ONTAP Discussions

Strange snapshots with UUID names in braces

nappadmin
996 Views

Model: AFF-A200 running ONTAP 9.8P14

 

Hi all,

We notice something has been creating snapshots on some but not all volumes. The snapshot names are UUIDs in braces, e.g.: {1e694cb2-bddb-11ee-81a5-00a098db949a}.

We checked, they are not created by the volume's snapshot-policy. Those snapshots have normal names.

The strange thing about these UUID-named snapshots is that they are not created on a set schedule. They don't appear everyday, but on random days.

We don't know what created them and how long they will be kept, or if they will even be auto-deleted at all. So we have been manually deleting some older ones.

Can you suggest what settings or logs we can look at to help identify the source of these snapshots?

Thanks for your help!

2 REPLIES 2

dbenadib
834 Views

Hi,

 

EMS logs can be a good start or even command audit log can help you figure out what and who's creating snapshots.

 

dbenadib_0-1712050055773.png

 

 As an example here I can see that ip 192.168.0.5 did create a snapshot named 897348926478923564823467823643298 with success conecting via SSH and using admin credentials. In your case you might see ZAPI or REST.

 

The audit log command can also be filtered by timestamp or message etc..

 

https://kb.netapp.com/onprem/ontap/os/Overview_of_ONTAP_Logs 

 

HTH

 

David B

nappadmin
626 Views

Thanks for the info, that should give us a lead.

Public