make the volume case-sensitive. Then retry the import with the enable (gbl-ns-vol-shr) command.
Import Interrupted	An administrator stopped the import with the cancel import command. You may be able to restart the import with no enable (gbl-ns-vol-shr) and then enable. If the import was stopped too far in the process, you must first use nsck ... destage to shut down the volume, remove and re-add the share, then enable the volume again.
Internal Error (number)	Internal problem; contact F5 personnel.
Metadata Only	The share is designated to store namespace metadata only, so there are no client-accessible files to import. This serves as an explanation; it is not an import error.
Offline: Volume Disabled	No imports are possible unless the volume is enabled. Use the enable (gbl-ns, gbl-ns-vol) command to enable the volume.
Offline: Volume Failed	The metadata share for the volume failed to import. Use metadata share to designate a new dedicated share for metadata.
Remove Interrupted	An administrator stopped the share removal with the cancel remove command. To restart the removal process, use remove-share migrate, remove-share nomigrate, no share, or no filer.
Storage job aborted.	The import process was interrupted by an nsck ... rebuild force. The rebuild operation will re-import the share.
Storage job aborted: DNAS is shutting down.	DNAS, the internal name for volume software, is shutting down. This may be the result of administrative action, such as a remove service, during the import. The volume has stopped running, so the import is canceled.
Uninitialized (No filer assigned)	Use the filer command to assign a filer to the share, then retry the import.

Purpose	Use the show namespace mapping command to view the back-end shares behind a namespace.
Mode	(any)
Security Role(s)	crypto-officer or storage-engineer
Syntax	show namespace mapping show namespace mapping namespace show namespace mapping namespace volume vol-path   namespace (1-30 characters) focuses on one namespace. Without this, the command displays the shares behind all namespaces. vol-path (1-1024 characters) focuses on one volume.
Guidelines	The output is a two-column table with the namespace and volume in the left column and the physical filer shares in the right column. For direct volumes, this shows one line per attach point. The word, [replica-snap], appears next to any replica-snap shares. Use show server-mapping to show all of the filer shares behind client-side share, from a front-end service such as cifs or nfs.
Sample(s)	bstnA# show namespace mapping shows filer shares behind all namespaces. For sample output, see Figure 21.7 on page 21-68.   bstnA# show namespace mapping wwmed volume /acct shows the back-end shares behind a particular volume. See Figure 21.8 on page 21-69.
Related Commands	show namespace show server-mapping show global-config namespace

Purpose	Use the show namespace status command to view the import status of a namespace.
Mode	(any)
Security Role(s)	crypto-officer, storage-engineer, network-engineer, network-technician, or operator
Syntax	show namespace status namespace show namespace status namespace volume vol-path show namespace status namespace volume vol-path share share-name show namespace status all   namespace (1-30 characters) identifies a namespace. vol-path (1-1024 characters) focuses on one volume. share-name (1-64 characters) narrows the focus to a single share. all displays status for all namespaces.
Guidelines	A managed-volume share imports files from its back-end filer when it is enabled and its parent volume is also enabled. A direct-volume share does not import; it only connects to its attach points (see attach). Use enable (gbl-ns-vol-shr) to enable a share, and use enable (gbl-ns, gbl-ns-vol) to enable a volume. This shows one table for each namespace and a sub-table for each volume. The top row of each volume table contains the name of the volume and its status. The Status is one of these values: Enabled - Available for client access. Starting indicates that the volume software is starting. This can occur after enabling the volume, after an ARX reload, or after an nsck ... rebuild. Stopping means that the volume software is shutting down. An nsck ... destage or nsck ... rebuild can cause this. Migrating shows that the volume is migrating its metadata from one share to another. The nsck ... migrate-metadata command starts a metadata migration. Disabled indicates that the volume is administratively disabled. Shares are grouped under their volumes. For each share, this shows the Share name (or metadata-share for a metadata-only share), the name of the external Filer, the NFS Export or CIFS Share behind this namespace share, and the Status of the share. An [rs] appears before a replica-snap share, which holds snapshots of a standard share in the same volume.
Guidelines: Share Status	In the Status column, the following messages show the progress of a successful import: Pending - Scheduled for import. Importing - Actively inventorying the back-end storage. Online - Import completed successfully, back-end storage is ready to be used. A direct share goes directly to this state. The following status conditions may also appear: Disabled means that someone issued a no enable for the share or its volume. Offline means that the volume lost contact with the back-end filer, or that someone disabled the share with no enable. Use show exports to check the connection with the filer. Interrupted indicates that the ARX lost contact with the filer during the import. Error shows that the import failed; use show namespace for a more-detailed error message. Removing metadata appears when the share is being removed from the namespace. (Use no share, remove-share migrate, or remove-share nomigrate to remove a share.) Updating Probes occurs after an upgrade to a new software release (see boot system). The initial import of the share used a now-outdated probe to prove that the share is viable for import, so the volume is now running the latest probe test. This status should change to Online very quickly; examine the share with show exports and/or probe exports if this status persists for a long period of time. Uninitialized means that no one has assigned a filer to the share. Use the show namespace command for more-detailed progress and error messages.
Sample(s)	bstnA# show namespace status all shows volume shares and filer import status for all configured namespaces. For sample output, see Figure 21.9 on page 21-71.   bstnA# show namespace status wwmed shows volume shares and filer import status for the wwmed namespace. See Figure 21.10 on page 21-73.   bstnA# show namespace status wwmed volume /acct shows volume shares and filer import status for the wwmed~/acct volume. See Figure 21.11 on page 21-74.
Related Commands	show namespace show global-config namespace enable (gbl-ns-vol-shr) enable (gbl-ns, gbl-ns-vol)

Purpose	If a CIFS service has MMC browsing enabled, only authorized Windows clients can manage the service. You can use the windows-mgmt-auth command to create a Windows-management-authorization (WMA) group, a list of Windows clients with MMC permissions, and then you can use this command to apply one or more such groups to the current namespace. You can also use this command to select privileged CIFS clients who can access snapshots. (This command has no effect on snapshot access by NFS clients.) Use no windows-mgmt-auth to remove a WMA group from the current namespace.
Mode	gbl-ns
Security Role(s)	storage-engineer or crypto-officer
Syntax	windows-mgmt-auth name no windows-mgmt-auth name   name (1-64 characters) identifies the WMA group.
Default(s)	None
Guidelines	Each WMA group has special MMC access to the namespace. The Windows clients in the group share the same MMC permissions. All cifs services backed by this namespace (if they have browsing enabled) use the WMA group(s) that you identify with this command. You can also use WMA groups to manage CIFS-client access to snapshots. Use the permit snapshot monitor (see permit (gbl-mgmt-auth)) command to allow group members to view snapshots, and use the snapshot privileged-access command in any volume where the group(s) should access snapshots. Use this command multiple times to associate multiple WMA groups with the namespace. The show windows-mgmt-auth command shows all available groups and their configurations. If a single front-end cifs service has exports from more than one namespace, this set of WMA groups must be the same for all of the exported namespaces. (The export (gbl-cifs) command exports a namespace volume through CIFS.) If this command makes the current namespace inconsistent with the other namespace(s) behind the same CIFS service, the CLI prompts with an opportunity to make the same change in the other namespace(s). Enter yes to allow the CLI to propagate the change to the other namespace(s).
Samples	bstnA(gbl-ns[medarcv])# windows-mgmt-auth testers bstnA(gbl-ns[medarcv])# windows-mgmt-auth fullAccess bstnA(gbl-ns[medarcv])# windows-mgmt-auth readOnly associates three WMA groups to the medarcv namespace. A Windows client in one of these groups has the MMC permissions defined in the group. No other Windows client has MMC access to the namespace.   bstnA(gbl-ns[medarcv])# no windows-mgmt-auth testers removes a WMA group, testers, from the medarcv namespace.
Related Commands	windows-mgmt-auth show windows-mgmt-auth