topic Re: resize root volume in ONTAP Discussions

resize root volume

SVHO — Wed, 04 Jun 2025 11:03:10 GMT

Can you resize the root volume like any other volume? We are looking to forward the audit logs to an external device and was told it will take up some space if we turn it on.

From the OnCommand Manager it shows.

cm_svm_root volume (shows as volumes on SVM).

Thanks,

Re: resize root volume

Ontapforrum — Tue, 30 Jun 2020 19:35:26 GMT

Hi,

I guess you are talking about 'audit' logs for NAS ?

For audit logs, there are '2' volumes which are separate and should ideally be nothing to do with SVM root volume.

Audit records are initially stored in binary staging files (on staging volume MDV*) and later consolidated and converted to user-readable event logs, which are stored in the audit event log directory (Existing_non_root or separate small size volume) for the SVM. Even though the size of the log directory is 200MB (with log rotation), shouldn't be on svm_root_vol.

You can check staging volume space usage:

::> df -h MDV*
or,
::> volume show -vserver <cluster> -volume MDV*

To resize:
::*> set diag
::*> volume size -vserver <cluster> -volume MDV_aud_*

To resize "log directory" volume, you can resize normally without going into diag level.

KB:
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_is_a_staging_volume_and_how_to_use_it_to_troubleshoot_issues%3F

How to troubleshoot space issues related to the staging volumes
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-EA958194-3CE9-4022-B6CD-A66E263FD4F8.html

On the side note: There is another 'root volume'(Most IMPORTANT one) which is Node's root volume (Part of the root aggregate): which is reserved for system files, log files, and core dump files.
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-sag%2FGUID-A60F4F83-0034-4DB8-838B-06E9D4BEF9A4.html

Thanks!

Re: resize root volume

SVHO — Tue, 30 Jun 2020 21:59:02 GMT

Yes this is for the audit logs. I opened a a case with support and just like you said, it has nothing to do with the SVM root volume.

User support points to the volume labeled "vol0" from each of the aggregate as the place holder for the logs.

volume show

cmnas-01 vol0 root_cmcnas01 online RW 348.6GB 305.0GB 12%
cmnas-02 vol0 root_cmcnas02 online RW 348.6GB 299.2GB 14%

Thanks,

Re: resize root volume

Ontapforrum — Tue, 30 Jun 2020 22:19:12 GMT

Yes, those are 'root' volume for each Node, which is created when you install Ontap software on the root aggregate. This is where 'Security Audit Logs' are stored. The one I mentioned in the first response is NAS Audit logs (cifs/nfs).

/mroot/etc/log/

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-sag%2FGUID-E593FD00-D062-4649-853A-4409E282FA12.html