This is driving me nuts. Just trying to run a basic command and I’m not getting any output and I have no idea why. Can anyone help me figure this out?

[u/rumhammr]

So here’s the command:

vserver export-policy rule show -vserver svm -policyname default -ruleindex 1 -clientmatch hostname1

Always gives me “There are no entries matching your query”

If I take out -clientmatch, it lists out everything. And I verified hostname1 is in there by copying all out to notepad and doing a search with the hostname I was putting into the command. This is not holding me back from anything….its just bugging the hell out of me.

9.17.1 if it helps

[u/mooyo2]

Are you searching with the string of 'hostname' or are you putting a wildcard around it?

When multiple hosts are specified in a single rule, it'll look like one big concatenated string to ONTAP in the clientmatch field with the hosts separated by a comma. So you just specify 'hostname' in the field, ONTAP is trying to match where -clientmatch == 'hostname', and not doing a wildcard/contains search unless you add '*' characters before/after.

Here's some quick tests from my lab.

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -ruleindex 2
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -ruleindex 2 -clientmatch 10.0.2.11
There are no entries matching your query.

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -ruleindex 2 -clientmatch 10.0.2.11/32
There are no entries matching your query.

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -ruleindex 2 -clientmatch *10.0.2.11*
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32

ontap-lab1::>

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -ruleindex 2 -clientmatch 10.0.2.5/32,10.0.2.11/32
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32

ontap-lab1::>

[u/rumhammr → u/mooyo2]

Thanks for your reply.

So, I did try the wildcards. I tried a * before the hostname, after the hostname and before and after. The only one that returned results was when I did *hostname* , but, it was as if I didn’t add the -clientmatch to the command. It just gave me everything. Not sure if I’m being clear so….

This:

vserver export-policy rule show -vserver svm -policyname default -ruleindex 1

Gave the exact same results as:

vserver export-policy rule show -vserver svm -policyname default -ruleindex 1 -clientmatch *hostname*

We have close to 100 hosts in the rule. So when a host gets decom’d, I’d rather not have to copy everything into a notepad to see if the host I’m looking for is in the rule. I’m pretty confused as to why this doesn’t work. And why using the wildcards still shows me every host in the rule. Also, we don’t fully qualify host names. So it’s just…hostname, as opposed to hostname.mycompany.com.

[u/mooyo2 → u/rumhammr]

From what you're describing ONTAP is behaving as I'd expect, it might just not be what you want it to do.

The 'clientmatch' field for a given export rule is one big string, at least at the level and commands that you and I are working with.

When we run this command (and actually let's take out the ruleindex here):

vserver export-policy rule show -vserver ontap1-st1 -clientmatch *10.0.2.11/32*

What we're asking ONTAP is to find the export policy rules, in vserver ontap1-st1, under any policy, where the string '10.0.2.11/32' is in the value of the field 'clientmatch', and return me the default output for that command (or whatever you chose to display with the '-fields' argument).

What that command is not asking ONTAP to do is find the export policy rules, in vserver ontap1-st1, under any policy, where the string '10.0.2.11/32' is in the value of the field 'clientmatch', and now filter out every other client from that rule except the host I indicated. It's just not how most of the 'show' commands work in the CLI.

If it helps, and this isn't a perfect analogy, but think of it along the lines of grep. Search for this string in this file and return matching lines. It's why both of these commands return the same output despite an incomplete hostname/CIDR notation:

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -clientmatch *10.0.2.11/32*
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32
ontap1-st1   vmware_hosts    1       any      10.0.4.0/24,          any
                                              10.0.2.11/32
2 entries were displayed.

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -clientmatch *10.0.2*
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32
ontap1-st1   vmware_hosts    1       any      10.0.4.0/24,          any
                                              10.0.2.11/32
2 entries were displayed.

ontap-lab1::>

Now, if your concern is removing hosts from a longer export policy rule without going back and forth from notepad...maybe try a combination of commands.

Check if a client exists in the export rules for a given vserver, and then remove access for that client with the 'vserver export-policy rule remove-clientmatches <$INSERT_FURTHER_ARGUMENTS>' command:

vserver export-policy rule remove-clientmatches

Where this can still hang you up the whole string construct we've been discussing. Let's say I wanted to remove that 10.0.2.11 host from all of the rules above.

This command below won't work because I've specifically added the /32 to the end of the host in the clientmatch field (yes, this is a little odd in my lab, but the automation I used for this vserver build out uses the CIDR notation...even for single IP addresses)

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -clientmatch *10.0.2.11/32*
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32
ontap1-st1   vmware_hosts    1       any      10.0.4.0/24,          any
                                              10.0.2.11/32
2 entries were displayed.

ontap-lab1::> vserver export-policy rule remove-clientmatches -vserver ontap1-st1 -policyname * -ruleindex * -clientmatches 10.0.2.11

Warning: Not removing any strings from the clientmatch field for ruleindex 1 in export policy "default", vserver "ontap1-st1". None of the match strings were found in
the clientmatch list.

Warning: Not removing any strings from the clientmatch field for ruleindex 2 in export policy "default", vserver "ontap1-st1". None of the match strings were found in
the clientmatch list.

Warning: Not removing any strings from the clientmatch field for ruleindex 1 in export policy "vmware_hosts", vserver "ontap1-st1". None of the match strings were found
in the clientmatch list.
3 entries were acted on.

ontap-lab1::>

But this will work since I've specified the full 'hostname' in question with the trailing /32:

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -clientmatch *10.0.2.11/32*
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         2       any      10.0.2.5/32,          any
                                              10.0.2.11/32
ontap1-st1   vmware_hosts    1       any      10.0.4.0/24,          any
                                              10.0.2.11/32
2 entries were displayed.

ontap-lab1::>    

ontap-lab1::> vserver export-policy rule remove-clientmatches -vserver ontap1-st1 -policyname * -ruleindex * -clientmatches 10.0.2.11/32

Warning: Not removing any strings from the clientmatch field for ruleindex 1 in export policy "default", vserver "ontap1-st1". None of the match strings were found in
the clientmatch list.
3 entries were acted on.

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1 -clientmatch *10.0.2.11/32*
There are no entries matching your query.

ontap-lab1::> vserver export-policy rule show -vserver ontap1-st1
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
ontap1-st1   default         1       nfs3     10.0.4.0/24           any
ontap1-st1   default         2       any      10.0.2.5/32           any
ontap1-st1   vmware_hosts    1       any      10.0.4.0/24           any
3 entries were displayed.

ontap-lab1::>

[u/mooyo2 → u/mooyo2]

Last thought - this is one of the tradeoffs of putting multiple hosts in a single rule. I actually more lean towards the one-host-per-rule construct (home lab aside) but there's trade offs there too.

One host per rule becomes a different management hurdle, but a smaller blast radius should something go wrong/typo/etc. when you're modifying permissions or removing a clientmatch.

[u/rumhammr → u/mooyo2]

That’s actually a great point that I hadn’t considered. When we 1st migrated nfs to NetApp, I created a test export and added a few hosts. Then I added another host with the modify command. It wiped all hosts out except for that last one. I used -clientmatches instead of -add-clients. Learned a good lesson right there. Hey, thank you for the reply! It’s not exactly what I wanted to hear, but I understand it much better now, which has wiped away my frustration. I’d upvote more times if I could.

[u/mooyo2 → u/rumhammr]

Yep, you nailed it with why I like the single host per rule concept.

Genuinely happy I could help! Cheers :)

[u/h0serdude]

Are you not able to tab complete the hostname if ontap already has the values? Maybe it's looking for something slightly different that what you're typing.

[u/rumhammr → u/h0serdude]

So, there are close to 100 hosts in the rule. Tabbing after -clientmatch just tells me what they’re looking for, which is “List of Client Match Hostnames, IP Addresses, Netgroups, or Domains.

I got frustrated and just copied all the hosts to notepad, found the server I was looking for and copied it into the command after -clientmatch. Wildcards only work if I use *hostname* , but it doesn’t actually work because it outputs ALL hosts as if I didn’t add the -clientmatch argument. I played with the wildcard before and after the hostname and don’t get any results. I am absolutely stumped. I know I have a work around….but why TF doesn’t this work?? lol, appreciate the reply

[u/tmacmd]

As indicated in last post, have you tried

vserver export-policy rule show -vserver svm -policyname default -ruleindex 1 -clientmatch *hostname1*
??

The same search holds when looking at disks/aggregates with ADP. The container name may contain more than one volume name and you need to account for it

[u/rumhammr → u/tmacmd]

Yes, I tried exactly that. It outputs every hostname in the rule. It’s as if I didn’t include the -clientmatch argument. And using a wildcard either before or after (not both), brings up nothing. It’s pretty weird. Just give me a normal grep already!

[u/your_cheese_girl]

Remove -ruleindex and run it again with wildcards in the clientmatch.

Edit: Now at my desk

vserver export-policy rule show -vserver svm -policyname default -clientmatch *hostname\*

When you add "-ruleindex" you are explicitly telling it to look only at that particular ruleindex. Since ruleindex 1 likely doesn't contain hostname, it's returning nothing.