Hello,
Just for a little light reading material - I bookmarked the following a few months back to help me keep track of the various domains:
https://kb.netapp.com/support/s/article/ka21A0000000fzcQAA/faq-cpu-utilization-in-data-ontap-scheduling-and-monitoring?language=en_US
That said, I vaguely recall us working a case a long time ago (7mode - 8.0.x) where we had an nSanity gather going against an Exchange host and our filers. Anyway, with 8.0, Kahuna would manifest itself on a single core which would skew our ANY statistic. What I remember is that during the nSanity gather (and during a subsequent perfstat gather) we'd see that Kahuna-owned core spike in relation to whatever performance gather we had going on. I don't know how that behavior translates into ONTAP, but it makes me suspect that monitoring gets reflected more in the Kahuna/wafl_ex domains vs. the HostOS.
We have a relatively quiet 8.3 cluster that we're in the process of decommissioning. If I have time I'll fire up a perfstat against it and see what domain is getting the business.
Regards,
Chris