How can you tell if a zpool is encrypted

[Alan W. Smtih]

I'm in the process of replacing a hard drive on my FreeNAS-9.10.2-U5 system. There's a note at the beginning of Replacing a Failed Drive that says:

> If your pool is encrypted with GELI, refer to Replacing an Encrypted Drive before proceeding.

The first line in that section is:

> If the ZFS pool is encrypted, additional steps are needed when replacing a failed drive.

While I'm 99% certain my zpool isn't encrypted, I'd like to verify that before I start issuing commands.

How can I tell if a zpool is encrypted (or verify it's not)?

 

[m0nkey_]

You would have encrypted the pool at the time of creation. You cannot encrypt a pool after the fact.

To check however, you can run zpool status <poolname>. If you see something along the lines of gptid/<some-long-guid>.eli. The .eli is a good sign the pool is encrypted.

Edit: Just to note that swap is always encrypted, regardless of the fact you encrypted your pool or not.

 

[Alan W. Smtih]

Cool. Looks like I'm in good shape.

Code:

mingus% zpool status z
  pool: z
 state: ONLINE
  scan: resilvered 3.10T in 162h59m with 0 errors on Sun Jul  9 17:56:11 2017
config:

  NAME											STATE	 READ WRITE CKSUM
  z											   ONLINE	   0	 0	 0
	raidz3-0									  ONLINE	   0	 0	 0
	  gptid/c6171db6-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/c68a4186-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/c701c120-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/c779c670-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/0d977d05-569b-11e7-8777-d05099264f68  ONLINE	   0	 0	 0
	  gptid/c8688176-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/c8e2f1e9-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/c9cc35d5-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/ca449ed0-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/cabb7d11-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0
	  gptid/cb39f216-4668-11e4-b49f-d05099264f68  ONLINE	   0	 0	 0

errors: No known data errors

And to make sure I understand, if it was encrypted I'd see this instead, right?

Code:

mingus% zpool status z
  pool: z
 state: ONLINE
  scan: resilvered 3.10T in 162h59m with 0 errors on Sun Jul  9 17:56:11 2017
config:

  NAME												STATE	 READ WRITE CKSUM
  z												   ONLINE	   0	 0	 0
	raidz3-0										  ONLINE	   0	 0	 0
	  gptid/c6171db6-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/c68a4186-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/c701c120-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/c779c670-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/0d977d05-569b-11e7-8777-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/c8688176-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/c8e2f1e9-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/c9cc35d5-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/ca449ed0-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/cabb7d11-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0
	  gptid/cb39f216-4668-11e4-b49f-d05099264f68.eli  ONLINE	   0	 0	 0

errors: No known data errors