Find VM’s contributed most part of snapshots taken on a NFS datastore

[vwmagic]

We are taking daily snapshots on a few NFS Datastore, and found very large size of snapshots are produced In daily basis

I don't have the access to these VM's (Windows), is there any way to find out what VM's and what Virtual disks or their change rates caused these snapshots?  If powercli script would be the solution, do you have one? Thanks!

[scott28tt]

Daily snapshots at the VM level, or at the storage level?

VM snapshots are not backups, and you risk the chance of the snapshot chain breaking - just had to say that.

How do you know there are large snapshots but NOT know which VMs they relate to, given that the VM name is part of the filename?

[vwmagic]

Snapshots were at the storage datastore level. There are approximately 30 VM’s in it. Some may have high change rates and produced large snapshot delta. We wanted to identify what these VM’s are if we don’t know what they are doing.

[continuum]

Go to the NFS=datastore with WinSCP.

Then watch out for the large delta or sesparse vmdks.

Those files use the name of the VM as first part of the name - so you can easily check to which VM they actually belong.

If you find a file named Pluto-000003-sesparse.vmdk with a size of 300gb and a recent timestamp you can then deduce that the dwarf-planet VM Pluto has at least one snapshot with a size of 300gb ...

[vwmagic]

Your solution provided here seems addressing snapshots taken at VM. My question is about snapshots at Storage Datastore which only reflect any type of changes made at VM level, these changes could be made to regular data on disk drives, or anything else. My understanding "...sesparse.vmdk" is the result of snapshoting at VM.

Hopefully, it makes sense to you. Thanks!

[scott28tt]

vSphere can tell you disk writes at the VM level, otherwise you would need to interrogate each guest OS.

[vwmagic]

Disk writes would not make snapshots larger, the changed or deleted blocks would.

That reminds me of CBT. With CBT enabled, will that result in any type of logs which contains only changed or deleted data? If yes, where can I find and measure the size ?

thanks!

[daphnissov]

A disk write *is* a change and will absolutely be captured in a VM snapshot. Other than write profiling each VM like Scott has suggested, the only other way would be to suspend your NAS snapshots and individually snapshot the VMs at the same time and observe the change rates over a given period.

[vwmagic]

Again, the question here is NOT about snapshots at VM level, but snapshots at Storage Datastore, and produced very large size snapshots contained in the datastore. Different storage vendor takes care of snapshotting differently, writing doesn't contribute snapshot space, this is how NetApp snapshotting works.

CBT should be able to tell us how much changes being made, if we know where these changes are located, we can then measure the size of them?

[sjesse]

If your referring to snapshots on the storage level, VMware isn't going to know about the snapshots, like a guest os in a vm can't know about VMware snapshots. CBT tracking is done in VMware in a file to track the difference, but that file is in the same nfs share as all the files so it would have no clue. There would have to be some sort of interface into the storage product that could see the snapshots, The closest NetApp equivalent is snapdiff, but that's used by backup vendors from my own research

What SnapDiff is

[vwmagic]

Yes, you got what I am asking for. As you said, VMware doesn't know snapshots on the storage level, and I am not seeking for that. I just wanted to know if VMware knows how much data changes being made on the VM, that is all I am asking for? as you said, It not directly related to Snapshots on the storage.

[daphnissov]

No, CBT can't be used in this way. CBT is meant to be used in tandem with virtual machine snapshots, not a higher-level abstraction.

[vwmagic]

Thanks!

Is there anyway on VMware to figure out how much data being changed on this VM in daily basisi?

[daphnissov]

Please don't use the term "VMware" when referring to a product. VMware is the name of a company. The product here is ESXi or, for the suite including ESXi and vCenter, it's vSphere.

As I said above, you have essentially two options:

1. Use some type of block profiling tool inside the guest (I don't know of any) that can track and report block size changes.
2. Temporarily snapshot each VM and observe the growth of the deltas over a 24 hour period. The deltas contain the changed blocks and will reveal which VM(s) is/are changing the most.

[vwmagic]

Yeah, I heard you about option 2. However, taking snapshots on VM would cost extra storage space, and also there are quite some VM's involved and required the other group involved...