Access denied by FPolicy server synchronous response
Applies to
- ONTAP
- CIFS
- FPolicy
Issue
- During multiple file operations, e.g. copying the directory from CIFS share to local disk when every single file has to be recalled by the Fpolicy archiving solution, files get copied successfully until an "access denied" error is returned for one file. If the operation is retried, it succeeds until the next error is returned some files further.
- A vserver security trace show access denied by Fpolicy server
Example
vserver security trace trace-result show
Vserver: svm1
Node Index Filter Details Reason
--------------- ----- -------------------------- ------------------------------
node01 1 Security Style: -
Access is denied by the
FPolicy server or due to
mandatory attribute of the
FPolicy policy.
Protocol: cifs
Volume: -
Share: share1
Path: -
Win-User: Domain\user1
UNIX-User: root
Session-ID: xxxxxxxxxxxxxxxxxxx
- Fpolicy logs in ONTAP may contain DENY response:
Example
[kern_fpolicy:nfo:6553] [enum clnt_stat FSMNbladeRespTask::shmSendRespToNblade(std::list<nbladeRespQueueElement_t> &, int, char *, CLIENT *)] reqId = XXXXXXXXXX respCode 2 : DENY - A network trace capturing the traffic between the Fpolicy external-server would show that the file open is denied by the FPolicy external-engine:
Example
Screen Request (18226441) SMB_OPEN: \path\to\file.ext
Screen Response (18226441) SMB_OPEN: Denied