ActiveCluster for File Veeam Backup
Hello everyone :-) we recently got a Flasharray with the new "ActiveCluster for File" feature, which is pretty nice. We are trying to switch to Veeam. We are using VMware. I therfore created a Linux based Veeam Backup & Replication Server as well as linux based proxies in our vCenter. Backing up VMs via the hot-add transport mode works without any issues. The issue that we are facing is, how do we backup the NFS shares created from the "ActiveCluster for File"? Because Veeam sees the VMDKs from the VMs in the vCenter but doesen't see the NFS mounts from Everpure in the guest OS of the VM. My questions and thoughts are: Is it possible to create an physical Linux based on Veeam proxy and connected it to the Everpure FlashArray? According to this link, Everpure doesn't support the storage snapshot Integration feature https://helpcenter.veeam.com/docs/vbr/userguide/storage_system_requirements.html?ver=13 This is the Plugin I wanted to use with the physical proxy which is connected to the FlashArray https://www.veeam.com/kb4129 I can add the NFS Share into Veeam and create backjobs but how does it technically work? It uses the VBR Server as an proxy.. But is that the right way? How can I create Veeam backup jobs for NFS mounts (which are mounted on VMs in the vCenter, which Veeam doesn't see) provided by ActiveCluster for File ? How does a Veeam file share backup work technically and how should the recommended backup design be in this scenario? Thank you!
NDU replacement/upgrade
Hello everyone, I have a question I do not find an answer. I have found these two commands that may or may not do the same thing, but can't confirm anywhere purewes controller setattr --verify-array <array_name> ct0 --mode secondary and puredb run giveback --safe <---- run from ct0 Supposedly, they both set ct0 as secondary, therefore ct1 as primary. But, is it? What is the difference? ThanksEntra ID SAML2 SSO on FlashArray (Purity//FA 6.12.3), including fleets
Hi everyone, Here is a working setup for single sign-on from Microsoft Entra ID to a FlashArray, tested on Purity//FA 6.12.3, which is the newest version at the time of writing. It follows the Microsoft tutorial for Pure Storage SSO (https://learn.microsoft.com/en-us/entra/identity/saas-apps/pure-storage-sso-tutorial) and adds the fixes I needed to get the login test to pass. It also covers adding more arrays and fleets. Two things that break the login if you skip them The gallery app ships with role names that do not match the FlashArray role names. If you do not rename them, the login test fails because the array cannot find the role (Step 6). The claims must have no namespace URI (Step 5). What you need An array admin login Entra admin rights (Enterprise applications and App registrations) The Pure Storage SSO app from the Entra App Gallery A user or group to assign Overview Create a certificate on the array Configure SAML2 SSO on the array Entra app and the array certificate Load the Entra signing certificate on the array Claims (delete the namespace URI) Fix the app role names Assign, test and enable Plus: more arrays and fleets, and a troubleshooting list at the end. Step 1: Create a certificate on the array The array needs its own RSA certificate to sign SAML requests and decrypt assertions. Do not use the management certificate: it is EC 256 and caused a 500 error for me. purecert self-signed create saml-sp --common-name myarray.pure --days 365 purecert list The saml-sp row should show self-signed, rsa, 2048. Note the expiry date: SSO signing stops working when it expires. Step 2: Configure SAML2 SSO on the array Go to Settings › Access › Users and Policies › SAML2 SSO and edit the configuration. Array URL: the array FQDN, for example https://myarray.pure/. Signing Credential and Decryption Credential: type the certificate name saml-sp. Do not paste certificate text. Switch on Sign Request and Encrypt Assertion. IdP Entity ID, URL and IdP Metadata URL: copy them from the Entra app (Set up Pure Storage SSO section). Keep Enabled off for now and save. Without credentials, saving fails with "Must provide signing credential when signed request is enabled" and the same message for decryption. The GUI can silently keep management, so check the result in the CLI: puresso saml2 list puresso saml2 test Both credential columns must show saml-sp. If not, set them directly: puresso saml2 setattr Entra-ID --signing-credential saml-sp --decryption-credential saml-sp This can print "Certificate claim does not exist." even though the values were applied, so trust the list output. Step 3: Entra app and the array certificate In the Entra admin center go to Enterprise apps › New application, search Pure Storage SSO and add it. Open Single sign-on › SAML › Basic SAML Configuration. Set Identifier to the array's SP Entity ID and Reply URL to the array's Assertion Consumer URL. Both are shown in the array's SAML2 SSO dialog, so copy them from there. On the array, open the certificates page and download saml-sp. Rename the extension from .crt to .cer. In the Entra app go to Single sign-on › SAML Certificates › Verification certificates › Edit, tick Require verification certificates, and upload the .cer. Because Encrypt Assertion is on, also import the same .cer under Token encryption and activate it (see the token encryption guide under Links). Check that you exported the right certificate: openssl x509 -in saml-sp.cer -noout -subject -enddate The subject must show the common name you used in Step 1, not the GUI certificate. Step 4: Load the Entra signing certificate on the array The array needs Entra's signing certificate to validate the response. If this is empty the array test still shows OK, but a real login fails. In Entra open Single sign-on › SAML Certificates and download Certificate (Base64). Open the file, copy everything including the BEGIN CERTIFICATE and END CERTIFICATE lines. In the array's SAML2 SSO dialog click Edit next to Verification Certificate and paste it. CLI alternative: puresso saml2 setattr Entra-ID --verification-certificate Step 5: Claims (delete the namespace URI) In the Entra app go to Single sign-on › Attributes & Claims › Edit. Open each claim, clear the Namespace field completely, and make sure the names match exactly: dn: user.onpremisesdistinguishedname email: user.mail (or user.userprincipalname for UPN) family_name: user.surname given_name: user.givenname purity_roles: user.assignedroles (required for array level SSO) Step 6: Fix the app role names The Pure Storage SSO gallery app is set up incorrectly for its role names. It ships readonly_role, ops_admin_role, storage_admin_role and array_admin_role with an empty value. The names must match the FlashArray role names exactly, otherwise the login test fails because the array cannot find the role. The roles are edited in App registrations, not in the Enterprise application: Go to App registrations › All applications and search for the app name. Open App roles and click a role. In Display name, remove the _role suffix. In Value, enter the role name, for example array_admin. Click Apply and repeat for the other roles. array_admin_role → Display name: array_admin, Value: array_admin storage_admin_role → Display name: storage_admin, Value: storage_admin ops_admin_role → Display name: ops_admin, Value: ops_admin readonly_role → Display name: readonly, Value: readonly Leave msiam_access as it is. Step 7: Assign, test and enable In the Entra app go to Users and groups › Add user/group, pick the user, click Select a role and choose one of the renamed roles. Only one role per assignment. On the array open the SAML2 SSO dialog and click Test. All lines must be green and the first two must show saml-sp. Click E2E Test, sign in with the assigned user, then click Check E2E Test Result. If it passes, switch Enabled on and save. The login page now shows Click for Single Sign-On and a Local Access link. Tip: Keep a working local admin login in case something on the Entra side breaks or a certificate expires. More arrays and fleets Each array needs its own certificate, and that certificate must be uploaded to Entra under Verification certificates, next to the ones from the other arrays. You do not need a new Enterprise application per array. If you use Fusion / fleet manager, enable Trust Other SAML Service Providers In Fleet in the SAML2 SSO configuration and apply these settings on each additional array: Create the certificate on that array (Step 1) with its own common name. Use the same SSO configuration name as on the first array. Array URL: the FQDN of the new array. SP Entity ID: set it to Manual and paste the SP Entity ID of the first array. All fleet members must use the same SP Entity ID. Signing Credential and Decryption Credential: saml-sp, the certificate of this array. Switch on Sign Request and Encrypt Assertion. Identity Provider fields and Verification Certificate: the same values you used on the first array. In the Entra app, add a second Reply URL with the Assertion Consumer URL of the new array, and upload the new array's saml-sp .cer under Verification certificates. Run Test and E2E Test before enabling. After that you can sign in on the other arrays with the same Entra users, roles and claims. Note: If you use Encrypt Assertion on several arrays, check this: Entra token encryption uses one active certificate per application, so test each array with the E2E test. Troubleshooting Save fails: must provide signing or decryption credential: Create saml-sp and enter its name in both fields Red error echoes a long MIID... string: You pasted certificate text. Type the certificate name instead Test shows management as credential: Run puresso saml2 setattr as in Step 2 500 Internal Server Error when starting login: The credential was the EC management certificate. Switch to the RSA saml-sp certificate Login test fails, role not found: Rename role display name and value in App registrations (Step 6) Login fails or user has no role: Clear the claim namespaces and check purity_roles = user.assignedroles (Step 5) Verification certificate shows - in the test: Paste the Entra Base64 certificate (Step 4) If you do not need signed requests or encrypted assertions, you can switch off Sign Request and Encrypt Assertion and skip the certificate steps. Links Configure Pure Storage SSO for Single sign-on with Microsoft Entra ID (https://learn.microsoft.com/en-us/entra/identity/saas-apps/pure-storage-sso-tutorial) Configure Microsoft Entra SAML token encryption (https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption) Manage certificates for federated single sign-on (https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on) App roles UI (https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps#app-roles-ui) Hope this saves someone some time. Questions and corrections are welcome.10012026 - TechTalk Recap - Oracle Resiliency—Choosing the Right Data Protection Approach🛡️
If you missed our latest TechTalks session, Lester Wells and I explored an important reality for Oracle teams: there is no single data-protection feature that covers every failure scenario. Keeping Oracle resilient means looking beyond a simple “backup or HA” decision. The right approach layers protection for local failures, site failures, operational recovery, and logical corruption—then aligns each layer to the application’s business requirements. What you missed 👇 🧭 HA and DR are different problems. High availability helps applications continue through infrastructure failures; disaster recovery protects against a broader site-level event. Both matter, but not every database needs the same RPO or RTO. ⚡ Snapshots improve operational recovery. Fast, space-efficient snapshots can help reduce backup and recovery pressure, refresh dev/test environments, support reporting copies, and provide recovery points for ransomware or user errors. 🏢 ActiveCluster is designed for continuous availability. For metro-distance deployments that meet latency requirements, synchronous replication can provide zero RPO and zero RTO protection against array or site failure. 🌍 ActiveDR extends protection across distance. Continuous, asynchronous replication supports disaster recovery where synchronous replication is not practical—and enables non-disruptive DR testing. 🧩 Layered protection covers more failure modes. Oracle RAC, ActiveCluster, ActiveDR, Data Guard, Flashback, and snapshots each address different risks. Combining the right layers helps protect both availability and recoverability. 🔎 Replication does not replace logical recovery. A bad write, accidental delete, or corruption can replicate correctly. Point-in-time snapshots and database-level recovery tools remain important parts of the plan. One of the best practical examples was using ActiveDR to bring up and validate a DR environment without disrupting production. That makes it easier to test your recovery plan more often—before you need it. 🎥 Catch up on the session HERE🎥 💬 Which Oracle resilience challenge is top of mind for your team: backup windows, recovery time, site-level availability, DR testing, or protection from logical errors? Share your perspective in the comments.
What’s New in Virtualization: From Hypervisors to Kubernetes
July 16 | Register Now! Modern virtualization is evolving and organizations are now managing a growing mix of hypervisors, container platforms, and cloud environments. Join the session for a deep dive into how Everpure integrates with several virtualization platforms. We’ll cover VMware Cloud Foundation 9.1, the new Nutanix partnership, OpenShift Virtualization, Proxmox, and Azure Local updates. Discover how the Everpure 2026 roadmap delivers the flexibility and performance needed for any hypervisor or container strategy. See what’s new, what’s amazing, and what’s next in the future of modern data storage. Latest integrations: Updates on VCF 9.1, Proxmox, and Azure Local Modern platforms: The new Nutanix partnership and OpenShift Virtualization What’s next: A sneak peek at the Everpure 2026 roadmap Register Now!A list of useful Purity CLI commands to manage Pure Flash Storage arrays.
"pureadmin" commands The pureadmin command displays and manage administrative accounts in Pure Flash Storage Array (22 Commands) Explanation pureadmin create testuser --api-token Generate an API token for the user testuser pureadmin create testuser --api-token --timeout 2h Create API Token for testuser valid for 2 hours pureadmin create testuser --role storage_admin Create user testuser with storage_admin role. Possible roles are readonly, ops_admin, storage_admin, array_admin pureadmin delete --api-token Delete API Token for current user pureadmin delete testuser Delete user testuser from Flash Array pureadmin delete testuser --api-token Delete API Token for user testuser pureadmin global disable --single-sign-on This will disable single sign-on on the current array. Enabling single sign-on gives LDAP users the ability to navigate seamlessly from Pure1 Manage to the current array through a single login. pureadmin global enable --single-sign-on This enables single sign-on on the current array. Enabling single sign-on gives LDAP users the ability to navigate seamlessly from Pure1 Manage to the current array through a single login. pureadmin global list List the global administration attributes like Lockout Duration, Maximum Login Attempts, Minimum Password Length, etc.. pureadmin global setattr --lockout-duration 1m Set the lockout duration to 1 minute after maximum unsuccessful login attempts. pureadmin global setattr --max-login-attempts 3 Set the maximum failed login attempts to 3 before the user get locked out. pureadmin global setattr --min-password-length 8 Set the minimum length of characters required for all the local user account passwords to 8. Minimum length allowed is 1. This will not affect the existing user accounts, but all future password assignment must meet the new value. pureadmin list List all the users configured in the Flash Array pureadmin list --api-token List all the users with api tokens configured pureadmin list --api-token --expose List all the users with api tokens configured and expose the api token for the current user loggedin. pureadmin list --lockout List all the user accounts that are currently lockout pureadmin refresh --clear Clears the permission cache for all the users pureadmin refresh --clear testuser Clears the permission cache for testuser pureadmin refresh testuser Refresh the permission cache for testuser pureadmin reset testuser --lockout Unlock locked user testuser pureadmin setattr testuser --password Change the password for the user testuser pureadmin setattr testuser --role array_admin Change the role of the user testuser to array_admin role. Possible roles are readonly, ops_admin, storage_admin, array_admin "purealert" commands The purealert command manages alert history and the list of designated email addresses for alert notifications (8 Commands) Explanation purealert flag 121212 Flag an alert with ID 121212. This will appear in the flagged alert list. purealert list List all the alerts generated in the Pure Flash Array purealert list --filter "issue='failure'" List all the alerts generated for failures purealert list --filter "severity='critical'" List all the alerts with Critical severity. purealert list --filter "state='closed'" List all the closed alerts purealert list --filter "state='open'" List all the alerts in Open state purealert list --flagged List all the alerts that are flagged. By default all alerts are flagged. We can unflag command once those are resolved. purealert unflag 121212 Unflag alert with ID 121212. This will not appear in the flagged alert list. "purearray" commands The purearray command displays attributes and monitors I/O performance in Pure Flash Storage Array (24 Commands) Explanation purearray connect --management-address 10.0.0.1 --type async-replication --connection-key Connects the local array to remote array 10.0.0.1 for asynchronous replication using the connection key. The Connection key will be prompted to enter. purearray connect --management-address 10.0.0.1 --type sync-replication --connection-key Connects the local array to remote array 10.0.0.1 for synchronous replication using the connection key. The Connection key will be prompted to enter. purearray connect --management-address 10.0.0.1 --type sync-replication --replication-transport ip -- connection-key Connects the local array to remote array 10.0.0.1 for synchronous replication via Ethernet transport using the connection key. The Connection key will be prompted to enter. purearray disable phonehome Disable phonehome or dialhome feature of array. purearray disconnect 10.0.0.1 Disconnects array 10.0.0.1 from the local array connected for remote replication. purearray enable phonehome Enable phonehome or dialhome feature of array. purearray list Display the array name,serial number and firmware version purearray list --connect Display remotely connected arrays for replication purearray list --connect --path Display arrays connected for remote replication along with connection paths purearray list --connect --throttle Display the replication throttle limit purearray list --connection-key Display the connection key that can be used to connect to the array purearray list --controller List all the controllers connected to the Array. This will also display the model and status of each controller purearray list --ntpserver List the NTP servers configured purearray list --phonehome Display the dial home configuration status of the Array purearray list --space Display the capacity and usage statistics information of the Array. purearray list --space --historical 30d Display the capacity and usage statistics information of the Array since last 30 days purearray list --syslogserver List the syslog server names configured to push the logs in pure array purearray monitor --interval 4 --repeat 5 Display the array-wide IO performance of a Flash Array in every 4 seconds for 5 times. purearray remoteassist --status check the Remote Assist is active or inactive purearray rename MYARRAY001 Set the name of the array to MYARRAY001 purearray setattr --ntpserver '' Remove all the NTP servers configured for pure array purearray setattr --ntpserver time.google.com Set the NTP server purearray setattr --syslogserver '' Remove all the syslog server servers configured for pure array purearray setattr --syslogserver log.server.com set the syslog server for pure array "pureaudit" commands The pureaudit command displays and manages the audit logs record details in Pure Flash Storage Array (7 Commands) Explanation pureaudit list Display the list of audit records. Audit trail records are created whenever administrative actions are perfromed by a user (for eg: creating, destroying, eradicating a volume) pureaudit list --filter 'command="purepod" and subcommand="create"' List all the audit records for purepod create command executed in the array pureaudit list --filter 'command="purepod" and user="pureuser"' List all the audit records for purepod commands executed by pureuser in the array pureaudit list --filter 'command="purepod"' List all the audit records for purepod command executed in the array pureaudit list --filter 'user = "root"' Display the list of audit records for the root user pureaudit list --limit 10 Display the first 10 rows of audit records pureaudit list --sort user Display the list of audit records sorted by the user field. By default the records are sorted by the time field "pureconfig" commands The pureconfig command provides commands to reproduce the current Pure Flash Storage Array configuration (4 Commands) Explanation pureconfig list Display list of commands to reproduce the volumes, hosts, host groups, connections, network, alert and array configurations. Copying this and running in another array will create an exact copy. pureconfig list --all Displays all the commands required to reproduce the current FlashAarray configuration of hosts, host groups, pods, protection groups, volumes, volume groups, connections, file systems and directories, alert, network, policies, and support. pureconfig list --object Displays the object configuration of the FlashArray including hosts, host groups, pods, protection groups, volumes, volume groups, and connections, as well as file systems and directories if file services are enabled. pureconfig list --system Displays the system configuration of the flah array including network, policies, alert and support puredns commands The puredns command manages the DNS attributes for an arrays administrative network. (4 Commands) "puredns" list Display the current DNS parameters configured in the array. This includes the domain suffixes and IP addresses of the name servers Explanation puredns setattr --domain "" Removes the domain suffix from Purity//FA DNS queries puredns setattr --domain test.com --nameservers 192.168.0.10,192.168.2.11 Add the IPv4 addresses of two DNS servers for Array to use to resolve hostnames to IP addresses, and the domain suffix test.com for DNS searches. puredns setattr --nameservers"" Unassigns DNS server IP addresses from the DNS entry. This will stop making DNS entries. "puredrive" commands The puredrive command provides information about the Flash Drives and NVRAM modules in Pure Flash Storage Array (6 Commands) Explanation puredrive admit Admit all drive modules that have been added or connected but not yet admitted to the array. Once successfully admitted, the status of the drive modules will change from unadmitted to healthy. puredrive list List all the flash drive modules in an Array. This will also display the capacity of each module. puredrive list --spec List all the flash drive modules in an Array along with Protocol( SAS/NVME) information puredrive list --total List all the flash drive modules in an Array with the total capacity figure puredrive list CH0.BAY10 Display information about flash drive BAY10 in CH0 puredrive list CH0.BAY10 --pack Display information about flash drive BAY10 in CH0 and all other drives in the same pack
