This discussion is locked
c.baker
Level 1 (0 points)

Q: Slow responsive SAN / Kernel log flooded with errors

About a week ago we upgraded our two MDC and 4 clients to Lion Server and Lion, respectively, and since our client computers have been having slow access to the SAN volume and I've noticed ton's of messages in the Kernal.log file.  The errors are this (and similar):

 

kernel[0]: xsanfs_getsecurity: cvp 0xffffff8021ac3400 nt_sd_key 0xec995c516e: unable to map SID S-1-5-21-4096-2147483673-3823604070-2002 (error 2)

 

Not sure if either are related in regards to access response, but I do know that the second MDC that is getting these errors is taking hours (like 3 hours and 40 min to backup 38 GB) to an external storage device (normally took about 20 min).

 

Also to note, our primary MDC does not have any of these logs, but clients and second MDC does.

 

I've did some Google searching but to no avail have found anything other than others having that problem but no real solution.  I've been having another issue that I've contacted Apple about and shot off an e-mail to that contact, but no response.  Any help would be greatly appreciated. Thanks!

Posted on Jan 17, 2012 3:55 PM

Close
c.baker

Q: Slow responsive SAN / Kernel log flooded with errors

  • All replies
  • Helpful answers

  • by Blaidd Drwg,

    Blaidd Drwg Blaidd Drwg Jan 18, 2012 8:34 AM in response to c.baker
    Level 1 (109 points)
    Jan 18, 2012 8:34 AM in response to c.baker

    Xsan uses SIDs in access control lists. Each time it looks at a file's ACL, it has to map the SID to a user or group. This process is failing.

     

    You have likely used a local user in an ACE. You shouldn't do that with Xsan, because the SID will only map successfully on the one system where that account exists. There's more info in http://support.apple.com/kb/TS3556.

     

    I recommend setting up a network directory (e.g. Open Directory, Active Directory, LDAPv3) and making sure that users of the SAN only log in as network users. You will also need to remove the bad ACLs from files that have them. Tracking them down individually will be painful. So you might consider instead just getting rid of all ACLs on the volume with "sudo chmod -R -N /Volumes/XsanVolume", then adding new ACLs that use only network users and groups. Or simply turn off ACLs if you don't need them.