Super-users administer NASLORD itself. They automatically have access
to all active Access Zones, MTrees and Namespaces, across all Clusters, Appliances and
VDCs configured in NASLORD. They do not need to be granted access to anything
explicitly.
Tenant administrators are end users. They only see and manage the
PowerScale Access Zones, PowerProtect DD MTrees and ObjectScale Namespaces that have
been explicitly granted to them. Their view of the interface is simplified accordingly.
(See the NASLORD 3.0.0 Tenant User Guide.)
Tenant users are end users. They only see and manage the PowerScale
Access Zones, PowerProtect DD MTrees and ObjectScale Namespaces that have been
explicitly granted to them. Their view of the interface is simplified accordingly.
(See the NASLORD 3.0.0 Tenant User Guide.)
This guide covers everything a super-user needs: connecting storage systems, creating
Tenants and users, configuring chargeback, budgets and report delivery, and operating
the appliance.
Most administrative functions are reached from the Admin page in the web interface.
2.User management
Creating a local user
Navigate to Admin page → User Management.
Click the + Create Local User button located on the top right corner.
Enter the user details: username, first name, last name, email and password.
For a super-user: enable the “Super-user” checkbox. No further grants are needed.
For a tenant administrator: select the PowerScale Access Zone(s),
PowerProtect DD MTree(s) and/or ObjectScale Namespace(s) this user is allowed to
manage. Optionally associate the user with a Tenant (see
section 5) so they can view that Tenant’s charge reports and
budget dashboards.
Click the Add User button on the bottom right.
Managing users
Once a user has been created, hover the mouse over the cells on the right of the user
list to see the Access Zone(s), MTree(s) and Namespace(s) that the user can manage.
Right-click on any user and select “Edit” or “Delete” as necessary.
The user list also records each user’s last authentication timestamp and source IP
address, which is useful for auditing.
3.LDAP authentication
NASLORD users can authenticate against an external LDAP directory instead of using
local passwords.
Navigate to Admin page → LDAP and add/edit the LDAP provider: server
address, port, bind credentials, search base and attribute mappings.
When creating or editing users, select “LDAP Authentication” as the authentication method.
Tenants can be mapped to the directory as well: each Tenant can carry an LDAP base OU
and an LDAP administrator group DN (see section 5), which ties
directory users to the proper Tenant.
Local and LDAP users can coexist; the built-in “admin” account remains local so you
cannot be locked out by a directory outage.
4.Two-factor authentication
NASLORD supports time-based one-time password (TOTP) two-factor authentication,
compatible with standard authenticator applications, with static backup tokens for
recovery.
To enable or disable 2FA system-wide: Admin page → Two-Factor Authentication.
When 2FA is enabled, users enroll their authenticator device at their next login and
must provide a one-time code at each subsequent login.
Keep the backup tokens in a safe place; they allow login when the authenticator
device is unavailable.
5.Tenant management
Tenants are the unit of cost allocation and reporting in NASLORD 3.0. A Tenant groups
storage components (PowerScale Access Zones and ObjectScale Namespaces) and carries the
billing information used by charge reports, budgets, and report delivery.
Creating a Tenant
Navigate to Admin page → Tenants and add a new Tenant.
Fill in the Tenant details:
Name (must be unique)
Contact name, phone number, office address
E-mail address, and a separate report e-mail address (where monthly reports are sent)
Currency: USD, CAD, EUR, GBP or BRL
Optional LDAP base OU and LDAP administrator group DN
Notes
Enabled flag
Optionally enable “monthly reports” for the Tenant so its charge report is delivered
automatically each month (requires e-mail settings,
section 12.1, or report routes, section 10).
Associating components to a Tenant
PowerScale: the association is made at the Access Zone
level. Each Access Zone can belong to one Tenant.
ObjectScale: the association is made at the Namespace
level. Each Namespace can belong to one Tenant; Buckets automatically follow the
Tenant of their parent Namespace.
PowerProtect DD MTrees are granted to users directly and are not part of chargeback.
Important — currency consistency. All chargeback profiles applied to a
Tenant’s components must use the same currency as the Tenant. NASLORD validates this
and refuses a Tenant currency change or a profile assignment that would create a
mismatch.
6.PowerScale Multi-Tenant Manager
6.1 Adding a new PowerScale Cluster
Navigate to the PowerScale Clusters page and use the Add Cluster button located on the top right.
Enter the cluster address, API port (default 8080) and credentials. See
section 6.3 if you do not want to use the root account.
When adding a new cluster, all Access Zones are automatically discovered and added to
the NASLORD configuration, but are disabled by default.
With the demo license, you can add one (1) PowerScale Cluster and enable up to three
(3) Access Zones. Production licenses can be obtained without any Access Zone limit.
6.2 Enabling Access Zones
Access Zones must first be enabled, then access must be granted explicitly to Tenant
Administrators (section 2), and optionally the zone can be
associated to a Tenant for chargeback (section 5).
Right-click on the cluster name and use “Select Access Zones” to enable multiple Access Zones at once.
Alternatively, right-click on an individual Access Zone and use “Enable Access Zone”.
Once granted, Tenant Administrators are restricted to their own Access Zones: they can
browse the file system folders associated with their zones and view/create/edit/delete
Quotas, Snapshot Schedules, NFS exports and SMB shares.
6.3 (Optional) Creating a dedicated user and role on PowerScale
Follow these steps if you want NASLORD to connect to your clusters with credentials
other than root.
Creating a new user (OneFS CLI). Create a user called
naslord with password changeme — please use a secure password!
Navigate to the PowerProtect DD Appliances page and use the Add Appliance button located on the top right.
Enter the appliance address, SSH port (default 22), API port (default 3009) and
credentials. See section 7.2 if you do not want to use
the sysadmin account.
When adding a new appliance, all MTrees are automatically discovered and added to the
NASLORD configuration. Tenant Administrators do not automatically get
access to any MTrees; access must be granted explicitly
(section 2).
Notes. After creating new MTrees or configuring Retention Lock
parameters on the appliance, you may need to click “Refresh Cache” in the blue menu
bar (white icon with double arrows). If some of your MTrees appear in the
“Missing MTrees” column, right-click and select “Synchronize MTrees” before
proceeding.
With the demo license, you can add one (1) PowerProtect DD Appliance and enable up to
three (3) Primary MTrees. Production licenses can be obtained without any Primary
MTree limit.
7.2 PowerProtect DD CLI configuration
Log into the PowerProtect DD unit via SSH, using an account with admin privileges, such
as sysadmin.
Creating new users. User naslord will be used by the
NASLORD VM to create the Protected Copies in the Retention Locked MTrees:
user add naslord role backup-operator min-days-between-change 0 max-days-between-change 9999
User veeambackup will be used by the backup software (Veeam in this
example) to execute regular backup/restore operations:
user add veeambackup role none min-days-between-change 0 max-days-between-change 9999
(Optional) User veeamrecover will be used to recover backups from Retention
Locked MTrees in case of disaster:
user add veeamrecover role none min-days-between-change 0 max-days-between-change 9999
Creating a storage-unit for regular backups:
mtree create /data/col1/backup01
ddboost storage-unit modify backup01 user veeambackup
(Optional) Creating a storage-unit for recoveries in case of disaster:
mtree create /data/col1/backup01-recover
ddboost storage-unit modify backup01-recover user veeamrecover
Creating an MTree for Retention Lock (specify the desired mode of
operations — governance or compliance — and retention periods):
mtree create /data/col1/backup01-retlock
mtree retention-lock enable mode governance mtree /data/col1/backup01-retlock
mtree retention-lock set min-retention-period 720min mtree /data/col1/backup01-retlock
mtree retention-lock set max-retention-period 45days mtree /data/col1/backup01-retlock
mtree retention-lock set automatic-retention-period 14days mtree /data/col1/backup01-retlock
mtree retention-lock set automatic-lock-delay 5min mtree /data/col1/backup01-retlock
Creating NFS exports (specify the NASLORD VM IP address;
192.168.12.50 in this example):
a Primary MTree where your backup software saves the regular backups
(e.g. backup01), currently disabled in NASLORD; and
a Retention Lock MTree with Retention Lock parameters configured
(e.g. backup01-retlock), shown disabled and with a padlock icon.
To associate them:
Right-click on the Primary MTree (e.g. backup01) and select “Edit”.
Confirm the fields on the top of the form are correct.
Select the correct Retention Lock MTree in the pull-down list (e.g.
backup01-retlock). Only the MTrees with the correct Automatic Retention
Lock parameters appear in this list.
If you created a Disaster Recovery MTree, you may select it as well.
Select the time of day when Automatic Copies should be created, daily.
Leave “Automatic Cleanup” selected (NASLORD deletes the older copies for which the
retention period has expired).
Select the “Primary MTree Enabled” checkbox.
Click the save button on the bottom right.
After the association is completed, the Primary MTree is no longer disabled, and the
Retention Lock MTree shows a chain-link icon in addition to the padlock icon,
indicating it is linked to a Primary MTree.
Grant the Primary MTree to the appropriate Tenant Administrators
(section 2). They will be able to view details and Protected
Copies, browse the Primary Data and Protected Copies, and manually create a new
Protected Copy. Super-users have a similar view with more details displayed in the
table.
8.Chargeback Manager
8.1 Adding a new ECS/ObjectScale VDC
Navigate to the Chargeback Manager page and use the Add VDC button located on the top right.
Enter the VDC address, API port (default 4443) and credentials. See
section 8.2 if you do not want to use the root
account.
When adding a new VDC, all Namespaces and Buckets are automatically discovered and
added to the NASLORD configuration. If your NASLORD instance is using a demo license,
only the first three (3) Namespaces will be automatically enabled.
With the demo license, you can add one (1) ObjectScale VDC and enable up to three (3)
Namespaces. Production licenses can be obtained without any Namespace limit.
Enter a name and password and select “System Monitor”. This user should
not be configured as a System Administrator nor as a Security
Administrator.
Click the “Save” button.
Use this username and password when adding the VDC to NASLORD.
8.3 Enabling Namespaces
Click on the VDC name (in bold) to see the list of Namespaces.
Right-click on a Namespace and use “Enable Namespace” or “Disable Namespace” as necessary.
For each Namespace, the root user, capacity used and creation timestamp are displayed.
After enabling a Namespace, you may need to click “Refresh Cache” in the blue menu bar
(white icon with double arrows).
Associate each Namespace with its Tenant (section 5) so the
usage appears in that Tenant’s charge reports.
8.4 Chargeback Profiles
A Chargeback Profile defines the rates used to convert usage into charges. NASLORD 3.0
has profiles for both platforms:
ObjectScale profiles: Creation and Deletion rates (per 1,000
operations), Ingress and Egress rates (per GiB), and Capacity rates (per GiB/month).
Ingress, Egress and Capacity support multiple tiers.
PowerScale profiles: Data capacity rate, Protection Overhead rate,
and Snapshot capacity rate (per GiB/month), with support for rate tiers.
To manage profiles:
In the Admin page, click on Chargeback Profiles.
NASLORD comes preconfigured with a “Default” profile. The Default profile can be
modified but cannot be deleted. Components without an explicitly assigned profile use
the Default profile.
Click the + Add Profile button on the top right corner to create a new profile.
Right-click on any profile to “Edit”, “Clone” or “Delete” it.
When configuring a profile, select the currency and adjust the rates. For tiered
rates, configure as many tiers as necessary; the last tier must be open-ended.
8.5 Assigning profiles to Namespaces, Buckets and Access Zones
Namespaces: in the list of Namespaces, right-click on a Namespace and
select “Associate Chargeback Profile”, then pick the desired profile in the pull-down
list.
Buckets: by default, all Buckets within a Namespace inherit the
Chargeback Profile of the parent Namespace. To override this, click on a Namespace to
view its Buckets, right-click on a Bucket and select “Associate Chargeback Profile”.
Only the profiles using the same currency as the parent Namespace’s profile can be
applied to individual Buckets. A Bucket can also be reconfigured to inherit again
from the parent Namespace.
Access Zones: assign a PowerScale Chargeback Profile to each Access
Zone that should be charged.
Remember the currency rule: every profile applied to a Tenant’s components must use the
Tenant’s currency.
8.6 How charges are calculated
ObjectScale capacity is billed per day: the monthly rate is divided
by the number of days in the month, and each daily charge is rounded to the cent.
Monthly totals can therefore differ from a naive capacity × rate calculation by a few
cents.
ObjectScale ingress/egress volumes (GiB) and object creation/deletion counts (per
1,000 operations) are summed over the month and charged once.
PowerScale charges are based on the zone’s data capacity, protection overhead and
snapshot usage, at the profile’s GiB/month rates.
Only enabled components are charged: a disabled Access Zone or
Namespace does not appear in charge reports.
A valid license covering the product is required; otherwise the charge reports are
generated empty (see section 13).
9.Charge reports and dashboards
Charge reports are generated per Tenant and per month
(period in YYYYMM format). The report for the current month covers the period up to
yesterday and is not available on the 1st of the month.
For each Tenant you can open:
the Charge Reports list (monthly history),
the Charge Details view (per-component breakdown),
the Consolidated Dashboard (charts and totals).
An administrator-level Consolidated Dashboard aggregates all Tenants.
Reports can be exported in PDF Summary, PDF Complete/Detailed, CSV, JSON and XML
formats, and rendered in English, French, Spanish, German or Portuguese.
You can also view the chargeback of a single Namespace with “View Chargeback” in the
white menu bar, or click a Bucket name to see the charts for that Bucket.
10.Automated report delivery
NASLORD can deliver charge reports automatically every month, and on demand.
Prerequisite: for e-mail delivery, configure the SMTP settings first
(section 12.1).
Report destinations
A destination defines where and how reports are sent:
SMTP: one or more e-mail recipients, with a configurable subject line.
SFTP: host, port, username/password, and remote path.
HTTP POST: URL, authentication (None, Basic, Bearer or API Key),
optional extra headers, TLS verification, and timeout.
Destinations can be individually enabled or disabled.
Report routes
A route binds a Tenant to a destination, and defines what is sent:
Scope: one specific Tenant, or Global (all Tenants).
Formats: any combination of PDF Summary, PDF Detailed, CSV, JSON and
XML (defaults to PDF Summary).
Language: English, French, Spanish, German or Portuguese.
Monthly delivery can be enabled or disabled per route, and a route can be triggered
manually at any time.
Monitoring deliveries
The Report Delivery pages show the report runs and every delivery attempt with its
outcome, so failed deliveries (unreachable SFTP server, SMTP error, HTTP failure) can
be diagnosed and re-triggered.
11.Tenant budgets
Budgets let you compare each Tenant’s actual charges against planned spending, and
alert when consumption approaches the plan.
Creating a budget
Open the Tenant’s Budget Dashboard from the Tenants page and create a budget.
Configure:
Name and currency (must match the Tenant currency)
Monthly budget amount and/or yearly budget amount
Fiscal year start month (default: January)
Start date, and an optional end date
Notes, enabled flag
Optionally break the budget down into components with their own monthly/yearly amounts.
Thresholds and notifications
When a budget is created, two alert thresholds are added automatically: 85% (Warning)
and 100% (Critical). Thresholds can be adjusted (integer percentages).
When actual charges cross a threshold, NASLORD can send an e-mail notification
(requires SMTP settings, section 12.1).
Dashboard and history
The Budget Dashboard shows budget versus actual for the selected period (monthly or
fiscal-year view).
Budget snapshots are recorded periodically, building a history that can be browsed in
the Budget Snapshots page and exported as JSON.
12.System administration
12.1 E-mail (SMTP) settings
Admin page → Email Settings: configure the SMTP server, port,
credentials and sender address, then use the “test e-mail” function to validate the
configuration. SMTP is required for report delivery by e-mail, monthly tenant reports,
and budget threshold notifications.
12.2 Timezone
Admin page → Timezone: set the appliance timezone. This affects
displayed timestamps and the scheduling of daily/monthly jobs.
12.3 Scheduled jobs and logs
Admin page → Scheduled Jobs: view the recurring jobs (metric
collection, report generation, report delivery, budget snapshots, cleanup) and their
execution logs. The scheduler can be restarted from this page if required.
12.4 Database management and backups
Admin page → Database Management:
Export Database: create a backup of the NASLORD configuration
database, and download it for safekeeping.
Import Database: restore a previously exported backup.
Existing backup files on the appliance can be downloaded, restored or deleted.
Gallium recommends exporting the database before every upgrade and on a regular
schedule.
12.5 License management
Admin page → License:
View the installed license: covered products, limits (clusters, zones, VDCs,
namespaces), version and expiry.
Install a new license key received from Gallium.
Reminders.
The demo license is valid for 90 days and is limited to 1 Cluster / 3 Access Zones,
1 Appliance / 3 Primary MTrees, and 1 VDC / 3 Namespaces.
Charge reports are empty when the license is missing, expired or
does not cover the product.
The license is validated against the product’s major version; a 2.x license is not
valid on 3.0.0 unless issued for “any” version.
12.6 Upgrades, reboot and shutdown
In-app upgrade: upload the NASLORD upgrade package on the Upgrade
page, review the confirmation screen and apply. Export the database first
(section 12.4).
The appliance can be rebooted or shut down from the web interface; application
services can also be reloaded without a full reboot.
Console-level reconfiguration (root password, network settings) is done with the
configure command in the VM console — see the Installation Guide.
13.Troubleshooting
Charge reports show $0 / empty
Check the license first (Admin page → License). Reports are generated
empty when the license is missing, expired, or does not cover the product (PowerScale
or ObjectScale). Also verify that:
the Access Zones / Namespaces concerned are enabled,
they are associated with the correct Tenant,
a chargeback profile with the Tenant’s currency is applied (or the Default profile is
configured with the correct rates).
A component is missing from the interface
Click “Refresh Cache” in the blue menu bar (white icon with double arrows) after
creating or changing objects directly on the storage systems.
On PowerProtect DD, if MTrees appear in the “Missing MTrees” column, right-click and
select “Synchronize MTrees”.
A report for this month is not available
The current-month report covers data up to yesterday and cannot be produced on the 1st
of the month; past months are complete. Future periods cannot be generated.
E-mail deliveries fail
Use the test function in Email Settings to validate SMTP connectivity, then check the
Report Delivery pages for the recorded delivery attempts and error details.
Capacity charges differ slightly from rate × GiB
This is expected: capacity is billed per day with each daily charge rounded to the cent
(see section 8.6).
14.How to contact Gallium
To inquire about NASLORD or to obtain a quote for a licensed version, please contact us
directly:
