Skip to main content
NetApp Knowledge Base

How ARP creates Snapshots

  1. Last updated
  2. Save as PDF
Views:
2,097
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
core
Last Updated:

Applies to

Answer

Options default value:
  • arw.snap.create.interval.hours = 4 hours
  • arw.snap.new.extns.interval.hours = 48 hours (Beginning with ONTAP 9.13)
A snapshot for new-extension is created if all conditions below are true:
  1. The last high-entropy snapshot is more than 1 hour old.
  2. The last new-extension snapshot is more than 4 hours old. 
  3. The last new-extension snapshot is more than 48 hours old. (Beginning with ONTAP 9.13)
  4. The command output below is true
    security anti-ransomware volume attack-detection-parameters show -vserver <vserver_name> -volume <volume_name> -fields based-on-never-seen-before-file-extension 
Scenario-1: Only high-entropy data. No new file extension.
  • T: Snapshot created due to high-entropy data.
  • T + 4 hour: Snapshot created due to high-entropy data.
  • T + 8 hour: Snapshot created due to high-entropy data.
  • T + 12 hour: Snapshot created due to high-entropy data.
  • …
Scenario-2: High-entropy data and new file extensions. 

Note: The further description refers to reasons a and b above.

  • ONTAP 9.10, 9.11, 9.12:
    • T: Snapshot created due to high-entropy data.
    • T + 20 mins: A new file extension .abcd observed. Snapshot not created for reason a.
    • T +  1 hour 30 mins: A new file extension .efgh observed. Snapshot created. (The next snapshot for new-extension will not be created until 4 hours from this point)
    • T + 2 hours: A new file extension .mnop observed. Snapshot not created for reason b.
    • T + 4 hours: Snapshot created due to high-entropy data.
    • T + 5 hours: A new file extension .qrst observed. Snapshot created  (The next snapshot for new-extension will not be created until 4 hours from this point)
    • T + 8 hours: Snapshot created due to high-entropy data.
    • …
  • ONTAP 9.13 or later:
    • T: Snapshot created due to high-entropy data.
    • T + 20 mins: A new file extension .abcd observed. Snapshot not created for reason a.
    • T + 1 hour 30 mins: A new file extension .efgh observed. Snapshot created. (The next snapshot for new-extension will not be created until 48 hours from this point)
    • T + 2 hours: A new file extension .mnop observed. Snapshot not created for reason c.
    • T + 4 hours: Snapshot created due to high-entropy data.
    • T + 5 hours: A new file extension .qrst observed. Snapshot not created for reason c.
    • T + 8 hours: Snapshot created due to high-entropy data.
    • …
    • T + 48 hours: Snapshot created due to high-entropy data.
    • T + 48 hours + 20 mins: A new file extension .uvwx observed. Snapshot not created for reasons a & c.
    • T + 48 hours + 30 mins: A new file extension .wxyz observed. Snapshot created. (The next snapshot for new-extension will not be created until 48 hours from this point)

Additional Information

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.