High “Other IOPS” on NFS Volume Due to Qualys Scan

• ONTAP 9
• Version 9.15.1P14 and later
• NFS

• A sudden and sustained spike in "Other IOPS" was observed on an ONTAP NFS volume, resulting in:
  • CPU utilization of Node exceeding 80%.
  • Noticeable slowness in application response times.
  • Increased NFS Metadata Operations, including high GETATTR calls and smaller numbers of LOOKUP and ACCESS operations, originating from multiple client IPs.
• Noticed top clients contributing to the load showed local-only operations (Remote-Reqs = 0).
• vserver nfs connected-clients show helps in identifying the top clients.

cluster-1::*> nfs connected-clients show
Node: node1
  Vserver: vs1
  Data-Ip: xxx.xxx.xxx.xxx
                                                         Local Remote
Client-Ip       Protocol Volume    Policy   Idle-Time    Reqs  Reqs   Trunking
--------------- -------- --------- -------- ------------ ----- ------ --------
xxx.xxx.xxx.xxx nfs4.1   root_vol  pol1     6s           9     0      false
xxx.xxx.xxx.xxx nfs3     vol1      pol1     56s          7     0      false
xxx.xxx.xxx.xxx nfs4.1   vol1      pol1     6s           7     0      false
3 entries were displayed.