I'm working on retiring a failing NetApp cluster. It offers iCSCI, NFS, and CIFS volumes to the network. For CIFS, we're fairly under control there. It's a limited set of shares, and there's recent "last modified" filestamps in only a couple of locations.

However, how can I be sure that nothing else is using the storage - alternatively, how can I find what else is attached to it?

For iSCSI, the only initiators are our ESX farm, which no longer has any client disks on this device - there were some datastores and RDMs that have been migrated or turned off. But that does leave the possibility of something still using NFS from within a client.

Any thoughts?

  • 2
    Mirror the switch ports it's connected to and perform packet captures? – EEAA Jun 16 '15 at 18:34
  • Certainly an option – mfinni Jun 16 '15 at 18:47

What does 'sysstat -x' say, if that's essentially zero across the board (I'd try it a few times over a few minutes) then it's clear.

  • 1
    Yeah - there's still traffic, we haven't completed removing everything we know about entirely, yet. I suppose that will be the last step before pulling the LAN cables. – mfinni Jun 16 '15 at 21:23

To check iSCSI, use iscsi initiator show and iscsi session show. If you see anything, figure out what it belongs to and remove its access.

To check CIFS, rather than timestamps, you'd want to use the command cifs sessions.

To check NFS, if it's v3 and you don't have sessions, you could use nfsstat to check stats- that allows you to zero your stats and check which hosts are using NFS, if at all.

  • cifs sessions unfortunately only shows things open now - doesn't tell me what was in use a moment ago. Thus, timestamps at least tell me the last time something was modified; and CIFS auditing would tell me the last time something was even read. – mfinni Jun 16 '15 at 21:22
  • The iSCSI and NFS info is very helpful - thank you! – mfinni Jun 16 '15 at 21:22
  • yeah, cifs auditing is another option. I thought that as long as nothing had active connections to the data, you'd be fine to decom it. If you're worried about something waking up and needing access, then there's not a whole lot you can do- the longer you watch, the less of these things you'll miss, but you can't definitively say that there's nothing. – Basil Jun 17 '15 at 19:06
  • Exactly. And with CIFS, I'm less worried because if a user complains about losing access to data, as long as I have a copy on another server, I can share that out to them and now I know who was affected. That's why I said that for CIFS, we're feeling pretty good. – mfinni Jun 17 '15 at 20:18
  • Just in case, maybe do a final backup before dumping all the data :) – Basil Jun 17 '15 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.