I have a challenge to find out what is causing my snapshots to grow so large. I have a vserver with different tenants and its used for different type of data mostly users home directories, but i haven't a deep knowledge of what kind of data the users are writing into it. I guess its like the typical filserver with all kinds of data , execpt backups and swapfiles.
The volume is 4TB cifs only , and we are doing timebased snapshots every 2 hour in business hours.
Suddenly last fall the snapshots expanded from approx 2-3GB to 30-40GB every 2 hour and its killing my space, as i have to maintan the snapshots for 1 month. (not all the hour , but daily and weekly)
So i need to find what data is new/changed every 2 hour , and i have tried using different tools - like treesize - to search for the data but i'm unable to pinpoint the bully.
Are there any way/method to kind of track the data in the separate snapshots to at least get a hint to where the data comes from ?
Snapshot growth comes from deletions or changes. Would there have been any sort of backup file being written to the file share? It will be difficult to pin point the exact cause of the size of the snapshots, especially if there are a lot of files / folder owners in the volume.
There's a lot of things that could cause the issue, it's may not just be new files getting created and deleted, but could be a single file (even a relatively small one) which has constant churn inside of it.
I think @hariprak is on the right track, you'll need to turn on quotas...just don't put a limit in place. Then you can at least see what users are consuming the most space. Maybe setup some monitoring/reporting to track which users have the most change in their usage.
You may also want to check the CIFS sessions...look for anomolies and investigate with those users.
It may be a data deluge, but you could also enable CIFS audit logging and parse the logs looking for file operations.
If this post resolved your issue, please help others by selecting ACCEPT AS SOLUTION or adding a KUDO.