Skip to main content

Netapp Fpolicy Deployments Best Practices for Netwrix Activity Monitor

Netwrix Specific Recommendations​

Other Netwrix specific Best Practices​

  • Consider using multiple primary servers for scale out and fault tolerance purposes.
  • Use low-latency links between ONTAP and Activity Monitor Agent. For example, Activity Monitor Agents should be located in the same datacenter as the monitored NetApp appliances.
  • Reduce the monitoring scope (what operations, shares, volumes are being monitored). It is not recommended to monitor Directory Read operations on loaded servers.
  • Ensure that each ONTAP cluster node has a LIF per SVM to connect to Agents.

NetApp Specific Recommendations​

General Recommendations​

Review the following sections of the Technical Report. FPolicy Solution Guide for ONTAP:
https://www.netapp.com/pdf.html?item=/media/17001-tr4696pdf.pdf

  • Managing FPolicy Workflow and Dependency on Other Technologies (7.5)

NetApp recommends disabling an FPolicy policy before making any configuration changes. For example, if you want to add or modify an IP address in the external engine configured for the enabled policy, then first disable the policy.

If you configure FPolicy to monitor NetApp FlexCache® volumes, NetApp recommends that you do not configure FPolicy to monitor read and getattr file operations. Monitoring these operations in ONTAP requires the retrieval of inode-to-path (I2P) data. Because I2P data cannot be retrieved from FlexCache volumes, it must be retrieved from the origin volume. Therefore, monitoring these operations eliminates the performance benefits that FlexCache can provide.

When both FPolicy and an off-box antivirus (AV) solution are deployed, the AV solution receives notifications first. FPolicy processing starts only after AV scanning is complete. A slow AV scanner could affect overall performance, so AV solutions must be sized properly.

When defining the scope, add all the shares you want to monitor or audit into the share/include list. Turn off monitoring on the file server if you do not want to monitor the shares. Disabling FPolicy on the SVM is not helpful because the Netwrix Activity Monitor activity agent periodically checks on the file server and automatically disables or enables FPolicy if it notices a disconnection (if the Enable and connect FPolicy option was selected).

  • Sizing Considerations (7.6)

FPolicy performs inline monitoring of CIFS operations, sends notifications to the external server, and waits for a response, depending on the mode of external engine communication (synchronous or asynchronous). This process affects the performance of CIFS access and CPU resources. To mitigate any issues, NetApp recommends assessing and sizing the environment before enabling FPolicy.

Performance is affected by the number of users, workload characteristics such as operations per user, data size, and network latency.

  • Netwrix File Activity Monitor Best Practices (8)

The following best practices are recommended when using the Netwrix File Activity Monitor with a NetApp file server:

  • Restrain the FPolicy configuration to specific volumes, shares, and operations to decrease the impact on the SVM.
  • Consider deploying multiple Netwrix Activity Monitor activity agents for load balancing and fault tolerance.
  • Use the Enable and Connect FPolicy option to keep the SVM connected and consistently sending events to the Netwrix Activity Monitor activity agents.