snapshot file usage

[pal]

Hi Community,

I have a challenge to find out what is causing my snapshots to grow so large. I have a vserver with different tenants and its used for different type of data mostly users home directories, but i haven't a deep knowledge of what kind of data the users are writing into it. I guess its like the typical filserver with all kinds of data , execpt backups and swapfiles.

The volume is 4TB cifs only , and we are doing timebased snapshots every 2 hour in business hours.

Suddenly last fall the snapshots expanded from approx 2-3GB to 30-40GB every 2 hour and its killing my space, as i have to maintan the snapshots for 1 month. (not all the hour , but daily and weekly)

So i need to find what data is new/changed every 2 hour , and i have tried using different tools - like treesize - to search for the data but i'm unable to pinpoint the bully.

Are there any way/method to kind of  track the data in the separate snapshots to at least get a hint to where the data comes from ?

rgards

paal 

[rwelshman]

Snapshot growth comes from deletions or changes. Would there have been any sort of backup file being written to the file share? It will be difficult to pin point the exact cause of the size of the snapshots, especially if there are a lot of files / folder owners in the volume.

[pal]

Yes I know , there is a lot of files and directories on this vserver.

If it is a backup file i should have detected it in the search for the biggest files changed/created within the latest 2 hours, but there is none at the size > 5gb

¨pal

[hariprak]

Hi,

Is quota enabled for these volume? Quota on userhome?

Thanks

[pal]

Hi,

no quota enabled , its not an option , customers dont want it

¨pal

[SeanHatfield]

You could have an end user putting VMs in their home directory. These could show up as a bunch of 2gb files. 

[pal]

Yes , the clue is to find wich user 🙂

¨pal

[asulliva]

There's a lot of things that could cause the issue, it's may not just be new files getting created and deleted, but could be a single file (even a relatively small one) which has constant churn inside of it.

I think @hariprak is on the right track, you'll need to turn on quotas...just don't put a limit in place.  Then you can at least see what users are consuming the most space.  Maybe setup some monitoring/reporting to track which users have the most change in their usage.

You may also want to check the CIFS sessions...look for anomolies and investigate with those users.

It may be a data deluge, but you could also enable CIFS audit logging and parse the logs looking for file operations.

Andrew

[pal · Accepted solution]

Hi all,

I tracked the bugger 🙂 ,

actually it was Andrew the made me think about the auditing and it was the cause for this.

It was setup to save the auditlogs on the same volum , and when i looked at the folder i could see files generate constantly and deleted the next second.

So i stopped the auditing and changed the path for saving auditlogs to a new volum.

Problem solved.

I havent looked into why the audit behaved like this, but now the vfiler is migrated into cluster mode.

Thx for your inputs!

¨pal