Exclude "ALERT" event type vol.wafl.full for specific volumes

[bpostk]

We have an SVM setup for an internal customer who creates persistent volumes for k8s vms using the trident driver.  We have specific alerting setup for them in Active IQ that works for their needs, but we also use Ontap events for our purposes.   Their volumes often fill up and then we get spammed with Ontap events for vol.wafl.full.   Their volumes are created via the API and are added and removed as k8s vm's request resources, but they all volume names are prepended with "trident_pvc_"

Example vol names:

trident_pvc_836e672...

trident_pvc_836e073...

trident_pvc_836e332...

Is there a way to exclude the event wafl.vol.full and match to only volumes that start with the string "trident_pvc"?

I do not want to to exclude all wafl.vol.full events

This is what we currently use for a catch all:
Filter Name Rule Rule Message Name SNMP Trap Type Severity
Position Type
----------- -------- --------- ---------------------- --------------- --------
storageteam
10 include * * EMERGENCY, ALERT, ERROR
11 exclude * * *

[pedro_rocha · Accepted solution]

I guess that modifying volume full thresholds would do the trick.

Check this out: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_configure_Aggregate_and_Volume_Nearly_Full_and_Full_Thresholds_...

[bpostk]

That looks to be a global change across the cluster?  Which we wouldn't want to do, and some of these trident volumes can get to 100% at times before their checks kick in and push an expansion through the trident driver

[pedro_rocha]

did you check the command?

volume modify -volume VOL1...

You can change it on a per volume basis

[bpostk]

Good to know, thanks.  As these volumes are created and destroyed dynamically, hopefully that is something that can be set with the trident driver.