sevans@foundation.sdsu.edu (Steve Evans) writes:

Look at this screen shot. It's of a users folders snapshot directory. http://planetevans.com/netapp/snapshot.jpg

You can see that all the snapshots after nightly.3 are regular files. When I double click on them they want me to choose a program to open it with.

This is of the directory \filer\finance\llevinson~snapshot

If I go through \filer\finance~snapshot<snapshot>\llevinson I can access everything just fine.

Also several days ago (the day that lines up with the bad snapshots) everything from \filer\finance\llevinson (the live data) disappeared and we had to pull it from the last snapshot (hourly.0 which was good)

I am more used to using NFS, but this doesn't seem suprising to me. If \filer\finance\llevinson was deleted and recreated, then it is no longer the "same" directory as it was before, and following .snapshot from it will find only subsequent snapshots. The earlier ones have dummy entries which do indeed look like regular files, e.g.:

$ ls -al /home/auser/.snapshot total 40 drwxrwxrwx 19 root root 4096 May 2 16:00 . drwxr-xr-x 3 auser auser 4096 May 2 02:30 .. drwxr-xr-x 2 auser auser 4096 May 2 02:30 hourly.0 drwxr-xr-x 2 auser auser 4096 May 2 02:30 hourly.1 drwxr-xr-x 2 auser auser 4096 May 2 02:30 hourly.2 ---------- 1 root root 0 Mar 26 1999 hourly.3 ---------- 1 root root 0 Mar 26 1999 hourly.4 ---------- 1 root root 0 Mar 26 1999 hourly.5 ---------- 1 root root 0 Mar 26 1999 hourly.6 ---------- 1 root root 0 Mar 26 1999 hourly.7 [etc.]

I think the time stamp on the dummy entries is the time the volume was created. I've never been very clear why ONTAP has to put them in rather than just showing fewer entries in .snapshot.

Chris Thompson Email: cet1@cam.ac.uk

In message D73EA71EBBEE3E4AB1BDC50F0B85512411F7D7@email.foundation.sdsu.edu y +ou wrote:

Look at this screen shot. It's of a users folders snapshot directory. http://planetevans.com/netapp/snapshot.jpg

Startling, that -- the first time you see it.

You can see that all the snapshots after nightly.3 are regular files. When I double click on them they want me to choose a program to open it with.

If you switch to "detailed list view" (is it still called that?) then I'm guessing that nightly.{3-11} and your weekly* will show a size of zero bytes. If that is indeed the case, it indicates that your current directory didn't exist at the time of those earlier snapshots.

This is of the directory \filer\finance\llevinson~snapshot

Right.

If I go through \filer\finance~snapshot<snapshot>\llevinson I can access everything just fine.

Also several days ago (the day that lines up with the bad snapshots) everything from \filer\finance\llevinson (the live data) disappeared

Aha! OK, now I'd be willing to bet that my conjecture above was right.

and we had to pull it from the last snapshot (hourly.0 which was good)

I'm working with NetApp right now. Originally I had 6.1.3R2 and they said there were several CIFS issues with that version of ONTAP, so I upgraded to 6.3.1R1. Unfortunately (or fortunately) it only happens once a month or less. Has anyone seen anything like this before?

Your symptoms match the following scenario:

1. Some process (an errant user, a virus, a rogue script, whatever) did the equivalent of "rm -rf \filer\finance\llevinson" a few days ago... and it does this about once a month.

2. When you snaprestore (or copy?) files out of a snapshot (hourly.0 in your case), you create a NEW directory. The filer knows that this is a new directory, so it knows the directory didn't exist in snapshots older than, uh, nightly.2 -- it thus gives you bogus directory entries for nightly.3 and older.

However, when you go to \filer\finance~snapshot\ and look at hourly.0 vs nightly.3, you are looking at DIFFERENT DIRECTORIES -- i.e., nightly.{3-11} contain snapshots of the OLD directory whereas hourly.0-nightly.2 contain snapshots of your NEW directory.

That's why \filer\finance~snapshot\nightly.3\llevinson exists (i.e., it points to the old directory) whereas when you look at \filer\finance\llevinson~snapshot you're looking at snapshots ONLY of the new directory -- thus nightly.3 is a zero-length "dummy" file.

That's my guess as to what's happening here.

Works for netapp, not a spokesperson for netapp. ==== Collin Park Not a statement of my employer. Network Appliance 408-822-6878 3.1.039