How to Remove
Retention Locked Files

SYMPTOMS

"Permission denied" message when attempting to remove files that are under a Retention Lock period.

APPLIES TO

• All Data Domain systems
• DDOS 5.0 and later
• Retention Lock License

PURPOSE

Although the Retention Lock feature is designed to expressly prevent removal of locked files through the duration of the Retention period, there may arise occasions when it is necessary to override the Retention Lock.  This article provides instructions to do so.

CAUSE

By design, files under a Retention Lock cannot normally be removed within their specified retention period.

SOLUTION

The following example walks through the process of reverting the retention-lock on a file and its subsequent removal.

Note that retention lock must be currently enabled for the process below to work. If it was previously enabled, but currently disabled, you may need to re-enable retention lock before proceeding.

Also note that because the revert is a recursive process, it has to operate on each single file or directory, therefore may take a long time if there is a large number of files.

Assume a directory mounted from a Data Domain system with two files in it, and Retention Lock enabled.  Note that this example uses an NFS mount, but CIFS can also be used.

  # pwd

  /nfs_mount/backup/ret-lock-test

  # ls -al

  total 1

  drwxr--r--  2 root root 232 Apr  2 22:04 .

  drwxr-xr-x  3 root root 157 Apr  2 21:09 ..

  -rw-r--r--  1 root root   0 Jan  1  2013 test-locked-file

  -rw-r--r--  1 root root   0 Jan  1  2013 test-locked-file2

Now we’ll attempt to remove one of the files.

  # rm ./test-locked-file

  rm: remove write-protected regular empty file `./test-locked-file'? yes

  rm: cannot remove `./test-locked-file': Permission denied

  # ls -al

  total 1

  drwxr--r--  2 root root 232 Apr  2 22:04 .

  drwxr-xr-x  3 root root 157 Apr  2 21:09 ..

  -rw-r--r--  1 root root   0 Jan  1  2013 test-locked-file

  -rw-r--r--  1 root root   0 Jan  1  2013 test-locked-file2

The system correctly refuses to allow the file to be removed due to the retention lock.  Note that even though the error is a generic "Permission denied," in this instance it is due to the Retention Lock.

Logging onto the Data Domain system using an administrator account, we can verify the existence and settings for the Retention Lock feature, as follows (note that /data/col1/backup is the directory containing the relevant files on the Data Domain system):

  sysadmin@DD670# mtree retention-lock show min-retention-period mtree /data/col1/backup

  Retention-lock min-retention-period of mtree /data/col1/backup is: 50 days.

  sysadmin@DD670# mtree retention-lock show max-retention-period mtree /data/col1/backup

  Retention-lock max-retention-period of mtree /data/col1/backup is: 900 days.

In order to allow removal of the file, we must revert the retention lock, as follows:

  sysadmin@UK-DD670# mtree retention-lock revert "/data/col1/backup/ret-lock-test/test-locked-file"

  The 'mtree retention-lock revert' command removes retention-lock on this path thereby

  making it unprotected.

         Are you sure? (yes|no|?) [no]: yes

  ok, proceeding.

  Please enter sysadmin password to confirm 'mtree retention-lock revert':

  Message from syslogd@UK-DD670 at Mon Apr  2 22:18:47 2012 ...

  UK-DD670 ddfs[4324]: ALERT: MSG-SFS-00036: The command to reset retention was invoked

  on /data/col1/backup/ret-lock-test/test-locked-file

Now we can successfully remove the file:

  # rm ./test-locked-file

  # ls -al

  total 1

  drwxr--r--  2 root root 167 Apr  2 22:19 .

  drwxr-xr-x  3 root root 157 Apr  2 21:09 ..

  -rw-r--r--  1 root root   0 Jan  1  2013 test-locked-file2

However, note that the Retention Lock feature is still in place for other files in the directory (and elsewhere on the Data Domain system).

  # rm ./test-locked-file2

  rm: remove write-protected regular empty file `./test-locked-file2'? yes

  rm: cannot remove `./test-locked-file2': Permission denied

  # ls -al

  total 1

  drwxr--r--  2 root root 167 Apr  2 22:19 .

  drwxr-xr-x  3 root root 157 Apr  2 21:09 ..

  -rw-r--r--  1 root root   0 Jan  1  2013 test-locked-file2

WARNING:  If the "mtree retention-lock revert" command is applied to a directory, it will recursively remove the retention-lock for the directory and all files and sub-directories within the directory.  This is very useful, but always be certain that the parameters used in the command match the desired results.