RHEL NFSv3/v4.0: Archived NetApp Issues, Fixes and Workarounds
This translates the stored list of historical RHEL client issues with NetApp FAS running ONTAP 9, clustered Data ONTAP 8 or 7-Mode. Its old minimum fixed releases are recorded for diagnosis, not current supported deployment recommendations. Match the exact RHEL branch, kernel, nfs-utils, protocol and vendor interoperability information before applying any fix.
The exact official English counterpart was found. It confirms that the stored “RHEL 5.1.1” references mean RHEL 5.11. RHEL 8/9 issues are directed to the IMT Alerts/Notes for the applicable NFS interoperability profile; no RHEL 8/9 fixes are invented here.
RHEL 5.x — source issues 1–6
- 5.8: Kerberos mount warning
A sec=krb5 mount says rpc.idmapd/rpc.gssd appears not to be running even when the services are running.
Historical remedy / reference: nfs-utils1.0.9-66.el5 or later; RedHat76783.
- 5.9: ownership/mode commands
chmod, chgrp and chown fail on an NFSv3 mounted path.
Historical remedy / reference: The source traverses into the mounted path before issuing the command.
- 5.10/5.11: pending UNLOCK recovery
During NLM recovery, existing locks are reclaimed but pending unlock operations can remain neither released nor reclaimed.
Historical remedy / reference: Source reports no RHEL 5 workaround and identifies RHEL 6.6 GA as the historical fixed-client path.
- 5.11: EIO during storage failover
NFSv3 applications receive EIO/errno 5 because of missing SUNRPC fixes.
Historical remedy / reference: Source reports no RHEL 5 workaround; historical RHEL 6.6 GA client fixes.
- 5.11: no locks available
NFSv3 failover can return No locks available, errno 37, associated with missing SUNRPC fixes.
Historical remedy / reference: Same historical RHEL 6.6 GApath; not a recommendation to deploy that old release now.
- Bad sequence-ID loop
The client repeatedly writes while packet evidence shows NFS4ERR_BAD_STATEID, without matching storage-side logs. The original excerpt follows.
Historical remedy / reference: Source links RedHat bug620502.
/var/log/messages:Aug 16 19:08:17 uscf1plat0 kernel: NFS: v4 server 10.113.49.8 returned a bad sequence-id error!
grep sequence-id messages.1
Aug 16 19:08:17 uscf1plat0 kernel: NFS: v4 server 10.113.49.8 returned a bad sequence-id error!
...
Aug 22 01:09:27 uscf1plat0 kernel: NFS: v4 server 10.113.49.8 returned a bad sequence-id error!RHEL 6.x — source issues 1–14
- 6.x: legacy Kerberos crypto
nfs-kerberos can fail with permission denied / kinit: No supported encryption types (config file error?) when weak crypto is unavailable.
Historical remedy / reference: The source adds allow_weak_crypto=yes in /etc/krb5/krb5.conf. This weakens crypto policy and is only a historical, explicitly approved compatibility workaround; prefer supported crypto/configuration instead of enabling it generically.
- 6.3/6.4: chmod/chgrp/chown
The same NFSv3 mounted-path ownership/mode issue is listed.
Historical remedy / reference: Traverse to the mounted path before the command, per the source.
- 6.2/6.3: hung application
Ctrl-C may not interrupt a hung writer; old intr/nointr mount options are not a reliable escape on the described newer kernel path.
Historical remedy / reference: Source suggests SIGKILL via kill -9 pid. This forcefully terminates when the kernel can honor it; an uninterruptible I/O wait may remain pending and application cleanup is not guaranteed. Diagnose the NFS fault too.
- 6.3/6.4: NLM byte-lock failure
After server crash, the waiting byte-range lock is not retried and the application receives -ENOLCK / No locks available.
Historical remedy / reference: 6.3 kernel 2.6.32-279.46.1.el6; 6.4 kernel 2.6.32-358.49.1.el6.
- 6.1/6.2/6.3: NFSv4.0 delegation hang
The source describes BAD_STATID(spelling as stored) with delegations enabled.
Historical remedy / reference: Historical 6.3 kernel 2.6.32-279.46.1.el6.
- 6.4: missing referral directories
Lookups cover all volumes, but listing shows only one HAnode’s volumes.
Historical remedy / reference: Tracked as bug963337; no fixed kernel is supplied by this entry.
- 6.4: security-flavor fallback
A sec=krb5 mount can negotiate from RPCSEC_GSS to AUTH_UNIX based on SECINFO and succeed against a sys-only export rule. The source flags the policy implication.
Historical remedy / reference: Tracked as bug948145; no invented fixed version or blanket exploit claim.
- 6.4: delegated OPEN recovery deadlock
An OPEN state-recovery operation concurrent with delegated-open permission checking can deadlock on the open owner’s NFSv4 sequence ID.
Historical remedy / reference: 2.6.32-358.49.1.el6.x86_64.
- 6.4: setattr on revoked delegation
_nfs4_do_setattr() uses a delegation stateid without a writable open stateid. If revoked, nfs4_handle_exception() lacks struct nfs4_state and translates the error to EIO.
Historical remedy / reference: 2.6.32-358.49.1.el6.x86_64 or later in that branch.
- 6.3/6.4: stateid-recovery loop
Recovery can loop on zero_stateid NFS4ERR_BAD_STATEID.
Historical remedy / reference: Historical RHEL 6.5 or later; bug923939.
- 6.x: recursive directory warning
chown -R / setattr / chmod over nested junctions such as /vol1/vol2/vol3 can report a circular/recursive directory structure.
Historical remedy / reference: Source says an updated kernel in the RHEL 6.7 branch; bug1223978. “6.7” here is the RHELrelease branch, not Linuxkernel 6.7.
- 6.x: Kerberos clock-skew window
See the complete clock-skew explanation below; the source misplaced this RHEL 6 entry under its RHEL 7 heading.
Historical remedy / reference: Source issue 12 and MIT ticket 8268; details below.
- 6.3/6.4/6.5: NFSv4.1 recovery outage
Under heavy workload, LIF migration and other controller operations requiring state recovery can cause hangs/long I/O outages. Source BURT814789.
Historical remedy / reference: All three historical 6.5.z packages: kernel-2.6.32-431.29.2.el6; nfs-utils-1.2.3-39.el6_5.3; libtirpc-0.2.1-6.el6_5.2. The title mentions v3/v4.0 but this source entry specifically covers v4.1.
- 6.4/6.5/6.5.z: I/O outages/errors
Older clients can suffer outages/errors across NFSv3, v4.0 and v4.1. Source BURT866544.
Historical remedy / reference: Historical RHEL 6.6 GA kernel-2.6.32-504.el6.
RHEL 7.x — source issues 1–7
Source best-practice reference: NetApp TR-4067. Its edition and actual platform applicability must match the deployment.
- 7.0: multiple NFS client faults
I/O errors, kernel crashes, permission denied on previously validated mounts and intermittent data corruption are listed across v3/v4.0/v4.1. BURT915759.
Historical remedy / reference: Historical RHEL 7.1 GA kernel-3.10.0-229.el7.
- 7.x: pNFS session not removed
After EIO, umountmay fail to destroy the session to a data server.
Historical remedy / reference: Source threshold 7.1.z/7.2, greater than 3.10.0-320; bug1234986. Preserve exact branch/advisory qualification rather than treating a bare version prefix as a support guarantee.
- 7.1: pNFS setattr/admin_revoked EIO
Takeover/giveback can cause EIO/errno5 with the listed revoked-state path.
Historical remedy / reference: Source threshold 7.1.z/7.2, greater than 3.10.0-289; bug1214410.
- 7.1: MetroCluster switchover I/O
NFSv4 I/O to disaster-site volumes can intermittently fail with EIO after switchover.
Historical remedy / reference: Source threshold 7.1.z/7.2, greater than 3.10.0-295; bug1240790. The stored link label names 1240790 but href wrongly points to 923939; corrected here.
- 7.x: recursive directory warning
chown -R / setattr / chmod over multilevel junction paths can report recursive structure.
Historical remedy / reference: Updated kernel in RHEL 7.1 branch, per the source; bug1225090.
- 7.1: locks remain after LIF migration
An open/locked NFSv4.x file can retain a lock after close following LIF migration or SFU; the source warns of possible corruption.
Historical remedy / reference: Source threshold kernel 3.10.0-320 or later; bug1263376.
- 6.x/7.x: Kerberos clock skew
The source repeats the same ticket/context-expiry issue as RHEL 6 issue12.
Historical remedy / reference: See below; the stored MIT link incorrectly targeted a RedHat bug and is corrected to the MIT ticket.
Kerberos clock-skew case — details retained
The source describes SECD’s MIT krb5 gss_accept_sec_context() checking the service-ticket end time against the server clock without the expected skew allowance. The relevant conditions are: (1) server time is ahead of client time but within configured Kerberos skew; (2) maximum service-ticket lifetime is shorter than maximum TGT lifetime; (3) the NFS request arrives in a skew window where the ticket is still valid according to the client but expired according to the server.
The server rejects the request with AUTH_ERROR, prompting a GSS context refresh. The client reuses its existing service ticket, which the server rejects with GSS_S_CREDENTIALS_EXPIRED, resulting in permission denied. Once a refreshable ticket expires on the client, it can be renewed and the symptom can clear. The source workaround sets KDC maximum service-ticket lifetime equal to maximum TGT lifetime so refreshing first requires TGT refresh, where the Linux client handles the skew. This is a historical case-specific policy change, not a substitute for checking clock synchronization, crypto and supported fixes.
Reference: MIT krb5 ticket 8268. The source’s malformed function/error spellings are normalized here; they were prose, not a captured raw log. Every source case is represented, including the duplicate 6.x/7.x Kerberos placement.