Todd,
This filer is a NearStore and it only gets SV traffic. It's easy to see what SV are running. There would only be a few different volumes with active SV running at a time. A df followed by another one 5 minutes later showed more than 100 different volumes increased their space usage. It acts like the reverse of the 7.3 upgrade where meta data for the snapshots is moved to the aggregate. This acts like the aggregate was pushing everything back to the volumes.
This is the same filer I posted about the vol options root command failing earlier in the week. We did a software update from 8.0.1 to 8.0.1P1 which is what I run on most of my NearStores. We did this because the root command worked on one of my 3140 NS with that OS. That software update should have delivered new files, so we don't expect we have any corrupt files anywhere.
Thanks,
Jeff
On Sat, Dec 17, 2011 at 10:05 AM, Bennett Todd bet@rahul.net wrote:
What with snapshots and the filesystem trickery that makes them possible, it may help to temporarily forget about the ongoing deletions and focus on the space consumption. It can be hard to identify who is writing; besides filehandles held open for long-term writing, kernels can write seemingly on their own initiative for core dumps and the like.
Sometimes it helps to ogle raw ip traffic to look for hosts sending lots of traffic to an address owned by a filer.