Strange snapshots with UUID names in braces

[nappadmin]

Model: AFF-A200 running ONTAP 9.8P14

Hi all,

We notice something has been creating snapshots on some but not all volumes. The snapshot names are UUIDs in braces, e.g.: {1e694cb2-bddb-11ee-81a5-00a098db949a}.

We checked, they are not created by the volume's snapshot-policy. Those snapshots have normal names.

The strange thing about these UUID-named snapshots is that they are not created on a set schedule. They don't appear everyday, but on random days.

We don't know what created them and how long they will be kept, or if they will even be auto-deleted at all. So we have been manually deleting some older ones.

Can you suggest what settings or logs we can look at to help identify the source of these snapshots?

Thanks for your help!

[dbenadib]

Hi,

EMS logs can be a good start or even command audit log can help you figure out what and who's creating snapshots.

 As an example here I can see that ip 192.168.0.5 did create a snapshot named 897348926478923564823467823643298 with success conecting via SSH and using admin credentials. In your case you might see ZAPI or REST.

The audit log command can also be filtered by timestamp or message etc..

https://kb.netapp.com/onprem/ontap/os/Overview_of_ONTAP_Logs 

HTH

David B

[nappadmin]

Thanks for the info, that should give us a lead.