Receiving AutoSupports for callhome.arw.activity.seen alerts from ONTAP cluster
Applies to
- ONTAP 9.11.1 and later
- Autonomous Ransomware Protection (ARP) or Anti_Ransomware (ARW)
Issue
- Receiving an AutoSupport-triggered alert:
HA Group Notification from NETAPP01 (volume1 (UUID: baaa57df-c736-11ea-9401-XXXXXXXXXXXX) vserver1(UUID: 5d7c5692-b755-11e6-a10f-XXXXXXXXXXXX)) ALERT
HA Group Notification (POSSIBLE RANSOMWARE ACTIVITY DETECTED) ALERT
- EMS log reports:
[Node-01: svc_queue_thread: callhome.arw.activity.seen:alert]: Call-home message for volume1 (UUID: baaa57df-c736-11ea-9401-XXXXXXXXXXXX) verver1(UUID: 5d7c5692-b755-11e6-a10f-XXXXXXXXXXXX)
[Node-01: svc_queue_thread: callhome.arw.activity.seen:alert]: Call home message for POSSIBLE RANSOMWARE ACTIVITY DETECTED, Volume: volume1 (UUID: baaa57df-c736-11ea-9401-XXXXXXXXXXXX) in Vserver: verver1 (UUID: 5d7c5692-b755-11e6-a10f-XXXXXXXXXXXX)