If I take a snapshot of a volume and I see that snapshot's size changes every minute, is it safe to conclude there has been data changes in that volume since the snapshot was taken? I thought so but just want to make sure I don't miss anything.
Solved! See The Solution
Yes - safe, but not 100% - it may be changing due to background ONTAP processes, such as deduplication, compression, but most likely from clients reading or writing data (read time updates will change metadata, so snapshot size - so it doesn't necessarily mean write, but often does)
In my case, I have observed snapshot sizes only increase so it does not look like to be the result of deduplication/compression. I have concerns about this because in my scenario all the servers mounting to this set of volumes have been powered off but I still see these volumes' snapshots grow at a steady rate after snapshots are taken. I suspect there are other servers mounting to the volumes as well.
Snapshot "size" never decreases. It is amount of data changed since snapshot had been taken. Deduplication/compression change data as well (not user visible data, but what is actually stored on volumes), so they cause snapshot growth.