ONTAP Discussions

Snapshot audit logs


Hello, comrades! In CDOT 8.2.3, is there a log I can look at (maybe in /etc/log or /etc/log/mlog) that describes what the system is doing with snapshots? 


My use case: our snapshot retention policy is something like "12 daily, 8 weekly." A colleague wants to know if a daily snapshot was successful on such-and-so day, more than 12 days ago. That snapshot is gone, of course, but I'd like to see the log file that says "this snapshot for this volume was deleted as per retention policy." Is this a thing I can see, or is it wishful thinking?




Logs are available. Refer https://library.netapp.com/ecmdocs/ECMP1196890/html/man5/na_snapmirror.5.html

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.


Thanks for this, but these aren't the logs I'm looking for. You've provided a link that discussses SnapMirror logs, but what I'm looking for are snapshot logs.


I'm looking for any sort of logs that will say "created this snapshot at this time; deleted that snapshot at that time." Do such logs exist?


You can, if you are using Data ONTAP 8.3. There is a privileged command, "volume snapshot event-config modify". But you must consider the consequences of enabling this. Such commands can cause excessive logging into log files, leading to low space on /mroot and related issues. Please be aware.

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.
Cannot find the answer you need? No need to open a support case - just CHAT and we’ll handle it for you.
NetApp on Discord Image

We're on Discord, are you?

Live Chat, Watch Parties, and More!

Explore Banner

Meet Explore, NetApp’s digital sales platform

Engage digitally throughout the sales process, from product discovery to configuration, and handle all your post-purchase needs.

NetApp Insights to Action
I2A Banner