Todd C. Merrill" tmerrill@mathworks.com asked:

Is there a way to log snapshot events?

I.e.:

Sun Apr 22 02:29:13 EDT [consumer]: Disk scrubbing finished... Sun Apr 22 08:30:46 EDT [snapevent]: Snapshot test created on vol vol0 by user luser from machinename Sun Apr 22 08:31:46 EDT [snapevent]: Snapshot test renamed to test2 on vol vol0 by user luser from machinename Sun Apr 22 08:32:46 EDT [snapevent]: Snapshot test2 deleted on vol vol0 by user luser from machinename Sun Apr 22 08:33:46 EDT [snapevent]: Snapshot test3 created on vol vol0 by user luser from console [...] Mon Apr 23 00:00:02 EDT [snapevent]: Snapshot nightly.0 rolled on vol vol0 by user root from scheduler [...]

Etc?

Sometimes, as today, I find snapshots that should be there aren't, and it takes a while to find out how they disappeared. Sometimes, I never do find out how they gave up their mortal bits.

and fpsfrance@fps.fr (FPS France) replied

May be you could do something like : > tail -f /mnt/nac/etc/message | grep snap > my_snap_log when your Filer is mounted on the /mnt/nac dir of a Unix machine / You will have also to make a script to tail the new /etc/message file as this file change on the Filer.

As there aren't any messages about snapshots in /etc/messages (with default syslog.conf, anyway), how would this help?

If you have auditlog.enable turned on (the default) in ONTAP 6.x, then then you'll be able to track the explicit creations and deletions of snapshots via /etc/log/auditlog*, but this won't help for the changes made by the snapshot schedule.

Chris Thompson University of Cambridge Computing Service, Email: cet1@ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QG, Phone: +44 1223 334715 United Kingdom.