Supported FPolicy file operations and filters for NFSv4 in ONTAP
Suggest changes
PDFs
When you configure your FPolicy event, you need to be aware that only certain combinations of file operations and filters are supported for monitoring NFSv4 file access operations.
Beginning with ONTAP 9.15.1, FPolicy supports the NFSv4.1 protocol.
Beginning with ONTAP 9.19.1, administrators can control NFSv4.2 availability at the SVM level, enabling or disabling the protocol for individual storage VMs using either System Manager, the CLI, or REST API.
Beginning with ONTAP 9.20.1, FPolicy supports monitoring of NFSv4.2 file access events, including new file operations for extended attribute (xattr) writes and security-label filters for Labeled NFS activity. Learn more about enabling or disabling NFS for ONTAP SVMs.
|
Security-label filters (setattr_with_security_label_change and getattr_with_security_label_read) require NFSv4.2 security labels (Labeled NFS) to be enabled on the SVM. Learn more about enabling NFSv4.2 security labels. getxattr and listxattrs are read-only operations and are not monitored by FPolicy.
|
The list of supported file operation and filter combinations for FPolicy monitoring of NFSv4, NFSv4.1, or NFSv4.2 file access events is provided in the following table:
Supported file operations |
Supported filters |
|---|---|
close |
offline-bit, exclude-directory |
create |
offline-bit |
create_dir |
Currently no filter is supported for this file operation. |
delete |
offline-bit |
delete_dir |
Currently no filter is supported for this file operation. |
getattr |
offline-bit, exclude-directory getattr_with_security_label_read (Beginning with ONTAP 9.20.1, this filter is supported and requires Labeled NFS) |
link |
offline-bit |
lookup |
offline-bit, exclude-directory |
open |
offline-bit, exclude-directory |
read |
offline-bit, first-read |
write |
offline-bit, first-write, write-with-size-change |
rename |
offline-bit |
rename_dir |
Currently no filter is supported for this file operation. |
setattr |
offline-bit, setattr_with_owner_change, setattr_with_group_change, setattr_with_mode_change, setattr_with_sacl_change, setattr_with_dacl_change, setattr_with_modify_time_change, setattr_with_access_time_change, setattr_with_size_change, exclude_directory setattr_with_security_label_change (beginning with ONTAP 9.20.1 this filter is supported and requires Labeled NFS) |
setxattr |
Beginning with ONTAP 9.20.1, this file operation is supported and requires Labeled NFS. Currently no filter is supported for this file operation. |
removexattr |
Beginning with ONTAP 9.20.1, this file operation is supported and requires Labeled NFS. Currently no filter is supported for this file operation. |
symlink |
offline-bit |
Beginning with ONTAP 9.13.1, users can receive notifications for failed file operations due to lack of permissions. The list of supported access denied file operation and filter combinations for FPolicy monitoring of NFSv4, NFSv4.1, or NFSv4.2 file access events is provided in the following table:
Supported access denied file operation |
Supported filters |
|---|---|
access |
N/A |
create |
N/A |
create_dir |
N/A |
delete |
N/A |
delete_dir |
N/A |
link |
N/A |
open |
N/A |
read |
N/A |
rename |
N/A |
rename_dir |
N/A |
setattr |
N/A |
write |
N/A |