The vserver security trace command set is the most effective tool for diagnosing granular access problems. When a user has partial access, the issue could stem from export policies, name mapping, or file-level UNIX permissions. This command traces the entire decision-making process for a specific client's access attempt against a specific file path. It provides a detailed, step-by-step breakdown of each security check ONTAP performs, allowing an administrator to pinpoint the exact stage and reason for the access denial, which is crucial for resolving inconsistent access scenarios.

A. security login create: This command is used for creating cluster or SVM administrative user accounts, which is unrelated to troubleshooting client data access on an NFS volume.

B. security audit show: This command displays the audit log configuration. While auditing can log access failures, it does not provide a real-time, step-by-step diagnostic trace of the access-check logic.

D. vserver export-policy check-access: This command only verifies if a client's IP address matches an export policy rule. Since the user can access some files, the export policy is likely not the root cause.

1. NetApp Technical Report 4067

"NFS in NetApp ONTAP":

Section 5.1

"Troubleshooting Tools"

states

"The security trace command set is the most powerful tool for troubleshooting access issues. It provides a step-by-step trace of the security checks that ONTAP performs for a client request." This directly supports using this tool for complex access scenarios.

2. ONTAP 9 Commands

vserver security trace Manual Page:

The command description states: "This command is used to trace the security checks that are performed for a client request... The trace results show the outcome of each step in the security check process." This confirms its function as a detailed diagnostic tool.

3. ONTAP 9 Commands

vserver export-policy check-access Manual Page:

The command description clarifies its limited scope: "This command displays the result of an access check for a client against the export policy of a Vserver." This highlights that it does not check beyond the export policy

such as file-level permissions.