Is there any tool available to find the which qtree is contributing more data change?

[selvi]

Hi,

I  have a volume whose snapshots are occupying lot of space. This volume contains qtrees  which are accessed thro CIFS shares and are quota set. If I take a quota report every 2 -3 hrs and check, there is no much change in the  "used size" of the qtree. it shows only some KBs of change.

My actual data size is 350 GB.  we are retaining 10 weekly, 10 nightly, 6 hourly snapshots. Snap reserve is full and it has started consuming space from volume.  due to the same volume is now 910 GB full. Its increasing 30-40 GB per day due to the snapshots. Sum of used size of qtrees in quota report shows only 1 or 2 GB increase daily.   I want know if any user is deleting and adding data into the qtree hence contributing more space in snapshot.

Is there any way to find the same?

regards,

Selvi

[aborzenkov]

Snapshot “grows” due to data changes, not due to data additions. After adding 20G of data snapshot size will remain the same (almost because of metadata overhead), but after changing 20G of data size of active file system will not change, but snapshot will appear to “grow” to 20G.

I suggest getting file modification time report to see, how many files are changed. You mentioned in another post that most files are office documents. In this case every changed file almost sure implies completely new version with old one possibly frozen in snapshot.

Get several consecutive snapshots; compare file modification times to see whether files were changed between snapshots. I suspect sum of changed file sizes will be close to snapshot size.

You could also enable audit to get exact report who is accessing files.