Operational evidence routine · thresholds come from workload objectives
Run this at a consistent time and save outputs with the cluster name and timestamp. Compare against baseline, not merely whether a command returned output.
About the command and output examples
Names, addresses and results are illustrative. Commands have not been executed against a live storage system or SAN switch for this publication. Confirm syntax and compatibility for your release, then rehearse in an approved lab. Existing-data recovery and destructive changes need an environment-specific plan. Read the editorial standards.
01Daily: health and service
- Review unresolved system health and EMS alerts, node and HA state, aggregate and volume headroom, data LIF status, SnapMirror health and lag.
- Check application tickets and any AutoSupport or monitoring alarms. Investigate new critical errors rather than clearing them to make the dashboard green.
cluster show
storage failover show
system health alert show
event log show -severity ERROR
storage aggregate show
volume show
network interface show
snapmirror show02Weekly: trends and recoverability
- Compare capacity and latency to last week. Review rapidly growing volumes, snapshots, replication lag, failed transfers, and a sample of host path health.
- Validate a recovery point by restoring a test file or isolated clone. Review firmware, ONTAP support notices, expiring certificates, and pending changes.
No unresolved priority alert, capacity trend has an owner, and the recovery test is documented.
03Escalation record
- For any incident capture exact time, client/host, SVM, volume or LUN, error, recent changes, commands and outputs, impacted users, current workaround, and next owner.
- Avoid attaching secrets, private client data, or full logs to a public site.
A second administrator can reproduce the investigation from the incident record.
04A daily record that turns readings into actions
An inventory script can report what an API or CLI returns, but it cannot prove that the application can transact or that a recovery point restores. Combine collection with a small service probe and a scheduled isolated recovery test. Compare daily output to a known baseline and document exceptions; collecting large text files without a review owner is not an operating process.
| Check | Record | Example action trigger |
|---|---|---|
| Nodes/HA/alerts | New state compared with yesterday | Unexplained takeover or loss of readiness |
| Client protocols | Representative permitted user/host test | Authentication or transaction fails |
| Capacity | Logical/physical usage and growth | Runway approaches the defined reserve/deadline |
| Protection | Usable point age, duration and errors | Actual RPO missed even when health is good |
| Events | New relevant EMS events and start time | Repeated fault correlated with a service symptom |
- Use the supplied automation inventory with a read-only account and trusted certificates/SSH host keys. Test connection failure as well as the happy path.
- Assign an owner and response deadline for each new exception. Link it to the affected workload rather than treating every alert as equal severity.
- Keep the previous successful record. A failed collection today must be shown as unknown/failed, not replaced with yesterday’s green state.
05Weekly review example: detect trend before the incident
Suppose physical free space falls by 40 GiB/day and the chosen reserve will be reached in eight days, although the current percentage is below a static alarm. The weekly review should assign a capacity action now and inspect the workload causing growth. Similarly, replication can be healthy while its recovery point is older than the application objective. Review values against the service objective rather than only green status.
Weekly review records growth/runway, restore evidence, failed collections and overdue actions with named owners.
Use the section links to revisit a step, or follow a related guide below.
Official references and further reading
Choose the matching release in the vendor documentation before using a command or design. References open on the publisher’s website; linked material remains with its publisher.