It looks like Tim and Alexander also gave you a few good suggestions which are both good places to look.

What protocol does the filer serve as we may be able to get an idea where the writes are coming from with per client stats.

For NFS

Set

options nfs.per_client_stats.enable  on

First zero counters

ssh ntap1 vfiler run vfiler0 nfsstat –z

then list the per client stats and repeat a few minutes later to see what client is sending all the nfs writes.

ssh ntap1 vfiler run vfiler0 nfsstat -l

for CIFS

set

options cifs.per_client_stats.enable on

cifs top -n 20

--JMS

From: toasters-bounces@teaparty.net [mailto:toasters-bounces@teaparty.net] On Behalf Of Fletcher Cocquyt
Sent: Wednesday, April 02, 2014 12:24 PM
To: <toasters@teaparty.net> Lists
Subject: Determining what's contributing to fast aggregate growth

Hi all,

In the last 36 hours or so we have a 19Tb aggregate that is growing above 18Tb used.

Usually the aggregate used level only grows if we grow its volumes.

This is different - I was forced to delete snapshots and shrink volumes to get it back under 90%.

And in the last 3 hours its back above 91% - used level is climbing 5-10g/minute

I so far can not see where the growth is coming from,

Aggr snapshot is OFF

Ontap 8.1.2 

na02> aggr status

           Aggr State           Status            Options

          aggr0 online          raid_dp, aggr     root, nosnap=on, raidsize=19

                                64-bit        

thanks for any tips!