Managing SnapVault log files

Regulatory compliance of SnapVault log files

SnapVault creates log files that meet the following requirements for regulatory compliance:

The contents of log files cannot be overwritten or deleted, nor can the log file itself be deleted.
The log files must accurately record the exact series of events that occur during a timeframe.

How SnapVault maintains compliance

SnapVault uses a SnapLock volume in which the log files are kept. This volume, called a LockVault^TM log volume, is a standard WORM volume. SnapVault uses an append-only write to write to the log files. This allows accurate record keeping but does not allow previous events to be overwritten.

SnapVault uses two types of log files to record events: SnapVault operations log files and SnapVault files transferred log files.

Configuring the LockVault log volume

The LockVault log volume must be created and configured before you begin an initial (level 0) SnapVault transfer. A LockVault log volume must be a SnapLock volume. The SnapLock volume can be a traditional volume or a flexible volume and is created using the vol -L or aggr -L command followed by a vol create command, respectively. See the SnapLock section of the Storage Management Guide for information about creating SnapLock volumes. All SnapVault log entries will be created in this log volume. This is a system-wide option; therefore, a SnapVault operation on any SnapLock volume on the system is logged to this volume.

Note
You need to set this option for SnapVault transfers to SnapLock volumes to succeed.

To configure the log volume, complete the following step on the SnapVault secondary system:

Step	Action
1	Enter the following command: options snapvault.lockvault_log_volume volume_name volume_name is a SnapLock volume. Note You must use the name of a previously created SnapLock volume for this command to succeed and this volume should not be used for any other purpose.

Where log files are kept

All SnapVault log files are kept in the /etc/log directory of the LockVault log volume that you created and configured. Log files in this directory inherit the default retention period of the log volume. Log files cannot be deleted from the volume until their retention periods have expired. SnapVault does not remove expired log files automatically; therefore, you will have to delete them.

Caution
Ensure that you set the default retention period on the log volume appropriately. The initial default retention period is 30 years for SnapLock Compliance volumes.

Operations log files

The following is the format for an operations log file name:

snapvault.yyyymmdd_zzz

yyyy is the year

mm is the month (01 to 12)

dd is the date (01 to 31)

zzz is the current time zone setting

The timestamp denotes when the log file is created and is generated using the compliance clock.

Operations log files have a weekly rotation policy; SnapVault creates a new log file every Sunday morning at midnight and is based on the compliance clock. Any SnapVault operations that are active when the new log file is created are recorded in the new log file.

Files transferred log files

SnapVault creates a new files transferred log file at the beginning of each SnapVault transfer. Files transferred log files are kept in the following directory structure in the LockVault log volume:

/etc/logs/snapvault secondary vol/secondary qtree name/month/log file

The snapvault secondary vol directories are the SnapLock volume names on the secondary storage system. The following is the format of the directory name:

secondary volume name_volume id

The volume UUID globally uniquely identifies a volume.

The secondary qtree name directories are the qtrees within a snapvault secondary vol directory. The following is the format of the secondary qtree directory name:

secondary qtree name_treeid_inodenum_gennum

The tree ID, inode number, and generation number uniquely identify the qtrees within a volume.

The month directory denotes the month in which log files for a qtree were generated. The format for the month directory is as follows:

yyyymm

The year (yyyy) and month (mm) are generated using the compliance clock.

The log file name uniquely identifies each transfer log file. The following is the format of the transfer log file name:

snapvault_filelog.yyyymmdd_hhmmss_zzz

The year (yyyy), month (mm), day (dd), hour (hh), minute (mm), second (ss) and time zone (zzz) are generated using the compliance clock.

Example

The following is a sample path for a transfer log file named snapvault_filelog.20040123_000500_PST:

/etc/log/vault_ ed0ad520-5f40-11d8-91ca-00a09800dcba/users_ 
19_1435628_1286197/200401/snapvault_filelog.20040123_000500_PST

Files transferred log file contents

A transfer log contains a header that describes the transfer and zero or more entries that describe the contents of the transfer. A log file contains only a header and zero entries in two instances: When no data on the primary had changed since the last SnapVault update, or for a rollback transfer.

Header format

The header at the beginning of each log file contains the following information:

Transfer type
Source system and source path
Destination system and destination path
Date and time of the start of the transfer
Date and time of the source system Snapshot copy
Note
Date and time of the source system Snapshot copy is interpreted according to the time zone settings on the secondary system, not the primary system.

Example

The following is an example of a header log record:

# Transfer type: Base Start

# From: sourcesystem:/vol/compat_data/myqtree1

# To: destinationsystem:/vol/logs/mult1

# Start time: Tue Mar 30 22:43:09 GMT 2004

# Source snapshot timestamp: Wed Mar 31 23:41:01 EST 2004

Types of log entries

The following types of log entries are recorded in transfer log files:

Create file (regular, special, or stream)
Delete file (regular, special, or stream)
Create directory
Delete directory
Rename from (regular file or directory)
Rename to (regular file or directory)
Modify file (regular, special, or stream file, but not directory)
Modify attributes (regular, special, or stream file, or directory)

Log entry format

Log entries have the following format:

date_and_time action_taken base_path_length:stream_name_length path_name

date_and_time is the mtime or ctime value from the primary storage system, not the secondary storage system.

Note
The mtime value is used for Create file and directory types, Delete file and directory types, and Modify File type because these entry types modify data. The ctime value is used for Rename file and directory types and Modify Attribute types because these types modify the container for the data, not the data itself.

action_taken is one of the types of log entries.

base_path_length:stream_name_length is the length of the base path followed by a colon and the stream name in single byte characters. Only the base path length is shown if the file is not a stream file.

path_name is the file path relative to the base of the tree that is mirrored, not the absolute path name. The relative path name is the same on the primary and secondary storage systems.

Example

The following are examples of log entries:

Fri Mar 26 23:08:33 GMT 2004 Create Dir    7   ./mydir

Mon Oct  9 17:36:14 GMT 2000 Create File  14   ./mydir/myfile

Mon Jun 12 22:21:11 GMT 2000 Create File  14:8 ./mydir/myfile:strm

What actions create log entries

The following table lists actions that cause SnapVault to create a log entry, the type of log entry created, and possibly a note about the action.

Action	Entry type	Note
The initial transfer of all files and directories.	Create File Create Directory
The data in a file was modified.	Modify File	A Modify Attributes entry is not created if a Modify File entry was.
The attributes of a directory, such as permissions, were changed or any entries in the directory were added or deleted.	Modify Attributes (directory)
An access control list (ACL) for a file or directory was created, deleted, or changed.	Modify Attributes (any file or directory associated with the ACL)	Creation, deletion, or modification of ACLs are not explicitly logged.
A file or directory with only one link was renamed.	Rename From Rename To	Renaming creates two entries that appear together in the log.
A file was renamed.	Modify Attributes or Modify File in addition to Rename From and Rename To	A Modify Attributes entry is created if no data was modified. A Modify file entry is created if data was modified.
A directory was renamed.	Modify Attributes in addition to Rename From and Rename To
A hard link was added to an existing file.	Create File
A hard link to a file was removed and the file still has one or more hard links.	Delete File
A hard link was added to a file, but no content was changed.	Modify Attributes for all links to the file except the new link
A hard link was added to a file and content was changed.	Modify File for all links to the file except the new link
A hard link was deleted from a file, but no content was changed.	Modify Attributes for all links to the file except the deleted link
A hard link was deleted from a file and content was changed.	Modify File for all links to the file except the deleted link
A file with one or more hard links to it was created between the previous transfer and the current transfer.	Create File	No Modify File or Modify Attributes entry for the file
A file and all its hard links were deleted between the previous transfer and the current transfer.	Delete File	No Modify File or Modify Attributes entry for any links
A file with multiple hard links was renamed.	Create File Delete File Modify Attributes or Modify File	A file with hard links is renamed by adding one link to the file and deleting one link from the file.
Data or attributes of a file were modified.	Modify File or Modify Attributes respectively	A Modify File or Modify Attributes entry is created for each link to the file except links that were added or deleted by the transfer.