### Enable Onboard Key Manager (Example) Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/enable-onboard-key-management-96-later-nse-task.adoc This example demonstrates starting the key manager setup command without requiring the passphrase after every reboot. Ensure you use a strong passphrase that meets the length requirements. ```bash security key-manager onboard enable -cc-mode-enabled no ``` -------------------------------- ### Key Manager Setup Wizard Example Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/enable-onboard-key-management-95-earlier-nse-task.adoc This example demonstrates the interactive prompts during the key manager setup wizard when not enforcing CC mode. It shows where to confirm the use of onboard key management and enter the cluster-wide passphrase. ```cli cluster1::> security key-manager setup Welcome to the key manager setup wizard, which will lead you through the steps to add boot information. ... Would you like to use onboard key-management? {yes, no} [yes]: Enter the cluster-wide passphrase: <32..256 ASCII characters long text> Reenter the cluster-wide passphrase: <32..256 ASCII characters long text> ``` -------------------------------- ### Example: Rocky Linux 8 Repository Setup Source: https://github.com/netappdocs/ontap/blob/main/mediator/enable-access-repos-task.adoc This example demonstrates the sequence of commands to enable repositories and verify the list on Rocky Linux 8. ```shell [root@localhost ~]# dnf config-manager --set-enabled baseos [root@localhost ~]# dnf config-manager --set-enabled appstream [root@localhost ~]# dnf clean all [root@localhost ~]# dnf repolist repo id repo name appstream Rocky Linux 8 - AppStream baseos Rocky Linux 8 - BaseOS [root@localhost ~]# ``` -------------------------------- ### Example: Rocky Linux 10 Repository Setup Source: https://github.com/netappdocs/ontap/blob/main/mediator/enable-access-repos-task.adoc This example demonstrates the sequence of commands to enable repositories and verify the list on Rocky Linux 10. ```shell [root@localhost ~]# dnf config-manager --set-enabled baseos [root@localhost ~]# dnf config-manager --set-enabled appstream [root@localhost ~]# dnf clean all [root@localhost ~]# dnf repolist repo id repo name appstream Rocky Linux 10 - AppStream baseos Rocky Linux 10 - BaseOS [root@localhost ~]# ``` -------------------------------- ### Example: Rocky Linux 9 Repository Setup Source: https://github.com/netappdocs/ontap/blob/main/mediator/enable-access-repos-task.adoc This example demonstrates the sequence of commands to enable repositories and verify the list on Rocky Linux 9. ```shell [root@localhost ~]# dnf config-manager --set-enabled baseos [root@localhost ~]# dnf config-manager --set-enabled appstream [root@localhost ~]# dnf clean all [root@localhost ~]# dnf repolist repo id repo name appstream Rocky Linux 9 - AppStream baseos Rocky Linux 9 - BaseOS [root@localhost ~]# ``` -------------------------------- ### Start Statistics Collection Example Source: https://github.com/netappdocs/ontap/blob/main/smb-hyper-v-sql/determine-statistics-objects-counters-task.adoc This example demonstrates starting statistics collection for the 'client' object and displaying initial counter values. Note that output is truncated. ```cli statistics start -object client -sample-id Object: client Counter Value -------------------------------- -------------------------------- cifs_ops 0 cifs_read_ops 0 cifs_read_recv_ops 0 cifs_read_recv_size 0B cifs_read_size 0B cifs_write_ops 0 cifs_write_recv_ops 0 cifs_write_recv_size 0B ``` -------------------------------- ### Start Cluster Setup Wizard Source: https://github.com/netappdocs/ontap/blob/main/system-admin/add-nodes-cluster-concept.adoc This command initiates the cluster setup wizard after exiting the node setup wizard and logging in. It guides the user through the process of integrating the node into the cluster. ```cli ::> cluster setup Welcome to the cluster setup wizard. ``` -------------------------------- ### Example: Start CIFS Server and Verify Status Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/stop-start-server-task.adoc This example demonstrates starting the CIFS server on SVM 'vs1' and then verifying its status. The output shows the server is 'up'. ```cli cluster1::> vserver cifs start -vserver vs1 cluster1::> vserver cifs show -vserver vs1 Vserver: vs1 CIFS Server NetBIOS Name: VS1 NetBIOS Domain/Workgroup Name: DOMAIN Fully Qualified Domain Name: DOMAIN.LOCAL Default Site Used by LIFs Without Site Membership: Authentication Style: domain CIFS Server Administrative Status: up ``` -------------------------------- ### Example: Verify SMB and Configure BranchCache (All Shares) Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/configure-branchcache-task.adoc Demonstrates enabling advanced privileges, verifying SMB 2.1 and 3.0 status, returning to admin privileges, creating a BranchCache configuration for all shares, and verifying the BranchCache setup. ```cli cluster1::> set -privilege advanced Warning: These advanced commands are potentially dangerous; use them only when directed to do so by technical support personnel. Do you wish to continue? (y or n): y cluster1::*> vserver cifs options show -vserver vs1 -fields smb2-enabled,smb3-enabled vserver smb2-enabled smb3-enabled ------- ------------ ------------ vs1 true true cluster1::*> set -privilege admin cluster1::> vserver cifs branchcache create -vserver vs1 -hash-store-path /hash_data -hash-store-max-size 20GB -versions enable-all -server-key "my server key" -operating-mode all-shares cluster1::> vserver cifs branchcache show -vserver vs1 Vserver: vs1 Supported BranchCache Versions: enable_all Path to Hash Store: /hash_data Maximum Size of the Hash Store: 20GB Encryption Key Used to Secure the Hashes: - CIFS BranchCache Operating Modes: all_shares ``` -------------------------------- ### Start Key Manager Setup (ONTAP 9.4+) Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/enable-onboard-key-management-95-earlier-nse-task.adoc Use this command to initiate the key manager setup wizard. The `-enable-cc-mode yes` option enforces passphrase entry after a node reboot, which is beneficial for NVE volumes. ```cli security key-manager setup -enable-cc-mode yes|no ``` -------------------------------- ### Example: Initiate FlexClone Split Source: https://github.com/netappdocs/ontap/blob/main/volumes/split-flexclone-from-parent-task.adoc This example demonstrates how to start the FlexClone split operation, including the confirmation prompt and the job queuing message. ```bash cluster1::> volume clone split start -vserver vs1 -flexclone clone1 Warning: Are you sure you want to split clone volume clone1 in Vserver vs1 ? {y|n}: y [Job 1617] Job is queued: Split clone1. ``` -------------------------------- ### Node Setup Wizard Prompt Source: https://github.com/netappdocs/ontap/blob/main/system-admin/add-nodes-cluster-concept.adoc This prompt appears when a new node boots and the Node Setup wizard starts on the console. It allows initial configuration or exiting the wizard. ```text Welcome to node setup. You can enter the following commands at any time: "help" or "?" - if you want to have a question clarified, "back" - if you want to change previously answered questions, and "exit" or "quit" - if you want to quit the setup wizard. Any changes you made before quitting will be saved. To accept a default or omit a question, do not enter a value. Enter the node management interface port [e0M]: ``` -------------------------------- ### Example: Verify SMB and Configure BranchCache (Per Share) Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/configure-branchcache-task.adoc Demonstrates enabling advanced privileges, verifying SMB 2.1 and 3.0 status, returning to admin privileges, creating a BranchCache configuration for per-share caching, and verifying the BranchCache setup. ```cli cluster1::> set -privilege advanced Warning: These advanced commands are potentially dangerous; use them only when directed to do so by technical support personnel. Do you wish to continue? (y or n): y cluster1::*> vserver cifs options show -vserver vs1 -fields smb2-enabled,smb3-enabled vserver smb2-enabled smb3-enabled ------- ------------ ------------ vs1 true true cluster1::*> set -privilege admin cluster1::> vserver cifs branchcache create -vserver vs1 -hash-store-path /hash_data -hash-store-max-size 20GB -versions enable-all -server-key "my server key" cluster1::> vserver cifs branchcache show -vserver vs1 Vserver: vs1 Supported BranchCache Versions: enable_all Path to Hash Store: /hash_data Maximum Size of the Hash Store: 20GB Encryption Key Used to Secure the Hashes: - CIFS BranchCache Operating Modes: per_share ``` -------------------------------- ### Example: Starting disk replacement Source: https://github.com/netappdocs/ontap/blob/main/disks-aggregates/correct-misaligned-spare-partitions-task.adoc This command initiates the process to replace disk 1.0.1 with disk 1.0.10, aiming to align the spare partitions. ```cli c1::> storage disk replace -disk 1.0.1 -replacement 1.0.10 -action start ``` -------------------------------- ### Example: Enable BranchCache and Verify Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/enable-branchcache-existing-share-task.adoc This example demonstrates enabling BranchCache on a specific SMB share and then verifying the change. ```bash cluster1::> vserver cifs share show -vserver vs1 -share-name data2 Vserver: vs1 Share: data2 CIFS Server NetBIOS Name: VS1 Path: /data2 Share Properties: oplocks browsable changenotify showsnapshot Symlink Properties: - File Mode Creation Mask: - Directory Mode Creation Mask: - Share Comment: - Share ACL: Everyone / Full Control File Attribute Cache Lifetime: 10s Volume Name: - Offline Files: manual Vscan File-Operations Profile: standard cluster1::> vserver cifs share properties add -vserver vs1 -share-name data2 -share-properties branchcache cluster1::> vserver cifs share show -vserver vs1 -share-name data2 Vserver: vs1 Share: data2 CIFS Server NetBIOS Name: VS1 Path: /data2 Share Properties: oplocks browsable showsnapshot changenotify branchcache Symlink Properties: - File Mode Creation Mask: - Directory Mode Creation Mask: - Share Comment: - Share ACL: Everyone / Full Control File Attribute Cache Lifetime: 10s Volume Name: - Offline Files: manual Vscan File-Operations Profile: standard ``` -------------------------------- ### Start Key Manager Setup Source: https://github.com/netappdocs/ontap/blob/main/_include/enable-external-key-mgmt-95.adoc Initiates the KMIP key manager setup process on ONTAP nodes. This command must be run on all nodes in a MetroCluster environment. ```bash security key-manager setup ``` -------------------------------- ### Example: Enable and verify GPO support Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/enable-disable-gpo-support-task.adoc This example demonstrates enabling GPO support on SVM 'vs1' and then verifying the status. ```bash cluster1::> vserver cifs group-policy modify -vserver vs1 -status enabled cluster1::> vserver cifs group-policy show -vserver vs1 Vserver: vs1 Group Policy Status: enabled ``` -------------------------------- ### Example: Add and Verify Privileges Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/manage-local-privileges.adoc This example demonstrates adding specific privileges to a domain user and then verifying their application on the SVM. ```cli cluster1::> vserver cifs users-and-groups privilege add-privilege -vserver vs1 -user-or-group-name CIFS_SERVER\sue -privileges SeTcbPrivilege,SeTakeOwnershipPrivilege cluster1::> vserver cifs users-and-groups privilege show -vserver vs1 Vserver User or Group Name Privileges --------- --------------------- --------------- vs1 CIFS_SERVER\sue SeTcbPrivilege SeTakeOwnershipPrivilege ``` -------------------------------- ### Example: Add and Verify SeSecurityPrivilege Source: https://github.com/netappdocs/ontap/blob/main/smb-hyper-v-sql/add-sesecurityprivilege-user-account-task.adoc This example demonstrates adding the SeSecurityPrivilege to the 'EXAMPLE\SQLinstaller' account for SVM 'vs1' and then verifying its application. ```cli cluster1::> vserver cifs users-and-groups privilege add-privilege -vserver vs1 -user-or-group-name EXAMPLE\SQLinstaller -privileges SeSecurityPrivilege cluster1::> vserver cifs users-and-groups privilege show -vserver vs1 Vserver User or Group Name Privileges --------- --------------------- -------------- vs1 EXAMPLE\SQLinstaller SeSecurityPrivilege ``` -------------------------------- ### Enable CIFS Protocol (Example) Source: https://github.com/netappdocs/ontap/blob/main/smb-config/verify-protocol-enabled-task.adoc This example demonstrates how to enable the CIFS (SMB) protocol on an SVM named 'vs1.example.com'. ```text vs1::> vserver add-protocols -vserver vs1.example.com -protocols cifs ``` -------------------------------- ### Example home directory configuration commands Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/configure-home-directories-u-variable-task.adoc This example demonstrates a sequence of commands to set up a home directory configuration, including creating a qtree, adding a share, and setting up name mapping. ```bash volume qtree create -vserver vs1 -qtree-path /vol/vol1/users vserver cifs share create -vserver vs1 -share-name %w -path %u -share-properties homedirectory vserver name-mapping create -vserver vs1 -direction win-unix -pattern mydomain\user1 -replacement unixuser1 ``` -------------------------------- ### Start Original Source SVM Source: https://github.com/netappdocs/ontap/blob/main/data-protection/reactivate-original-source-svm-task.adoc Starts the original source SVM if it was previously stopped. The example shows starting 'svm1'. ```cli vserver start -vserver ``` ```cli cluster_src::> vserver start svm1 ``` -------------------------------- ### Example ONTAP Mediator Installation with HTTPS and iSCSI Support Source: https://github.com/netappdocs/ontap/blob/main/mediator/install-mediator-pkg-task.adoc This example demonstrates the console output during the installation of ONTAP Mediator with both HTTPS and iSCSI support, including user prompts and system checks. ```bash [root@mediator_host ~]# tar -zxvf ontap-mediator-1.12.0.tgz ontap-mediator-1.12.0/ ontap-mediator-1.12.0/csc-prod-chain-ONTAP-Mediator.pem ontap-mediator-1.12.0/ONTAP-Mediator-production.pub ontap-mediator-1.12.0/tsa-prod-ONTAP-Mediator.pem ontap-mediator-1.12.0/csc-prod-ONTAP-Mediator.pem ontap-mediator-1.12.0/tsa-prod-chain-ONTAP-Mediator.pem ontap-mediator-1.12.0/ontap-mediator-1.12.0 ontap-mediator-1.12.0/ontap-mediator-1.12.0.sig ontap-mediator-1.12.0/ontap-mediator-1.12.0.tsr ontap-mediator-1.12.0/ontap-mediator-1.12.0.sig.tsr [root@mediator_host ~]# ontap-mediator-1.12.0/ontap-mediator-1.12.0 ONTAP Mediator: Self Extracting Installer + Extracting the ONTAP Mediator installation/upgrade archive + Performing the ONTAP Mediator run-time code signature check Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls + Unpacking the ONTAP Mediator installer + ONTAP_MEDIATOR_INSTALL_HTTPS_ONLY is set to '0', args are: '' + Starting ONTAP Mediator install/update process: previous installation_mode is '' ONTAP Mediator can be installed with iSCSI and HTTPS support, or support for HTTPS only. Do you wish to install ONTAP Mediator with iSCSI and HTTPS support? Y(es)/n(o): yes ONTAP Mediator will be installed with mode: ISCSI_HTTPS + Selected install package mode: ISCSI_HTTPS + Checking that required ports 3260 and 31784 are free ONTAP Mediator requires two user accounts. One for the service (netapp), and one for use by ONTAP to the mediator API (mediatoradmin). Would you like to use the default account names: netapp + mediatoradmin? (Y(es)/n(o)): yes Enter ONTAP Mediator user account (mediatoradmin) password: Re-Enter ONTAP Mediator user account (mediatoradmin) password: + Checking if SELinux is in enforcing mode SELinux is set to Enforcing. ONTAP Mediator server requires modifying the SELinux context of the file /opt/netapp/lib/ontap_mediator/pyenv/bin/uwsgi from type 'lib_t' to 'bin_t'. This is necessary to start the ONTAP Mediator service while SELinux is set to Enforcing. Allow SELinux context change? Y(es)/n(o): yes The installer will change the SELinux context type of /opt/netapp/lib/ontap_mediator/pyenv/bin/uwsgi from type 'lib_t' to 'bin_t'. + Checking for default Linux firewall + Installing required packages. Last metadata expiration check: 2:16:00 ago on Tue 24 Mar 2026 12:58:28 PM EDT. ``` -------------------------------- ### Example: Create a home directory share with properties Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/add-home-directory-share-task.adoc This example demonstrates creating a home directory share named '%w' with additional properties like `oplocks`, `browsable`, `changenotify`, and `homedirectory`. ```bash cluster1::> vserver cifs share create -vserver vs1 -share-name %w -path %w -share-properties oplocks,browsable,changenotify,homedirectory ``` -------------------------------- ### Example: Create and show local user Source: https://github.com/netappdocs/ontap/blob/main/smb-config/create-local-user-accounts-task.adoc This example demonstrates creating a local user with a full name and then verifying its creation using the show command. It includes the interactive password prompt. ```bash cluster1::> vserver cifs users-and-groups local-user create -vserver vs1.example.com ‑user-name SMB_SERVER01\sue -full-name "Sue Chang" Enter the password: Confirm the password: cluster1::> vserver cifs users-and-groups local-user show Vserver User Name Full Name Description -------- -------------------------- ---------- ------------- vs1 SMB_SERVER01\Administrator Built-in administrator account vs1 SMB_SERVER01\sue Sue Chang ``` -------------------------------- ### Example: Mount a volume and verify Source: https://github.com/netappdocs/ontap/blob/main/nfs-admin/mount-unmount-existing-volumes-nas-namespace-task.adoc This example demonstrates mounting the 'sales' volume on SVM 'vs1' to the '/sales' junction path and then verifying its state. ```bash cluster1::> volume mount -vserver vs1 -volume sales -junction-path /sales cluster1::> volume show -vserver vs1 state,junction-path,junction-active vserver volume state junction-path junction-active --------- ---------- -------- --------------- ---------------- vs1 data online /data true vs1 home4 online /eng/home true vs1 sales online /sales true ``` -------------------------------- ### Install ONTAP Mediator (Console Output) Source: https://github.com/netappdocs/ontap/blob/main/mediator/install-mediator-pkg-task.adoc Example console output for a successful ONTAP Mediator installation. It shows the progress of OS package installations and the final success message, including log file locations. ```bash + Installing ONTAP Mediator. (Log: /root/ontap_mediator.CJqNqu/ontap-mediator-1.12.0/ontap-mediator-1.12.0/install_20260420120204.log) This step will take several minutes. Use the log file to view progress. Sudoer config verified ONTAP Mediator rsyslog and logging rotation enabled + Install successful. (Moving log to /opt/netapp/lib/ontap_mediator/log/install_20260420120204.log) + Note: ONTAP Mediator generated a self-signed server certificate for temporary use on this host. If the DNS name or IP address for the host is changed, the certificate will no longer be valid. The default certificates should be replaced with secure trusted certificates signed by a known certificate authority prior to use for production. For more information, see /opt/netapp/lib/ontap_mediator/README [root@mediator_host ~]# ``` -------------------------------- ### Example: Accessing and Booting Node from SP Console Source: https://github.com/netappdocs/ontap/blob/main/system-admin/access-system-console-node-task.adoc This example demonstrates accessing a node's system console from its SP, interacting with the loader prompt to boot ONTAP, and then exiting the console session. ```bash SP node2> system console Type Ctrl-D to exit. LOADER> LOADER> boot_ontap ... ******************************* * * * Press Ctrl-C for Boot Menu. * * * ******************************* ... ``` ```bash Connection to 123.12.123.12 closed. SP node2> ``` -------------------------------- ### Example: Create and show ONTAP qtree Source: https://github.com/netappdocs/ontap/blob/main/nfs-config/create-qtree-task.adoc This example demonstrates creating a qtree with a specific path and security style, then verifying its properties. ```bash cluster1::> volume qtree create -vserver vs1.example.com -qtree-path /vol/data1/qt01 -security-style unix [Job 1642] Job succeeded: Successful ``` ```bash cluster1::> volume qtree show -vserver vs1.example.com -qtree-path /vol/data1/qt01 Vserver Name: vs1.example.com Volume Name: data1 Qtree Name: qt01 Actual (Non-Junction) Qtree Path: /vol/data1/qt01 Security Style: unix Oplock Mode: enable Unix Permissions: ---rwxr-xr-x Qtree Id: 2 Qtree Status: normal Export Policy: default Is Export Policy Inherited: true ``` -------------------------------- ### Example: Create and Verify NFS Kerberos Configuration Source: https://github.com/netappdocs/ontap/blob/main/nfs-config/create-kerberos-config-task.adoc This example demonstrates enabling Kerberos on a LIF for a specific SVM with an SPN and OU, followed by verification of the configuration. ```cli vs1::> vserver nfs kerberos interface enable -lif ves03-d1 -vserver vs2 -spn nfs/ves03-d1.lab.example.com@TEST.LAB.EXAMPLE.COM -ou "ou=lab2ou" vs1::>vserver nfs kerberos-config show Logical Vserver Interface Address Kerberos SPN ------- --------- ------- --------- ------------------------------- vs0 ves01-a1 10.10.10.30 disabled - vs2 ves01-d1 10.10.10.40 enabled nfs/ves03-d1.lab.example.com@TEST.LAB.EXAMPLE.COM 2 entries were displayed. ``` -------------------------------- ### Issue a REST API call to get cluster version Source: https://github.com/netappdocs/ontap/blob/main/authentication/oauth2-rest-api.adoc After obtaining an access token, this example shows how to use it with a curl command to make a GET request to the ONTAP API to retrieve the cluster version. ```APIDOC ## Issue a REST API call to get cluster version ### Description After obtaining an access token, this example shows how to use it with a curl command to make a GET request to the ONTAP API to retrieve the cluster version. ### Method GET ### Endpoint `https:///api/cluster?fields=version` ### Parameters #### Path Parameters - **FQDN_IP** (string) - Required - The fully qualified domain name or IP address of the ONTAP management LIF. #### Query Parameters - **fields** (string) - Optional - Specifies which fields to return. `version` returns only the cluster version. #### Headers - **Authorization** (string) - Required - The OAuth 2.0 access token issued by the authorization server, prefixed with 'Bearer '. - **Accept** (string) - Optional - Specifies the desired response format. `*/*` accepts any format. ### Request Example ```bash curl --request GET \ --location "https://$FQDN_IP/api/cluster?fields=version" \ --include \ --header "Accept: */*" \ --header "Authorization: Bearer $ACCESS_TOKEN" ``` ### Response #### Success Response (200 OK) - **version** (string) - The ONTAP cluster version. ``` -------------------------------- ### Example: Enable and Verify SMB Signing Source: https://github.com/netappdocs/ontap/blob/main/smb-admin/enable-disable-required-signing-incoming-traffic-task.adoc This example demonstrates how to enable required SMB signing for SVM 'vs1' and then verify the setting. ```cli cluster1::> vserver cifs security modify -vserver vs1 -is-signing-required true cluster1::> vserver cifs security show -vserver vs1 -fields is-signing-required vserver is-signing-required -------- ------------------- vs1 true ``` -------------------------------- ### Install ONTAP Mediator with HTTPS Only Source: https://github.com/netappdocs/ontap/blob/main/mediator/install-mediator-pkg-task.adoc Execute the ONTAP Mediator installer script with the --https-only flag to enforce HTTPS-only communication. This example includes handling OCSP check warnings and setting up user accounts. ```bash [root@mediator_host ~]# ontap-mediator-1.12.0/ontap-mediator-1.12.0 --https-only ONTAP Mediator: Self Extracting Installer + Extracting the ONTAP Mediator installation/upgrade archive + Performing the ONTAP Mediator run-time code signature check Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls Error querying OCSP responder 40E72F35407F0000:error:1E800080:HTTP routines:OSSL_HTTP_REQ_CTX_nbio:failed reading data:crypto/http/http_client.c:596:40E72F35407F0000:error:1E800067:HTTP routines:OSSL_HTTP_REQ_CTX_exchange:error receiving:crypto/http/http_client.c:1045:server=http://ocsp.entrust.net:80 WARNING: The OCSP check failed while attempting to test the Code-Signature-Check certificate Continue without code signature checking (only recommended if integrity has been established manually)? y(es)/N(o): yes SKIPPING: Code signature check, manual override due to lack of OCSP response + Unpacking the ONTAP Mediator installer + ONTAP_MEDIATOR_INSTALL_HTTPS_ONLY is set to '1', args are: '' + Starting ONTAP Mediator install/update process: previous installation_mode is '' + Selected install package mode: HTTPS_ONLY + Checking that required port 31784 is free ONTAP Mediator requires two user accounts. One for the service (netapp), and one for use by ONTAP to the mediator API (mediatoradmin). Would you like to use the default account names: netapp + mediatoradmin? (Y(es)/n(o)): yes Enter ONTAP Mediator user account (mediatoradmin) password: Re-Enter ONTAP Mediator user account (mediatoradmin) password: + Checking if SELinux is in enforcing mode + Checking for default Linux firewall + Installing required packages. ``` -------------------------------- ### Start Destination SVM Source: https://github.com/netappdocs/ontap/blob/main/data-protection/create-smb-server-task.adoc Initiates the destination SVM to prepare it for configuration. Use this command before proceeding with other setup steps. ```bash destination_cluster::> vserver start -vserver dvs1 [Job 30] Job succeeded: DONE ``` -------------------------------- ### Example of assigning JIT access Source: https://github.com/netappdocs/ontap/blob/main/authentication/configure-jit-elevation-task.adoc This example demonstrates assigning JIT access to 'ontap_user' for the 'admin' role, allowing elevation for 1 hour per session within a 60-day initiation window starting July 1, 2025, at 1 PM. ```cli security jit-privilege user create -username ontap_user -role admin -session-validity-period 1h -jit-validity-period 60d -start-time "7/1/25 13:00:00" ``` -------------------------------- ### Example: Accessing and Booting Node from ONTAP Console Source: https://github.com/netappdocs/ontap/blob/main/system-admin/access-system-console-node-task.adoc This example shows accessing a node's system console from the ONTAP CLI, booting the node to ONTAP from the loader prompt, and then exiting the console session. ```bash cluster1::> system node run-console -node node2 Pressing Ctrl-D will end this session and any further sessions you might open on top of this session. Type Ctrl-D to exit. LOADER> LOADER> boot_ontap ... ******************************* * * * Press Ctrl-C for Boot Menu. * * * ******************************* ... ``` ```bash Connection to 123.12.123.12 closed. cluster1::> ``` -------------------------------- ### Example NFS Mount and File Operations Source: https://github.com/netappdocs/ontap/blob/main/nfs-config/test-access-client-systems-task.adoc This example shows the sequence of commands to create a directory, mount a volume, change into the directory, create a file, write to it, display its content, remove the file, and return to the parent directory. ```bash host# mkdir /mnt/test1 host# mount -t nfs -o hard 192.0.2.130:/vol1 /mnt/test1 host# cd /mnt/test1 host# touch myfile1 host# ls -l myfile1 -rw-r--r-- 1 root root 0 Sep 18 15:58 myfile1 host# cat >myfile1 This text inside the first file host# cat myfile1 This text inside the first file host# rm -r myfile1 host# cd .. ``` -------------------------------- ### Example GET API Call for Qtrees Source: https://github.com/netappdocs/ontap/blob/main/task_rest_access_log.adoc This JSON represents the raw output of a GET API call to retrieve a list of qtrees. It includes details about each qtree, its associated volume and SVM, and links for further navigation. The output also shows the total number of records and the self-link for the query. ```json { "records": [ { "svm": { "uuid": "19507946-e801-11e9-b984-00a0986ab770", "name": "SMQA", "_links": { "self": { "href": "/api/svm/svms/19507946-e801-11e9-b984-00a0986ab770" } } }, "volume": { "uuid": "1e173258-f98b-11e9-8f05-00a0986abd71", "name": "vol_vol_test2_dest_dest", "_links": { "self": { "href": "/api/storage/volumes/1e173258-f98b-11e9-8f05-00a0986abd71" } } }, "id": 1, "name": "test2", "security_style": "mixed", "unix_permissions": 777, "export_policy": { "name": "default", "id": 12884901889, "_links": { "self": { "href": "/api/protocols/nfs/export-policies/12884901889" } } }, "path": "/vol_vol_test2_dest_dest/test2", "_links": { "self": { "href": "/api/storage/qtrees/1e173258-f98b-11e9-8f05-00a0986abd71/1" } } }, ], "num_records": 1, "_links": { "self": { "href": "/api/storage/qtrees?max_records=20&fields=*&name=!%22%22" } } } } ``` -------------------------------- ### Example: Create and Show ONTAP Qtree Source: https://github.com/netappdocs/ontap/blob/main/smb-config/create-qtree-task.adoc This example demonstrates creating a qtree named qt01 on a specific SVM and volume, then verifying its creation and properties. ```bash cluster1::> volume qtree create -vserver vs1.example.com -qtree-path /vol/data1/qt01 -security-style ntfs [Job 1642] Job succeeded: Successful cluster1::> volume qtree show -vserver vs1.example.com -qtree-path /vol/data1/qt01 Vserver Name: vs1.example.com Volume Name: data1 Qtree Name: qt01 Actual (Non-Junction) Qtree Path: /vol/data1/qt01 Security Style: ntfs Oplock Mode: enable Unix Permissions: ---rwxr-xr-x Qtree Id: 2 Qtree Status: normal Export Policy: default Is Export Policy Inherited: true ``` -------------------------------- ### Enable Onboard Key Manager Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/enable-onboard-key-management-96-later-nse-task.adoc Use this command to start the setup for the Onboard Key Manager. Set `cc-mode-enabled=yes` to enforce passphrase entry after reboots. This option is not supported in MetroCluster configurations. The `security key-manager onboard enable` command replaces the older `security key-manager setup` command. ```bash security key-manager onboard enable -cc-mode-enabled yes|no ``` -------------------------------- ### Show Intercluster LIF Failover Details Source: https://github.com/netappdocs/ontap/blob/main/s3-config/create-intercluster-lifs-remote-fabricpool-tiering-task.adoc This example displays the failover targets for the intercluster LIFs, indicating which ports they can fail over to. It confirms the redundancy setup for high availability. ```cli cluster01::> network interface show -service-policy default-intercluster -failover Logical Home Failover Failover Vserver Interface Node:Port Policy Group -------- --------------- --------------------- --------------- -------- cluster01 cluster01_icl01 cluster01-01:e0c local-only 192.168.1.201/24 Failover Targets: cluster01-01:e0c, cluster01-01:e0d cluster01_icl02 cluster01-02:e0c local-only 192.168.1.201/24 Failover Targets: cluster01-02:e0c, cluster01-02:e0d ``` -------------------------------- ### Upgrade ONTAP Mediator (Console Output) Source: https://github.com/netappdocs/ontap/blob/main/mediator/install-mediator-pkg-task.adoc Example console output for upgrading ONTAP Mediator, including prompts for user accounts and password entry. It also shows the package installation status and success messages. ```bash [root@mediator_host~]# ontap-mediator-1.11.0/ontap-mediator-1.11.0 -y ONTAP Mediator: Self Extracting Installer + Extracting the ONTAP Mediator installation/upgrade archive + Performing the ONTAP Mediator run-time code signature check Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls + Unpacking the ONTAP Mediator installer ONTAP Mediator requires two user accounts. One for the service (netapp), and one for use by ONTAP to the mediator API (mediatoradmin). Using default account names: netapp + mediatoradmin Enter ONTAP Mediator user account (mediatoradmin) password: Re-Enter ONTAP Mediator user account (mediatoradmin) password: + Checking if SELinux is in enforcing mode + Checking for default Linux firewall + Installing required packages. Last metadata expiration check: 0:33:41 ago on Tue 21 Apr 2026 10:48:35 AM EDT. Package openssl-1:3.5.1-7.el9_7.x86_64 is already installed. Package openssl-devel-1:3.5.1-7.el9_7.x86_64 is already installed. Package kernel-devel-5.14.0-611.45.1.el9_7.x86_64 is already installed. Package kernel-modules-core-5.14.0-611.45.1.el9_7.x86_64 is already installed. Package gcc-11.5.0-11.el9.x86_64 is already installed. Package make-1:4.3-8.el9.x86_64 is already installed. Package which-2.21-30.el9_6.x86_64 is already installed. Package libselinux-utils-3.6-3.el9.x86_64 is already installed. Package patch-2.7.6-16.el9.x86_64 is already installed. Package perl-Data-Dumper-2.174-462.el9.x86_64 is already installed. Package perl-ExtUtils-MakeMaker-2:7.60-3.el9.noarch is already installed. Package bzip2-1.0.8-10.el9_5.x86_64 is already installed. Package efibootmgr-16-12.el9.x86_64 is already installed. Package mokutil-2:0.7.2-1.el9.x86_64 is already installed. Package python3-pip-21.3.1-1.el9.noarch is already installed. Package elfutils-libelf-devel-0.193-1.el9.x86_64 is already installed. Package policycoreutils-python-utils-3.6-3.el9.noarch is already installed. Package python3.12-3.12.12-4.el9_7.2.x86_64 is already installed. Package python3.12-devel-3.12.12-4.el9_7.2.x86_64 is already installed. Dependencies resolved. Nothing to do. Complete! OS package installations finished + Installing ONTAP Mediator. (Log: /root/ontap_mediator.JclgnS/ontap-mediator-1.11.0/ontap-mediator-1.11.0/install_20260421112205.log) This step will take several minutes. Use the log file to view progress. Sudoer config verified ONTAP Mediator rsyslog and logging rotation enabled + Install successful. (Moving log to /opt/netapp/lib/ontap_mediator/log/install_20260421112205.log) ``` -------------------------------- ### Create an S3 Snapshot (Example) Source: https://github.com/netappdocs/ontap/blob/main/s3-snapshots/create-s3-snapshot.adoc This example demonstrates creating a snapshot named 'pre-update' on the 'website-data' bucket within the 'vs0' storage VM. ```bash vserver object-store-server bucket snapshot create -vserver vs0 -bucket website-data -snapshot pre-update ``` -------------------------------- ### Example ONTAP Mediator Upgrade Console Output Source: https://github.com/netappdocs/ontap/blob/main/mediator/install-mediator-pkg-task.adoc This console output demonstrates an upgrade of ONTAP Mediator from version 1.11.0 to 1.12.0. It shows the self-extracting installer process, package checks, and user prompts for configuration. ```console [root@mediator_host ~]# ontap-mediator-1.11.0/ontap-mediator-1.11.0 -y ONTAP Mediator: Self Extracting Installer + Extracting the ONTAP Mediator installation/upgrade archive + Performing the ONTAP Mediator run-time code signature check Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls + Unpacking the ONTAP Mediator installer ONTAP Mediator requires two user accounts. One for the service (netapp), and one for use by ONTAP to the mediator API (mediatoradmin). Using default account names: netapp + mediatoradmin Enter ONTAP Mediator user account (mediatoradmin) password: Re-Enter ONTAP Mediator user account (mediatoradmin) password: + Checking if SELinux is in enforcing mode + Checking for default Linux firewall + Installing required packages. Last metadata expiration check: 0:03:56 ago on Mon 20 Apr 2026 02:49:08 PM EDT. Package openssl-1:3.5.1-7.el9_7.x86_64 is already installed. Package openssl-devel-1:3.5.1-7.el9_7.x86_64 is already installed. Package kernel-devel-5.14.0-611.45.1.el9_7.x86_64 is already installed. Package kernel-modules-core-5.14.0-611.45.1.el9_7.x86_64 is already installed. Package gcc-11.5.0-11.el9.x86_64 is already installed. Package make-1:4.3-8.el9.x86_64 is already installed. Package which-2.21-30.el9_6.x86_64 is already installed. Package libselinux-utils-3.6-3.el9.x86_64 is already installed. Package patch-2.7.6-16.el9.x86_64 is already installed. Package perl-Data-Dumper-2.174-462.el9.x86_64 is already installed. Package perl-ExtUtils-MakeMaker-2:7.60-3.el9.noarch is already installed. Package bzip2-1.0.8-10.el9_5.x86_64 is already installed. Package efibootmgr-16-12.el9.x86_64 is already installed. Package mokutil-2:0.7.2-1.el9.x86_64 is already installed. Package python3-pip-21.3.1-1.el9.noarch is already installed. Package elfutils-libelf-devel-0.193-1.el9.x86_64 is already installed. Package policycoreutils-python-utils-3.6-3.el9.noarch is already installed. Package python3.12-3.12.12-4.el9_7.2.x86_64 is already installed. Package python3.12-devel-3.12.12-4.el9_7.2.x86_64 is already installed. Dependencies resolved. Nothing to do. Complete! OS package installations finished + Installing ONTAP Mediator. (Log: /root/ontap_mediator.uigddi/ontap-mediator-1.11.0/ontap-mediator-1.11.0/install_20260420145003.log) This step will take several minutes. Use the log file to view progress. Sudoer config verified ONTAP Mediator rsyslog and logging rotation enabled + Install successful. (Moving log to /opt/netapp/lib/ontap_mediator/log/install_20260420145003.log) + Note: ONTAP Mediator generated a self-signed server certificate for temporary use on this host. If the DNS name or IP address for the host is changed, the certificate will no longer be valid. The default certificates should be replaced with secure trusted certificates signed by a known certificate authority prior to use for production. For more information, see /opt/netapp/lib/ontap_mediator/README + Note: ONTAP Mediator uses a kernel module compiled specifically for the current OS. Using 'yum update' to upgrade the kernel might cause service interruption. For more information, see /opt/netapp/lib/ontap_mediator/README [root@mediator_host ~]# ontap-mediator-1.12.0/ontap-mediator-1.12.0 ONTAP Mediator: Self Extracting Installer + Extracting the ONTAP Mediator installation/upgrade archive + Performing the ONTAP Mediator run-time code signature check Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls + Unpacking the ONTAP Mediator installer + ONTAP_MEDIATOR_INSTALL_HTTPS_ONLY is set to '0', args are: '' + Starting ONTAP Mediator install/update process: previous installation_mode is '' ONTAP Mediator can be installed with iSCSI and HTTPS support, or support for HTTPS only. Do you wish to install ONTAP Mediator with iSCSI and HTTPS support? Y(es)/n(o): yes ONTAP Mediator will be installed with mode: ISCSI_HTTPS + Selected install package mode: ISCSI_HTTPS ONTAP Mediator will be upgraded from version 1.11.0 to 1.12.0. Do you wish to continue? Y(es)/n(o): yes Capturing support_bundle to save pre-upgrade configuration. API Credentials are required. Mediator API User Name: mediatoradmin Password: Running plugins, please wait... ``` -------------------------------- ### Enable External Key Management Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/enable-external-key-management-96-later-hw-task.adoc Use this command to enable external key management for a vserver. Ensure KMIP SSL client and server certificates are installed. This command replaces the older 'security key-manager setup' command. ```cli security key-manager external enable -vserver admin_SVM -key-servers host_name|IP_address:port,... -client-cert client_certificate -server-ca-cert server_CA_certificates ``` ```cli clusterl::> security key-manager external enable -key-servers ks1.local:15696,10.0.0.10,[fd20:8b1e:b255:814e:32bd:f35c:832c:5a09]:1234 -client-cert AdminVserverClientCert -server-ca-certs AdminVserverServerCaCert ``` -------------------------------- ### Example: Creating Authentication Keys for Cluster Nodes Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/create-authentication-keys-93-later-task.adoc This example demonstrates the output when creating authentication keys for nodes in 'cluster1'. It shows the successful creation of keys and the restoration of key information on each node. ```bash cluster1::> security key-manager create-key (security key-manager create-key) Verifying requirements... Node: cluster1-01 Creating authentication key... Authentication key creation successful. Key ID: Node: cluster1-01 Key manager restore operation initialized. Successfully restored key information. Node: cluster1-02 Key manager restore operation initialized. Successfully restored key information. ``` -------------------------------- ### Example: Verifying Authentication Keys Creation Source: https://github.com/netappdocs/ontap/blob/main/encryption-at-rest/create-authentication-keys-93-later-task.adoc This example shows the output of the 'security key-manager query' command, verifying the creation of authentication keys for 'cluster1'. It lists the key details for each node, including the Key ID. ```bash cluster1::> security key-manager query (security key-manager query) Node: cluster1-01 Key Manager: 20.1.1.1 Server Status: available Key Tag Key Type Restored ------------- -------- -------- cluster1-01 NSE-AK yes Key ID: Node: cluster1-02 Key Manager: 20.1.1.1 Server Status: available Key Tag Key Type Restored ------------- -------- -------- cluster1-02 NSE-AK yes Key ID: ``` -------------------------------- ### Verify SVM Configuration and Status (Example) Source: https://github.com/netappdocs/ontap/blob/main/smb-config/create-svms-data-access-task.adoc Example output of the 'vserver show' command for 'vs1.example.com', detailing its configuration, including allowed protocols and operational state. ```bash cluster1::> vserver show -vserver vs1.example.com Vserver: vs1.example.com Vserver Type: data Vserver Subtype: default Vserver UUID: b8375669-19b0-11e5-b9d1-00a0983d9736 Root Volume: root_vs1 Aggregate: aggr1 NIS Domain: - Root Volume Security Style: ntfs LDAP Client: - Default Volume Language Code: C.UTF-8 Snapshot Policy: default Comment: Quota Policy: default List of Aggregates Assigned: - Limit on Maximum Number of Volumes allowed: unlimited Vserver Admin State: running Vserver Operational State: running Vserver Operational State Stopped Reason: - Allowed Protocols: nfs, cifs, fcp, iscsi, ndmp Disallowed Protocols: - QoS Policy Group: - Config Lock: false IPspace Name: ipspaceA ```