Feature Request: NetApp Snapmirror Labels

[dguinn]

Morning all. I was working with support on an issue getting a Veeam NetApp snapshot to replicate via SnapMirror and Vault policies correctly, and I think we found a pretty glaring hole. (Case #045788256). The NetApp SnapVault feature uses the snapmirror_label field on a snapshot to determine policy and retention. Any snapshot made by Veeam has NO label, and therefore will not vault.

My suggestion is to have a tick box to allow specification of a label, then a text field to put it in. The call to create the NetApp snapshot will get one extra field added, and we're done. Should be simple, and then those of us that run cascading backups no longer have to run a secondary Powershell script to add those tags after the fact.

Thanks for the consideration.

[Gostev]

@Adam.Bergh could you please verify this? I'm puzzled: if this is really the case, then how our customers have been using our SnapVault integration all these years?

[Adam.Bergh]

This is a known limitation currently with VBR that we do not modify the "snapmirror label" field of a snapshot created by Veeam. This typically effects situations where you want ONTAP to move data via SnapVault schedules, which is typically done in a tertiary relationship. Example would be Source to SnapMirror Target to SnapVault target. This has been brought up to Veeam R&D with hopes of being resolved in the future.

Current work around is with a post-job powershell script. I have created an example script that can be downloaded from here: https://github.com/ajbergh/Set-SM-Label.ps1

This script will set the snapmirror label to "Veeam" on any snapshots that were created by VBR.

Note that this script requires https://github.com/ajbergh/Encrypt_Password.ps1 to create the encrypted password for ONTAP access.

-Adam

[adam.paradis]

I'm trying to implement this workaround but when running the update command to set the snapmirror label it doesn't work and the field remains blank. Any thoughts? Thanks.

[Adam.Bergh]

Just wanted to post an update here. I worked with @adam.paradis directly to resolve the issue. Make sure that you have the most current NetApp powershell toolkit install to run the above scripts and verify from ONTAP CLI the correct snapmirror lable is being set with the script.

[Mattias]

Hi !

I have the same problem. I use NetApp snaplock but as veeam don't label the snapshot then the netapp will not apply the policy to it so it will get "Snaplocked". Is this planed to be implemented ? It causes me to install snapcenter plugin into Vcenter just to be able to do this, else I can do all my other backups in veeam.

From a users perspective it seams to be quite easy to do (as mentioned above), make a tick box and a field for the label.

[foggy]

Thanks for your feedback. It is on the list of possible improvements but no particular ETA at the moment.

[rennerstefan]

Hi !

I have the same problem. I use NetApp snaplock but as veeam don't label the snapshot then the netapp will not apply the policy to it so it will get "Snaplocked". Is this planed to be implemented ? It causes me to install snapcenter plugin into Vcenter just to be able to do this, else I can do all my other backups in veeam.

From a users perspective it seams to be quite easy to do (as mentioned above), make a tick box and a field for the label.

Hi Matthias,
I know this is already a old post but I want to ask one thing.
What you ask for is to use SnapLock on a SnapVault destination so that the Snapshots are locked as the belong to a locked Volume (like this: https://docs.netapp.com/us-en/ontap/sna ... ncept.html) or you ask that Veeam integrated into snaplock itself to lock a backup chain that is e.g. used as a repo via CIFS (like this https://www.netapp.com/media/6158-tr4526.pdf) or what exacty is the design you want to implement. As far as I know snaplock is still enabled on a volume base and locks the files and with that also the content of a snap. But usually it is not enabled on a primary VMware volume.
Would be good to know.
Thanks

[Mattias]

Hi,



You're overcomplicating things.

The only feature that's requested is for Veeam to put a snapshot-label on the snapshot and that's it. You can name the label with whatever information you want, as long as there IS a label. (Job name for instance)



The underlying mechanism for SnapLock to actually honor the timelock is to see a snapshot with a label, whatever the name is.

[rennerstefan]

Thanks for the clarification
In the meanwhile I found out what you talked about here.

[hnhn99]

Any news about this? How to solve the issue with snaplock/veeam?

[foggy]

Hi Hakan, no news regarding this functionality so far. Please see the workaround mentioned above.

[hnhn99]

How do I set the snaplabel when the snapshot on primary storage are taken, but before snapmirror transfer starts? I want vault destination to be snaplocked. Or could I just execute script on vault destination volume when veeam backup job are finished?

[rennerstefan]

The script itself will set the snaplabel and essentially you can set it whenever you like.
As it is outside of Veeam it will not be in-line with the snapmirror updates we do as they start immediately after the primary snap was created.
So i would recommend to set the label afterwards.
But keep in mind once you lock a snapshot on snapvault with snaplock veeam will fail to remove it when it expires. So you would need to make sure that it does not overlap.
You could also say you build only the primary snapshot with veeam and then create a snapmirror/snapvault update on the netapp side and set the lables. With that there would not be an overlap with veeam really.
Thanks

[oliverL]

Seeing that this Feature Request is open (or so it seems since there is no other upate within this topic and it is pretty much the first hit on Google ).
+1 from me for that Feature. Just have a customer where we need to implement the workaround.

Or is Veeam 12 our solution?

[Meteorain]

I haven't upgraded to v12 yet, but I've been told this is NOT a feature that has been included in v12.

[rennerstefan]

Hi,
that is right, it is not part of v12.
Thanks

[dguinn]

*bump* With SnapLock, this becomes even more important. I have the post-script workaround, but still would MUCH rather this be native.

[hnhn99]

any news?

[rennerstefan]

Hi hnhn99,
to clarify.
As you wrote above about using snaplock with snapshots and labels, is your request to support snapmirror labels or to support NetApp Tamperproof snapshots?
Same question to other ones on this thread.
And no, there is no update on the labels yet.
Thanks

[RyanJ]

Slight bump to this topic... I had another request to support NetApp Snaplock. But a slight twist as its being used in conjunction with SnapVault and secondary targets for the Snapshot job, and this is where the script is failing as the Snapshot Replication kicks off to the secondary filer before the script has a chance to rename the label.

I think fully integrating with NetApp Snaplock would be the best solution (however that needs to be done), but just being able to work with labels is good starting point as that would eliminate the need to run the script as the snap will have the correct label when Veeam creates it to fall in line with the SnapLock policy. If there was a way to even delay the start of the SnapVault replication until after the script runs, that would at least be a workaround, but for now the script seems to only work on the primary filer.

[Meteorain]

Hello,

We notice that there is no way to add a SnapMirror label to a snapshot created by Veeam on a NetApp storage system. There is a lot of NetApp snapshot functionality that relies on this label being present. SnapLock for immutability is an example. There are other posts that reference a PowerShell script to apply a label after the job runs, but there are several issues we've encountered while attempting to use this script:

- When using a secondary NetApp array. The snapshot is taken on the primary array, then the copy to the secondary array is initiated (SnapVault), then the Powershell script runs. The label doesn't get applied to the snapshot on the secondary array because the SnapVault copy has already started BEFORE the script changes the snapshot label on the primary snapshot.
- If the connection between the two arrays gets interrupted, the snapshot on the secondary array doesn't get renamed properly which makes targeting the snapshot with the script on the secondary array problematic.
- This is not a supported solution by either Veeam or NetApp so functionality is not guaranteed or tested

There are a couple of ways to resolve this issue, but neither is an option with Veeam:

1) Provide the option to add a snapshot label in the job settings. Veeam is already calling the NetApp API to create the snapshot so this should be a simple change to add the label.
2) Have an option to run a script BEFORE the copy to the secondary array is initiated so the label is applied to the primary snapshot before the SnapVault copy starts
3) Have a copy job option that does the SnapVault transfer instead of doing everything in one job. You could run the script to apply the snapshot label and then have a second job that does the SnapVault transfer.

Option #1 above would be the best option as it does not rely on an unsupported script to provide functionality that should exist between these systems.