resize root volume

[SVHO]

Can you resize the root volume like any other volume?  We are looking to forward the audit logs to an external device and was told it will take up some space if we turn it on.

From the OnCommand Manager it shows.

cm_svm_root volume (shows as volumes on SVM).

Thanks,

TT

[Ontapforrum]

Hi,

I guess you are talking about 'audit' logs for NAS ? 

For audit logs, there are '2' volumes which are separate and should ideally be nothing to do with SVM root volume.

Audit records are initially stored in binary staging files (on staging volume MDV*) and later consolidated and converted to user-readable event logs, which are stored in the audit event log directory (Existing_non_root or separate small size volume) for the SVM. Even though the size of the log directory is 200MB (with log rotation), shouldn't be on svm_root_vol.

You can check staging volume space usage:

::> df -h MDV*
or,
::> volume show -vserver <cluster> -volume MDV*

To resize:
::*> set diag
::*> volume size -vserver <cluster> -volume MDV_aud_*

To resize "log directory" volume, you can resize normally without going into diag level.

KB:
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_is_a_staging_volume_and_how_to_use_it_to_troubleshoot_issues%3F

How to troubleshoot space issues related to the staging volumes
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-EA958194-3CE9-4022-B6CD-A66E263FD4F8.html

On the side note: There is another 'root volume'(Most IMPORTANT one) which is Node's root volume (Part of the root aggregate): which is reserved for system files, log files, and core dump files.
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-sag%2FGUID-A60F4F83-0034-4DB8-838B-06E9D4BEF9A4.html

Thanks!

[SVHO]

Yes this is for the audit logs.  I opened a a case with support and just like you said, it has nothing to do with the SVM root volume.

User support points to the volume labeled "vol0" from each of the aggregate as the place holder for the logs.

volume show

Vserver   |  Volume |  Aggregate              | State    | Type       | Size  | Available | Usage

cmnas-01  vol0          root_cmcnas01       online RW              348.6GB 305.0GB 12%
cmnas-02  vol0          root_cmcnas02       online RW              348.6GB 299.2GB 14%

Thanks,

TT

[Ontapforrum]

Yes, those are 'root' volume for each Node, which is created when you install Ontap software on the root aggregate. This is where 'Security Audit Logs' are stored. The one I mentioned in the first response is NAS Audit logs (cifs/nfs).

 /mroot/etc/log/

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-sag%2FGUID-E593FD00-D062-4649-853A-4409E282FA12.html