FAQ for NetApp Workload Factory for Databases
Suggest changes
PDFs
Find answers to common questions about NetApp Workload Factory for Databases, including concepts, prerequisites, and behavior that are useful when you deploy, register, optimize, clone, and protect database workloads on Amazon FSx for NetApp ONTAP.
Getting started and permissions
Workload Factory for Databases discovers, assesses, provisions, and manages SQL Server, PostgreSQL, and Oracle databases on FSx for ONTAP.
Refer to Learn about Workload Factory for Databases for supported models.
Workload Factory for Databases works in all commercial regions where FSx for ONTAP is supported, but not in China regions, Secret Cloud, or Top Secret Cloud.
No. You can start in basic mode without granting permissions and copy partially completed code samples from Codebox. If you want to discover hosts and manage resources, you must add AWS credentials and create IAM policies for the permissions you need. See Quick start.
Savings calculator for detected hosts and the error log analyzer require view, planning, and analysis permissions. Registering resources, creating databases, creating sandbox clones, and fixing well-architected issues require operations and remediation permissions. Deploying a new database host requires database host creation permissions.
Deploy database hosts
Quick create applies defaults: FCI deployment, Windows Server 2016, and SQL Server 2019 Standard Edition. Advanced create lets you customize the deployment model (FCI or single instance), operating system, edition, version, instance type, provisioned IOPS and throughput, encryption, and monitoring.
FCI deployments create a Multi-AZ FSx for ONTAP file system, and FCI is supported only on Multi-AZ configurations. Standalone deployments create a Single-AZ file system. If you select an existing file system, a new storage VM is created for the SQL Server workloads.
Possibly. Deployment creates the AWS interface endpoints and the S3 gateway endpoint that it needs if they don't exist. It also sets the VPC DNS attributes EnableDnsSupport and EnableDnsHostnames to true if they aren't already.
You need Active Directory administrative access so that deployment can join the domain and create computer objects. Deployment creates a SQL service account if you don't supply one. For user-managed Active Directory, you must provide a security group that allows traffic from the EC2 instances to the directory service.
During deployment, Workload Factory enables CredSSP for credential delegation to the provisioning scripts. If a group policy blocks CredSSP delegation for all domain computers, deployment fails. Workload Factory disables CredSSP after deployment.
Not immediately. Workload Factory doesn't enable remote connection on the deployed SQL Server, so you'll need to configure it yourself, such as allowing the required client IP or subnet in the security group.
Register and manage resources
Registration lets you create databases and sandbox clones, run error log analysis, and optimize configurations. Resources must run on FSx for ONTAP storage and appear in the Inventory, which requires AWS credentials. You must also associate a link with the FSx for ONTAP file system and complete the prerequisite checks, including AWS and NetApp PowerShell modules for SQL Server.
Only SQL Server instances (FCI and standalone) and Oracle databases can be registered and managed. PostgreSQL hosts appear in the Inventory based on your AWS credentials but aren't registered. Detection covers PostgreSQL only on Amazon Linux and Oracle only on Red Hat Enterprise Linux.
Make the VPC endpoints for S3, AWS Systems Manager, and FSx for ONTAP available in the VPC, and allow port 443 in the security group for the interface endpoints. If you use a proxy, you must also allow the required Microsoft, PowerShell Gallery (SQL Server), and AWS domains.
You can no longer deploy to or monitor the resource from the console, and its FSx for ONTAP storage capacity is no longer counted as used by the instance. You can register the resource again later.
Creating a database adds two new volumes with independent LUNs for the data and log files. The files are thin-provisioned and consume only a few MBs of the allocated size. SQL Servers that use SMB don't support database creation.
Savings calculator
It compares storage, compute, SQL license, snapshot, and clone costs on FSx for ONTAP against Amazon Elastic Block Store, FSx for Windows File Server, and on-premises storage. For on-premises hosts you download a PowerShell assessment script, run it on the host, and upload the results. You can then select up to five hosts to analyze. Note that on-premises volume size isn't factored into the cost and percentage savings calculations.
It recommends the downgrade when the instance has 48 or fewer vCPUs and 128 GB or less of memory. The instance also must not use Enterprise features such as online index operations, Resource Governor, peer-to-peer or Oracle replication, R/Python extensions, or memory-optimized TempDB. The deployment model must not require Enterprise either.
You can select up to five detected hosts. Workload Factory consolidates them into a single FSx for ONTAP configuration recommendation with one SQL instance, unless the hosts exceed the throughput, capacity, or IOPS limits of a single file system. Creating or saving multiple FSx for ONTAP file systems isn't supported.
Well-architected configurations
The one-time assessment runs a script on the host and uploads the results, so no credentials are stored and resource registration isn't needed. Continuous assessment requires registering resources, associating a link, and granting permissions. It analyzes daily and can automatically fix issues.
Some fixes can cause downtime or service interruptions, so review each recommendation first. For example, test RSS and MAXDOP recommendations for performance before changing production.
Yes. Dismissing a configuration stops its analysis, avoids unnecessary alerts, and removes it from the total optimization score. You can reactivate it at any time, and analysis then resumes daily.
Scheduled FSx for ONTAP snapshots aren't application-consistent. The recommendation is to manage snapshots externally with tools such as NetApp SnapCenter to get application-consistent backups and avoid corruption during restore. Note that the Advanced create host deployment enables a daily snapshot policy with 7-day retention by default.
Sandbox clones
A sandbox clone is created from the most recent snapshot of the source database. It can be on the same SQL Server instance or on another one, as long as the target host is in the same VPC and shares the same FSx for ONTAP file system as the source. Creating one requires a managed (registered) SQL Server and operations and remediation permissions.
Refresh syncs the clone to the source database's current state or a previous snapshot, and deletes any changes you made to the clone. Re-baseline reverts the clone to its state at creation, also deleting changes, and saves space compared to creating a new clone. Split turns the clone into an independent database that consumes storage capacity, and the clone is deleted when the split completes.
If you create a clone while the source database is busy, the clone might not be in sync with the latest snapshot. The integrity check examines all objects in the clone. If it fails, don't use the clone and create a new one.
Splitting creates a new database that consumes additional storage capacity. Plan the capacity needed and increase the FSx for ONTAP file system capacity beforehand if required.
Data protection
It backs up workloads with local snapshots on primary FSx for ONTAP storage and replicates them to secondary FSx for ONTAP storage using SnapMirror technology. You create protection policies in Backup and Recovery.
The SQL Server instance must be registered with Windows credentials. You must also meet the Backup and Recovery SQL Server requirements, NetApp Console requirements (including a Console agent), and licensing. Workload Factory then installs the Plug-in for Microsoft SQL Server and redirects you to Backup and Recovery to create a protection policy.
Automation and error analysis
Codebox is an infrastructure-as-code co-pilot that generates REST API, AWS CLI, CloudFormation, and Terraform code for operations supported by Workload Factory. Terraform code hides the fsxadmin and vsadmin passwords, so you must re-enter them. A downloaded or copied CloudFormation template is retained for only seven days. See Automate with Codebox.
The analyzer requires Amazon Bedrock activation, a Bedrock VPC endpoint associated with the host's subnet, registered resources, and the required IAM permissions. For Oracle, you must also grant access to V$DIAG_ALERT_EXT. If your account administrator disabled AI features, the analyzer isn't available.
Log data and aggregations stay in your AWS account and travel over a private VPC endpoint, with no public internet exposure. Customer data isn't used to train or improve models. Bedrock processes logs in real time, and results are stored in your environment.