It looks like Tim and Alexander also gave you a few good suggestions which are both good places to look.
What protocol does the filer serve as we may be able to get an idea where the writes are coming from with per client stats.
For NFS
Set options nfs.per_client_stats.enable on
First zero counters ssh ntap1 vfiler run vfiler0 nfsstat -z
then list the per client stats and repeat a few minutes later to see what client is sending all the nfs writes. ssh ntap1 vfiler run vfiler0 nfsstat -l
for CIFS
set options cifs.per_client_stats.enable on
cifs top -n 20
--JMS
From: toasters-bounces@teaparty.net [mailto:toasters-bounces@teaparty.net] On Behalf Of Fletcher Cocquyt Sent: Wednesday, April 02, 2014 12:24 PM To: toasters@teaparty.net Lists Subject: Determining what's contributing to fast aggregate growth
Hi all,
In the last 36 hours or so we have a 19Tb aggregate that is growing above 18Tb used. Usually the aggregate used level only grows if we grow its volumes. This is different - I was forced to delete snapshots and shrink volumes to get it back under 90%. And in the last 3 hours its back above 91% - used level is climbing 5-10g/minute
I so far can not see where the growth is coming from, Aggr snapshot is OFF
Ontap 8.1.2
na02> aggr status Aggr State Status Options aggr0 online raid_dp, aggr root, nosnap=on, raidsize=19 64-bit
thanks for any tips!