Data gets added after snapshot w/o my wanting it???

[n3mmr]

I come from the SunOS/Solaris world, and I'm a bit surprised at one little thing:

This is on a RaidZ2 pool of five disks, a dataset brought over by a "zfs send pool/dataset@snap|ssh ... zfs recv ..." from a Solaris machine.

I just did an incremental zfs send on that FreeNAS dataset, the source dataset had grown by a few MiB, thus creating a new snapshot.. I'm NOT aware of any activity writing to that dataset in FreeNAS, but still, after the transfer has completed, the newly created snapshot almost immediately had a few kilobytes added... and later it kept growing until the new data, over and above the transferred increment, was all of 489kib...

I used zfs receive -F on the receiving end, maybe that has some bearing on this??


What happened? Bookkeeping?

Nothing similar happens to the Solaris ZFS original, and I can't say I ever saw anything like this, and I worked in Sun's Global Labs for several years, fiddling with ZFS until my fingers bled...

 

[cyberjock]

I'm sorry but I read this 3 times and I'm not understanding you. Can you explain in more detail please?

The only part I'm really understanding is that you did a zfs send from a solaris machine to a FreeNAS machine.

 

[SweetAndLow]

I read it a couple times also and didn't understand. I figured I was just missing something. Maybe they are trying to say a snapshot got created on freenas after doing a replication that was a differential replication.

 

[n3mmr]

OK...

I have a dataset of about 1.5 TiB on a FreeNAS 9.3 machine.

I put two snapshots in all on that dataset, one about three days ago, "@transfer_prep", and a new one today. "@transfer1".

Immediately after creating @transfer1, I noticed that the "used" column in the storage->snapshots admin gui view was indicating data being added causing @transfer1 to start using disk space. Data kept being written for about 15 minutes, stopping at about 480KiB. ten minutes later, another bout of data was written, and now the "Used" column of Storage->snapshots shows 960KiB for <dataset>@transfer1.

I cannot think of anything that would write to this dataset, at least I haven't deliberately started anything. Is there some kind pf bookkeeping or some buffering that does delayed writes after the snapshot?

Still, data was being added, somebody was writing to that dataset, and I am now looking for some way to find out what process wrote that data, and what data it was.

 

[cyberjock]

I don't know what would have been written since that would depend on your configuration. But, you can watch what processes are writing with "top -m io"

 

[fracai]

You can compare two snapshots or a snapshot to the current state using the "zfs diff" command.

 

[n3mmr]

You can compare two snapshots or a snapshot to the current state using the "zfs diff" command.

So
zfs diff -FHt Tank/cifs@transfer1 Tank/cifs
should give me some info??
Showing what has happened since transfer1 was created??

That command produces no output whatsoever.

 

[fracai]

You probably don't need the H or t options, F may be useful, but not required. You also don't need to specify the dataset without a snapshot. The default when only one snapshot is specified is to compare to the current state. That may be why no output is produced. Alternatively, no output is produced because there are no differences. The difference in used space may be internal ZFS bookkeeping.

 

[Robert Trevellyan]

I cannot think of anything that would write to this dataset, at least I haven't deliberately started anything. Is there some kind pf bookkeeping or some buffering that does delayed writes after the snapshot?

Where is your System dataset stored? Is your Reporting Database stored there too? Just wild guesses...

 

[n3mmr]

NAME AVAIL USED USEDSNAP USEDDS USEDREFRESERV USEDCHILD
Tank/cifs 8.93T 1.45T 9.18M 1.45T 0 0
Tank/cifs@transfer_prep - 8.24M - - - -
Tank/cifs@transfer1 - 966K - - - -
Tank/cifs@now - 0 - - - -
Tank/cifs@auto-20150513.0100-2w - 0 - - - -

is what it looks like in the reporting tool. I created that "now" snapshot yesterday, just to experiment.

What command(s) would show some clue as to what those 966K in @transfer1 really are?

I thought
zfs diff -FHt Tank/cifs@transfer1 Tank/cifs@now
but that produces no data

(Gaaah! How do you format tables in this forum???)

 

[n3mmr]

Access time updates???

 

[n3mmr]

The extra data was access time (atime) updates. Since the data is just bluray and dvd rips (in this particular dataset, access times are of no interest.

And, since all these rips are maximally compressed anyway, I've set this dataset up to have no compression and atime=off.

as root on FreeNAS (ssh in from a more comfortable window system), do:

zsh set atime=off Tank/dataset

and edit the dataset in the management gui volume manager and set this dataset to use no compression.

and no more surprises.

I think, I might be totally wrong, maybe there's a major time bomb ticking???

 

[pirateghost]

I'm confused as to why you are complaining about KiB