EMC Data Domain Operating System Retention Lock Software User s Guide

Transcription

1 EMC Data Domain Operating System Retention Lock Software User s Guide Backup Recovery Systems Division Data Domain LLC 2421 Mission College Boulevard, Santa Clara, CA WE-DDUPE; Rev A September 28, 2012

2 Copyright 2012 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC, Data Domain, and Global Compression are registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. 2

3 DD OS Retention Lock Software User s Guide This guide is for end-users and archive and backup application vendors who are interested in learning more about the DD Retention Lock software option and how to use its command set, described in this guide, to meet their data retention needs. Note: For information on versions of DD Retention Lock software after DD OS 5.1, see the Administration Guide for your version of DD OS. The sections that follow describe the interface of the DD Retention Lock option for locking files stored on EMC Data Domain systems. This document covers the topics shown in the following table: Overview Page 4 Supported Data Access Protocols Page 6 Enabling DD Retention Lock on the System Page 6 Client-Side Retention Lock File Control Page 14 System Behavior with Retention Lock Page 18 System Commands for DD Retention Lock Page 20 DD OS Retention Lock Software User s Guide 3

4 Overview Retention locking prevents specified files from being overwritten, modified, or deleted for a user-defined retention period of up to 70 years (or until January 19, 2038 if you are using NFS, because of protocol constraints). This software can be enabled only with an add-on DD Retention Lock license. Only files that are explicitly committed to be retained files (as described in this document) can be retention locked on the Data Domain system. Files are committed to be retention-locked files on the Data Domain system through client-side file commands issued while Retention Lock is enabled on the MTree containing the files (DD OS 5.0 and 5.1) or on the file system (DD OS ). For more information see Client-Side Retention Lock File Control on page 14. Note: Linux, Unix, and Windows client environments are supported. Files that are written to shares or exports that are not committed to be retained (even if DD Retention Lock is enabled on the MTree or file system containing the files) can be modified or deleted at any time. Retention locking prevents any modification or deletion of files under retention from occurring directly on Data Domain share(s) during the retention period time specified by the client-side command. Some archiving applications and backup applications can issue these commands when appropriately configured (see Supported Data Access Protocols on page 6). Applications that do not issue these commands cannot lock files using DD Retention Lock. Retention-locked files are always protected from modification and premature deletion if retention locking has ever been enabled on the Data Domain system (even if retention locking is subsequently disabled or if the retention-lock license is no longer valid). You cannot rename non-empty folders or directories within an MTree or a file system that has the retention-lock feature enabled. However, you can rename empty folders or directories and create new ones. The retention period of a retention-locked file can be extended but not reduced. The access control information of a retention-locked file can be updated. Once the retention period for a file expires, the file can be deleted using a client-side command, script, or application. However, the file cannot be modified even after the retention period for the file expires. The Data Domain system does not automatically delete a file when its retention period expires. Files locked using the Retention Lock feature can be replicated to another Data Domain system. Only the source system needs a Retention Lock license. If a retention-locked file is replicated, it remains retention-locked on the destination system and has the same level of protection. For more information, see Replication on page DD OS Retention Lock Software User s Guide

5 Figure 1 shows the steps to enable and use the DD Retention Lock software. 1) Enable DD Retention Lock software on the Data Domain system. (See Enabling DD Retention Lock on the System on page 6.) DD OS 5.0 and 5.1 Use Enterprise Manager or issue mtree retention-lock commands from the system console. DD OS Use Enterprise Manager or issue filesys retention-lock commands from the system console. 2) Commit files to be retention locked on the Data Domain system using client-side commands issued by an appropriately configured archiving or backup application, manually, or via scripts. Note: Windows clients may need to download utility programs for DD OS compatibility. (See Client-Side Retention Lock File Control on page 14.) 3) Optionally, extend retention time or delete files which have expired retention periods using client-side commands. (See Extend the Retention Time of a File on page 16 and Delete or Expire a File on page 17.) Figure 1: DD Retention Lock Flow DD OS Retention Lock Software User s Guide 5

6 Supported Data Access Protocols DD Retention Lock is compatible with industry-standard, NAS-based Write-Once-Read- Many (WORM) protocols, and integration is qualified with archive applications such as Symantec Enterprise Vault and EMC DiskXtender. Customers using backup applications such as CommVault can also develop custom scripts to use the retention lock feature from EMC Data Domain. To check whether an application is tested and certified for the Retention Lock feature, refer to the EMC Data Domain Archive Product Compatibility Matrix, available on the Data Domain Support Portal at: Archive_compatibility_matrix.pdf DD Retention Lock protocol support status is as follows: NFS is supported. CIFS is supported. VTL is supported (DD OS 4.7 and later). You can retention lock a virtual tape using the vtl tape modify command, described in the Command Reference Guide for your version of DD OS. (This feature is not currently available in Enterprise Manager.) The mtree retention-lock revert <path> command can be used to revert the retention-locked state of tapes locked with the vtl tape modify command. After the tape is unlocked, updates can be made to it. The unlocked state won't be visible via the Data Domain Enterprise Manager or CLI until the VTL service is disabled then enabled; however, updates will be applied to the unlocked tape. DD Boost is not supported. Currently, Retention Lock is not integrated with DD Boost. So, when files or backup images are retention-locked (via scripts) on a Data Domain system and a backup application (Symantec NetBackup, for example) via DD Boost is not in the loop, the administrator needs to be careful with scripts that lock files or images from a backup application perspective. If these scripts are not properly configured or deployed, there could be a scenario where a backup application attempts to expire backup files or images, but space is not released on the Data Domain system because these are still retention-locked from the scripts. Data Domain recommends that administrators change their retention period policy to align with the retention lock time. This applies to all the backup applications that are integrated with DD Boost: Avamar, Symantec NetBackup, Symantec Backup Exec, EMC NetWorker, and so on. Enabling DD Retention Lock on the System Before files can be retention locked: The DD Retention Lock software license must be added on the Data Domain system. The MTrees (DD OS 5.0 and 5.1) or file system (DD OS ) that will contain the retention-locked files must be enabled for retention locking. 6 DD OS Retention Lock Software User s Guide

7 Enabling the retention lock feature allows you to: Turn non-retention-locked files into retention-locked files on the Data Domain system using client-side commands. Extend the retention period of retention-locked files using client-side commands. With DD OS 5.0 and 5.1, minimum and maximum retention periods are defined on a per- MTree basis. These retention periods are in effect for all CIFS shares or NFS exports associated with that MTree only. With DD OS , a single minimum and a single maximum retention period is defined for the entire file system. These retention periods are in effect for all CIFS shares or NFS exports associated with that file system. You can enable or disable DD Retention Lock software using either the Enterprise Manager or Data Domain system commands described below. Note: To get started using the Enterprise Manager or system command line interface (CLI), see the Administration Guide for your version of DD OS. A complete description of all CLI commands for DD Retention Lock is provided in System Commands for DD Retention Lock on page 20. Using the Enterprise Manager (DD OS 5.0 and 5.1) 1. Log in to the Enterprise Manager. The Enterprise Manager window appears with the DD Network name in the Navigational pane. Navigational Pane 2. In the Navigational pane, expand DD Network and select a system. DD OS Retention Lock Software User s Guide 7

8 3. Click the System Settings > Licenses tabs. If RETENTION-LOCK is not listed, add the DD Retention Lock license as follows: a. In the Licensed Features pane, click Add. The Add License Key dialog box appears. b. In the License Key text box, enter the license key. Note: License keys are case-insensitive. Include the hyphens when entering keys. c. Click OK. The added license appears in the license list. 4. Click the Data Management > MTree > Summary tabs. MTree summary information appears. 5. In the Retention Lock area, click Edit. The Modify Retention Lock dialog box appears. 8 DD OS Retention Lock Software User s Guide

9 6. Perform the following actions in the Modify Retention Lock dialog box: a. Click the Enable check box to enable DD Retention Lock on the MTree. b. To change the minimum or maximum retention period (the feature must be enabled first), go to the Retention Period pane and modify the minimum or maximum time period: i. Type a number for the interval in the text box (for example, 5 or 14). ii. From the drop-down list, select an interval (minutes, hours, days, years). Note: The minimum retention period can be set to any time without error. Specifying a maximum retention period longer than 70 years results in an error. c. Click OK to save your settings. 7. After you close the Modify Retention Lock dialog box, updated MTree information is displayed. Note the following retention lock fields: Status indicates whether the retention locking is enabled for the MTree. Retention Period indicates minimum and maximum retention periods for the MTree. UUID is a unique identification number generated for the MTree. 8. To check retention lock configuration settings for any MTree, select the MTree in the Navigational pane, then click the Summary tab. 9. When you are finished, exit the Enterprise Manager. DD OS Retention Lock Software User s Guide 9

10 Using the Command Line Interface (DD OS 5.0 and 5.1) The following steps show how to configure an MTree named mtree1 for a minimum retention time of 96 hours and a maximum retention time of 30 years. Enter commands at the Data Domain system console prompt as an administrative user. Note: For additional retention lock commands, see System Commands for DD OS 5.0 and 5.1 on page Add the DD Retention Lock license: # license add ABCD-EFGH-IJKL-MNOP 2. Display the status of the retention lock license: # license show 3. Enable the retention lock feature on the MTree. # mtree retention-lock enable mtree /data/col1/mtree1 4. Display the status of the retention lock feature: # mtree retention-lock status mtree /data/col1/mtree1 5. Set the minimum and maximum retention periods for the MTree: # mtree retention-lock set min-retention-period 96hr mtree /data/ col1/mtree1 # mtree retention-lock set max-retention-period 30year mtree /data/ col1/mtree1 Note: The minimum retention period can be set to any time without error. Specifying a maximum retention period longer than 70 years results in an error. 6. Show the minimum and maximum retention periods for the MTree: # mtree retention-lock show min-retention-period mtree /data/col1/ mtree1 # mtree retention-lock show max-retention-period mtree /data/col1/ mtree1 10 DD OS Retention Lock Software User s Guide

11 Using the Enterprise Manager (DD OS ) 1. Log in to the Enterprise Manager. The Enterprise Manager window appears with the DD Network name in the Navigational pane. Navigational Pane 2. In the Navigational pane, expand the DD Network and select a system. 3. Click the System Settings > Licenses tabs. If Retention Lock is not listed, add the retention lock license as follows: a. In the Licensed Features pane, click Add. The Add License Key dialog box appears. b. In the License Key text box, enter the license key. Note: License keys are case-insensitive. Include the hyphens when entering keys. c. Click OK. The added license appears in the license list. 4. Go to Data Management > Filesystem to access the Tasks menu. From the Tasks menu, select Modify Retention Lock. The Modify Retention Lock dialog box appears. DD OS Retention Lock Software User s Guide 11

12 5. Perform the following actions in the Modify Retention Lock dialog box: a. Click the Enable checkbox to enable DD Retention Lock on the Data Domain system s file system. b. To change the minimum or maximum retention period for the file system, go to the Retention Period pane and modify the minimum or maximum time period: i. Type a number for the interval in the text box (for example, 5 or 14). ii. From the drop-down list, select an interval (minutes, hours, days, years). Note: The minimum retention period can be set to any time without error. Specifying a maximum retention period longer than 70 years results in an error. c. Click OK to save your settings. 6. After you close the Modify Retention Lock dialog box, updated file system information is displayed. Note the following retention lock fields: Status indicates whether retention locking is enabled for the file system. UUID is a unique identification number generated for the file system. Retention Period indicates minimum and maximum retention periods for the file system. 7. When you are finished, exit the Enterprise Manager. 12 DD OS Retention Lock Software User s Guide

13 Using the Command Line Interface (DD OS ) The following steps show how to configure the file system for a minimum retention time of 96 hours and a maximum retention time of 30 years. Enter commands at the Data Domain system console prompt as an administrative user. Note: For additional retention lock commands, see System Commands for DD OS on page Add the DD Retention Lock license: # license add ABCD-EFGH-IJKL-MNOP 2. Display the status of the DD Retention Lock license: # license show 3. Enable the retention lock feature on the Data Domain system s file system: # filesys retention-lock enable 4. Display the status of the retention lock feature: # filesys retention-lock status 5. Set the minimum and maximum retention periods for the Data Domain system: # filesys retention-lock option set min-retention-period 96hr # filesys retention-lock option set max-retention-period 30year Note: The minimum retention period can be set to any time without error. Specifying a maximum retention period longer than 70 years results in an error. 6. Show the maximum and minimum retention periods for the Data Domain system: # filesys retention-lock option show max-retention-period # filesys retention-lock option show min-retention-period DD OS Retention Lock Software User s Guide 13

14 Client-Side Retention Lock File Control This section describes the DD Retention Lock client command interface for locking files stored on EMC Data Domain systems. Linux, Unix, and Windows client environments are supported; however, Windows clients may need to download utility programs with commands to lock files. Note: If your application already supports industry-standard WORM, writing a file to a Data Domain retention lock enabled system locks the file as long as the file's retention time is between the minimum and maximum Retention Lock settings. You do not need to use the commands described in this section. To check whether an application is tested and certified for the Retention Lock feature, refer to the EMC Data Domain Archive Product Compatibility Matrix, available on the Data Domain Support Portal at: Archive_compatibility_matrix.pdf Warning: If you are using NFS, the retention time cannot be greater than January 19, 2038, because of protocol constraints. Client-side commands are used to manage the retention locking of individual files. These commands apply to all retention-lock-capable Data Domain systems and must be issued in addition to the setup and configuration of the retention lock feature on the Data Domain system (see Enabling DD Retention Lock on the System on page 6). Client Access to Data Domain System Files After an MTree is enabled for DD Retention Lock, you can: Create a CIFS share based on the MTree (DD OS 5.0 and 5.1) or file system (DD OS ). This CIFS share can be used on a client machine. Create an NFS mount for the MTree (DD OS 5.0 and 5.1) or file system (DD OS ) and access its files from the NFS mount point on a client machine. Notes: The commands listed in this section are to be used only on the client. They cannot be issued through the Data Domain Enterprise Manager or CLI. Command syntax may vary slightly, depending on the utility you are using. 14 DD OS Retention Lock Software User s Guide

15 Create a File and Set the Retention Time Create a file in the usual way and then set the last access time (atime) of the file to the desired retention time of the file, that is, the time at which the file may be deleted. If the atime is set to a value that is larger than the current time plus the minimum retention period, then the file will become a retention-locked file on the Data Domain system. Warning: If you are using NFS, the retention time cannot be greater than January 19, 2038, because of protocol constraints. Be aware that: Setting a file s atime to less than the current time plus the minimum retention period is ignored without error, and the file will not become a retention-locked file on the Data Domain system. (The file s atime may appear updated, but this is only temporary and is not written to disk.) Setting a file s atime to more than the current time plus the maximum retention period will result in the file becoming retention-locked file on the Data Domain system and the retention time will be the current time plus the maximum retention period. Note: A file must be completely written to the Data Domain system before it is committed to be a retention-locked file. The following command can be used on clients to set the atime: ClientOS# touch -a -t [atime] [filename] The format of atime is: [[YY]YY]MMDDhhmm[.ss] For example, suppose the current date and time is 1 p.m. on January 18, 2012 (that is, ), and the minimum retention period is 12 hours. Adding the minimum retention period of 12 hours to that date and time results in a value of Therefore, if the atime for a file is set to a value greater than , that file becomes retention locked. For example, the following command ClientOS# touch -a -t SavedData.dat will lock the file SavedData.dat until 10:30 PM December 31, DD OS Retention Lock Software User s Guide 15

16 Extend the Retention Time of a File To extend the retention time of a retention-locked file, set the file s atime to a value greater than the current retention time. For example, changing the atime from to using the following command ClientOS# touch -a -t SavedData.dat will cause the file to be locked until 12:30 p.m. December 12, Warning: If you are using NFS, the retention time cannot be greater than January 19, 2038, because of protocol constraints. Be aware that: Setting a file s atime to less than the current time plus the minimum retention period is ignored without error, and the file will not become a retention-locked file on the Data Domain system. (The file s atime may appear updated, but this is only temporary and is not written to disk.) Setting a file s atime to more than the current time plus the maximum retention period will result in the file becoming retention-locked file on the Data Domain system and the retention time will be the current time plus the maximum retention period. Identify a Retention-Locked File The atime value for a retention-locked file is its retention time. To determine whether a file is retention-locked, try to set the atime of the file to a value earlier than its current atime. This action will fail with a permission denied error if and only if the file is a retention-locked file. First, list the current atime value, then execute the touch command with an earlier atime. ClientOS# ls -l --time=atime [filename] ClientOS# touch -a -t [atime] [filename] The following examples show the command sequence. ClientOS# ls -l --time=atime SavedData.dat ClientOS# touch -a -t SavedData.dat If the atime of SavedData.dat is (12:30 p.m. December 12, 2020) and the touch command specifies an earlier atime, (12:30 p.m. December 11, 2020), the touch command fails, indicating that SavedData.dat is retention locked. Note: The --time=atime option is not supported in all versions of Unix. 16 DD OS Retention Lock Software User s Guide

17 Specify a Directory and Touch Only Those Files In this routine, root directory to start from contains the files on which you want to change access times. ClientOS# find [root directory to start from] -exec touch -a -t [expiration time] {} \; For example: ClientOS# find [/backup/data1/] -exec touch -a -t {} \; Read a List of Files and Touch Only Those Files In this routine, name of file list is the name of a text file that contains the names of the files on which you want to change access times. Each line contains the name of one file. ClientOS# touch -a -t [expiration time] `cat [name of file list]` For example: ClientOS# touch -a -t cat /backup/data1/filelist.txt Delete or Expire a File You can delete or expire a file with and expired retention lock using a client application, or delete a file using a standard file-delete command. Expiring a file using an application makes the file inaccessible to the application. The file may or may not actually be removed from the Data Domain system by the expiration operation. If it is not removed, the application often provides a separate delete operation. Note: If the retention time of the retention-locked file has not expired, the delete operation results in a permission denied error. You must have the appropriate access rights to delete the file, independent of the retention lock feature. Using ctime and mtime on Retention-Locked Files ctime ctime is the last-metadata-change time of a file. It gets set to the current time when any of the follow events occur: A non-retention-locked file is retention-locked. The retention period of a retention-locked file is extended. A retention-locked file is reverted. mtime mtime is the last-modified time of a file. It changes only when the contents of the file change. So, the mtime of a retention-locked file cannot change. DD OS Retention Lock Software User s Guide 17

18 System Behavior with Retention Lock Replication Note: For information on the replication feature, see the Administration Guide for your version of DD OS. Collection replication, MTree replication, and directory replication replicate the locked or unlocked state of files. That is, files that are retention locked on the source are retention locked on the destination and have the same level of protection. Only the source system needs a DD Retention Lock license. Replication is supported between systems that are: Running the same major DD OS version (for example, both systems are running DD OS 5.1). Running DD OS versions within the next two consecutive higher or lower major releases (for example, 4.7.x.x to 4.9.x.x or 4.9.x.x to 4.7.x.x). This cross-release replication is only supported for directory and MTree replication. The lowest release for replication with retention lock is DD OS 4.6. Note: MTree replication is not supported for DD OS 5.0 and earlier. Be aware that: Collection replication and MTree replication replicate minimum and maximum retention periods configured on the MTree to the destination system. Directory replication does not replicate minimum and maximum retention periods to the destination system. The procedure for configuring and using collection, MTree, and directory replication is the same as for Data Domain systems that do not have a DD Retention Lock license. Replication Resync The replication resync <destination> command tries to bring the destination in sync with the source when MTree or directory replication context is broken between the source and a destination systems. This command cannot be used with collection replication. Note that: If the destination MTree or directory contains retention-locked files that do not exist on the source, then resync will fail. If the destination directory has retention lock enabled, but the source directory does not have retention lock enabled, then a resync of a directory replication will fail. With MTree replication, resync will succeed if the source MTree does not have retention lock enabled while the destination MTree has retention lock enabled or vice versa, as long as the destination MTree does not contain retention locked files not present at the source. Note: For more information on the replication command, refer to the Command Reference Guide for your version of DD OS. 18 DD OS Retention Lock Software User s Guide

19 Fastcopy When filesys fastcopy source <src> destination <dest> is run on a system, it does not copy the locked or unlocked state of files. Files that are retention locked on the source are not retention locked on the destination. If you try to fastcopy to a destination that has retention-locked files, the fastcopy operation aborts when it encounters retention-locked files on the destination. Filesys Destroy When filesys destroy is run on a system with DD Retention Lock enabled: 1. All data is destroyed, including retention-locked data. 2. All filesys options are returned to their defaults. This means that retention locking is disabled and the min-retention-period as well as max-retention-period options are set back to their default values on the newly created file system. MTree Delete (DD OS 5.0 and 5.1) When mtree delete <mtree-path> attempts to delete an MTree that has retention lock enabled (or previously has had retention lock enabled) and currently contains data, the mtree delete command returns an error. Note: The behavior of mtree delete is a similar to a directory delete command an MTree with retention lock enabled (or previously enabled) can be deleted only if the MTree is empty. DD OS Retention Lock Software User s Guide 19

20 System Commands for DD Retention Lock To enable (or disable) DD Retention Lock software or to modify the minimum or maximum retention period, enter these CLI commands at the Data Domain system console prompt or execute them via a script. System Commands for DD OS 5.0 and 5.1 Note: Unless otherwise noted, these command options are available to administrative users only. retention-lock disable mtree retention-lock disable mtree mtree-path Disable the retention lock feature for the specified MTree. retention-lock enable mtree retention-lock enable mtree mtree-path Enable the retention lock feature for the specified MTree. When the feature is enabled on an MTree: Any file in the MTree may become retention locked by setting its atime into the future. Renaming of any non-empty directory in the MTree is disabled. retention-lock reset mtree retention-lock reset {min-retention-period max-retention-period} mtree mtree-path Reset the minimum or maximum retention period for the specified MTree to its default value. The default min-retention-period is 12 hours, and the default max-retentionperiod is 5 years. retention-lock revert mtree retention-lock revert path Revert the retention lock for all files on a specified path inside an MTree. Any retentionlocked file that lies on the specified path becomes a non-retention-locked file. The path may specify a directory or file within the MTree. The base of the path must be one of the following: /data/col1/mtree-name/ /backup/ Reverting a retention lock raises a Data Domain system alert (at the Error or Warning severity level) and logs the names of the retention-locked files that have been changed to non-retention-locked files. On receiving such an alert, the user should confirm that the reset operation was intended. 20 DD OS Retention Lock Software User s Guide

21 retention-lock set mtree retention-lock set {min-retention-period max-retention-period} period mtree mtree-path Set the minimum or maximum retention period for the specified MTree. The retention period is specified in the format [number][unit]. Possible unit values are: min hr day mo year By default, the min-retention-period is 12 hours and the max-retention-period is 5 years. These default values may be modified. Note: The minimum retention period can be set to any time without error. Specifying a maximum retention period longer than 70 years results in an error. For example, to set the min-retention-period to 24 months for mtree1, use: retention-lock show # mtree retention-lock set min-retention-period 24mo mtree1 mtree retention-lock show {min-retention-period max-retention-period} mtree mtree-path Show the minimum or maximum retention period for the specified MTree. Administrator permissions are not required to use this command option. retention-lock status mtree retention-lock status mtree mtree-path Show retention-lock status for the specified MTree. Possible values are enabled, disabled, and previously enabled. Administrator permissions are not required to use this command option. DD OS Retention Lock Software User s Guide 21

22 System Commands for DD OS Note: Unless otherwise noted, these command options are available to administrative users only. retention-lock disable filesys retention-lock disable Disable the retention lock feature. retention-lock enable filesys retention-lock enable Enable the retention lock feature on the Data Domain system s file system. When the feature is enabled: Any file may become retention locked by setting its atime into the future. Renaming of any non-empty directory is disabled. retention-lock option reset filesys retention-lock option reset {min-retention-period max-retention-period} Reset the minimum or maximum retention period its default value. The default min-retention-period is 12 hours and the default max-retention-period is 5 years. retention-lock option set filesys retention-lock option set {min-retention-period max-retention-period} period Set the minimum or maximum retention period. The retention period is specified in the format [number][unit]. Possible unit values are: min hr day mo year By default, the min-retention-period is 12 hours and the max-retention-period is 5 years. These default values may be revised. Note: The minimum retention period can be set to any time without error. Specifying a maximum retention period longer than 70 years results in an error. For example, to set the min-retention-period to 24 months, use: # filesys retention-lock option set min-retention-period 24mo 22 DD OS Retention Lock Software User s Guide

23 retention-lock option show filesys retention-lock option show {min-retention-period max-retention-period} Show the minimum or maximum retention period. Administrator permissions are not required to use this command option. retention-lock reset filesys retention-lock reset path Use this command to reset retention locking for all files on a specified path. Any retention-locked file that lies on the specified path becomes a non-retention-locked file. The path may specify a directory or file in the file system. For example, to reset the retention lock on all files in /backup/dir1, use the command: # filesys retention-lock reset /backup/dir1 Reverting a retention lock raises a Data Domain system alert (at the Error or Warning severity level) and logs the names of the retention-locked files that have been changed to non-retention-locked files. On receiving such an alert, the user should verify that the particular reset operation is intended. retention-lock status filesys retention-lock status Show retention lock status. The possible values of retention lock status are enabled, disabled, and previously enabled. Administrator permissions are not required to use this command option. DD OS Retention Lock Software User s Guide 23

24 24 DD OS Retention Lock Software User s Guide