topic Exclude "ALERT" event type vol.wafl.full for specific volumes in ONTAP Discussions

Exclude "ALERT" event type vol.wafl.full for specific volumes

bpostk — Wed, 04 Jun 2025 10:01:43 GMT

We have an SVM setup for an internal customer who creates persistent volumes for k8s vms using the trident driver. We have specific alerting setup for them in Active IQ that works for their needs, but we also use Ontap events for our purposes. Their volumes often fill up and then we get spammed with Ontap events for vol.wafl.full. Their volumes are created via the API and are added and removed as k8s vm's request resources, but they all volume names are prepended with "trident_pvc_"

Example vol names:

trident_pvc_836e672...

trident_pvc_836e073...

trident_pvc_836e332...

Is there a way to exclude the event wafl.vol.full and match to only volumes that start with the string "trident_pvc"?

I do not want to to exclude all wafl.vol.full events

This is what we currently use for a catch all:
Filter Name Rule Rule Message Name SNMP Trap Type Severity
Position Type
----------- -------- --------- ---------------------- --------------- --------
storageteam
10 include * * EMERGENCY, ALERT, ERROR
11 exclude * * *

Re: Exclude "ALERT" event type vol.wafl.full for specific volumes

pedro_rocha — Fri, 22 Apr 2022 17:10:31 GMT

I guess that modifying volume full thresholds would do the trick.

Check this out: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_configure_Aggregate_and_Volume_Nearly_Full_and_Full_Thresholds_in_Clustered_Data_ONTAP_8_and_ONTAP_9

Re: Exclude "ALERT" event type vol.wafl.full for specific volumes

bpostk — Fri, 22 Apr 2022 17:15:29 GMT

That looks to be a global change across the cluster? Which we wouldn't want to do, and some of these trident volumes can get to 100% at times before their checks kick in and push an expansion through the trident driver

Re: Exclude "ALERT" event type vol.wafl.full for specific volumes

pedro_rocha — Fri, 22 Apr 2022 17:25:11 GMT

did you check the command?

volume modify -volume VOL1...

You can change it on a per volume basis

Re: Exclude "ALERT" event type vol.wafl.full for specific volumes

bpostk — Mon, 25 Apr 2022 16:09:46 GMT

Good to know, thanks. As these volumes are created and destroyed dynamically, hopefully that is something that can be set with the trident driver.