User-defined workload Represents the input/output (I/O) operations from clients to a storage object that belongs to a policy group. A storage object is one of the following:
A Vserver with FlexVol volumes
A FlexVol volume
A file (typically represents a virtual machine) I/O to storage objects that are not assigned to policy groups belong to the 'User-Default' workload.
System-defined workload Represents internal work that the cluster performs. Storage QoS controls specific system operations to prevent them from interfering with client operations. Examples include storage efficiency operations and data replication operations.
System default is anything internal to WAFL basically, or ONTAP. If you have an idle system you're more likely to see it. Basically we have internal QoS workloads for deduplication, SnapMirror, etc., but there are some internal workloads that just don't have a QoS workload assigned, so we put them in a default bucket.
Correct. It will use 100% of whatever 1-5% of CPU is actually in use. Since they normally are idle processes unless called upon, this will appear to be higher. Either way, it is completely normal/working as intended.