topic Re: Snapshot audit logs in ONTAP Discussions

Snapshot audit logs

SMLocke — Wed, 04 Jun 2025 22:07:34 GMT

Hello, comrades! In CDOT 8.2.3, is there a log I can look at (maybe in /etc/log or /etc/log/mlog) that describes what the system is doing with snapshots?

My use case: our snapshot retention policy is something like "12 daily, 8 weekly." A colleague wants to know if a daily snapshot was successful on such-and-so day, more than 12 days ago. That snapshot is gone, of course, but I'd like to see the log file that says "this snapshot for this volume was deleted as per retention policy." Is this a thing I can see, or is it wishful thinking?

Re: Snapshot audit logs

Sahana — Tue, 09 Feb 2016 08:49:18 GMT

Logs are available. Refer https://library.netapp.com/ecmdocs/ECMP1196890/html/man5/na_snapmirror.5.html

Re: Snapshot audit logs

SMLocke — Tue, 09 Feb 2016 15:58:01 GMT

Thanks for this, but these aren't the logs I'm looking for. You've provided a link that discussses SnapMirror logs, but what I'm looking for are snapshot logs.

I'm looking for any sort of logs that will say "created this snapshot at this time; deleted that snapshot at that time." Do such logs exist?

Re: Snapshot audit logs

georgevj — Wed, 10 Feb 2016 06:58:57 GMT

You can, if you are using Data ONTAP 8.3. There is a privileged command, "volume snapshot event-config modify". But you must consider the consequences of enabling this. Such commands can cause excessive logging into log files, leading to low space on /mroot and related issues. Please be aware.