In addition to what virtek said (which is an excellent observation btw) change rate is determined by disk activity. Disk defrag, check disk fix, databases, all of this can change a single bit and thus trigger a change to the files. so along with the fact that you can't get this info, it's nearly impossible to figure out which VM is making (or could make) the most changes, since every instance is completely unique. And unless you have strict policies inside a VM via group policy I don't think you are ever going to really get an accurate collection, because users can install their software, or move things around inside the VM. The snapshots also don't correlate to the file names of your VM's either. Netapp keeps their own list of files and don't have any relevance to the real files. So this is next to impossible.
But maybe we are overlooking what the utlimate goal of what you are trying to accomplish and perhaps there may be a different way to get this information, and not use Netapp at all.
So by collecting this data, what do you hope to achieve, or what is needed by determining which VM's are changing the most. are you concerned about enough snapshot storage to make snapshots?
