I narrowly averted an outage on one of our most important servers today - a Windows Oracle server. It has several iSCSI LUNs, each in their own volume. DFM started alerting >90% utilisation on the volume that contains the C:\ drive LUN just after midday. The snapshots were huge. I deleted all the snapshots and gave the volume another 50GB to make sure it didn't stop. Now utilisation is down to ~25%.
But now I have to figure out what caused this.
A regular snapshot and snapmirror update happens at midday. And then the volume utilisation explodes. Here's the graph from DFM : http://imgur.com/2zA1VdP
So, I am trying to work out WHEN whatever activity caused this actually happened. The snapmirror happened at midday, then the volume utilisation exploded.
Am I right in thinking that whatever caused this snapshot growth happened AFTER the midday snapshot, rather than before midday?
There's nothing unusual in the event logs, so I'm going to have to ask the general population if anyone was doing any changes on that server at the time, and want to make sure I have my timeframes right.
Snapshots "grow" when data contained in these snapshots changes. So after snapshot was taken some host activity resulted in large amount of changed data. You have to check what your hosts do - there is nothing NetApp can do about it.
Yes, I definitely want to sleep like a baby. I think the fractional reserve is set at the default - 100%??. I can't tell right now (at home). But for what it's worth, this issue seems to have actually been caused by reallocate. We recently upgraded from 7.3 to 8.something, and the first reallocate on this volume seems to have exploded the snapshots. I'm reading up on how reallocate changes between 7.x and 8.x. It's pretty confusing. But thanks for the tips..