Snapshots Unexpectedly Deleted Despite Configured Retention Policy
Applies to
- ONTAP 9.16.1P10
- Ontap Snapshot
Issue
- Snapshot copies that are configured for retention through a Snapshot policy may be unexpectedly deleted from a volume.
- Older Snapshot copies can disappear even though:
- The Snapshot policy is configured to retain multiple weekly or monthly copies.
- Snapshot autodelete is disabled.
- No recent Snapshot policy or volume configuration changes were made.
- No SnapMirror or SnapVault activity explains the deletion.
- No user-initiated deletion is visible in the available audit logs.
- No relevant traces or events were found in the EMS or MGWD logs during the time period when the Snapshot copies were deleted.
- However RAS Traces confirms the snapshots were deleted via WAFL snapshot delete operations with a snapflags 0x20:
TRACE #3131 20260614_08:28:50 UTC 329594.454.111 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_3: SNAP DELETE: Pending mask & Snapdir updated. Type: Generic fsid: 314812700, snapid: 1026, snapflags: 0x0, owner: 0, mode(zlog:1/dbya:2/dbys:3): 0 TRACE #3132 20260614_08:28:50 UTC 329594.454.112 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_NAME: SNAP DELETE: Initiated. snapname: monthly.2026-04-01_0020 TRACE #3133 20260614_08:28:50 UTC 329594.454.169 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_4: SNAP DELETE: Completed WAFL_SNAP_DELETE msg. Type: Generic , timestamp: 314812700, fsid: 1026, snapflags: 0x20, snapid: 462 TRACE #3137 20260614_08:36:17 UTC 330042.128.841 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_3: SNAP DELETE: Pending mask & Snapdir updated. Type: Generic fsid: 315239429, snapid: 1026, snapflags: 0x0, owner: 0, mode(zlog:1/dbya:2/dbys:3): 0 TRACE #3138 20260614_08:36:17 UTC 330042.128.841 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_NAME: SNAP DELETE: Initiated. snapname: monthly.2026-03-01_0020 TRACE #3139 20260614_08:36:17 UTC 330042.128.899 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_4: SNAP DELETE: Completed WAFL_SNAP_DELETE msg. Type: Generic , timestamp: 315239429, fsid: 1026, snapflags: 0x20, snapid: 239 TRACE #3143 20260614_08:38:51 UTC 330196.372.311 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_3: SNAP DELETE: Pending mask & Snapdir updated. Type: Generic fsid: 315386401, snapid: 1026, snapflags: 0x0, owner: 0, mode(zlog:1/dbya:2/dbys:3): 0 TRACE #3144 20260614_08:38:51 UTC 330196.372.311 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_NAME: SNAP DELETE: Initiated. snapname: monthly.2026-02-01_0020 TRACE #3145 20260614_08:38:51 UTC 330196.372.365 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_4: SNAP DELETE: Completed WAFL_SNAP_DELETE msg. Type: Generic , timestamp: 315386401, fsid: 1026, snapflags: 0x20, snapid: 37 TRACE #3149 20260614_08:44:01 UTC 330506.299.365 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_3: SNAP DELETE: Pending mask & Snapdir updated. Type: Generic fsid: 315681778, snapid: 1026, snapflags: 0x0, owner: 0, mode(zlog:1/dbya:2/dbys:3): 0 TRACE #3150 20260614_08:44:01 UTC 330506.299.365 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_NAME: SNAP DELETE: Initiated. snapname: monthly.2026-01-01_0020 TRACE #3151 20260614_08:44:01 UTC 330506.299.414 clock_sec RAS_CAT:INFO RTT_COUNT:0 SNAP_RTT_DELETE_OP_4: SNAP DELETE: Completed WAFL_SNAP_DELETE msg. Type: Generic , timestamp: 315681778, fsid: 1026, snapflags: 0x20, snapid: 836
