Now at this time I had only place left where I can recover the data, aggregate level snapshots; so I looked at aggregate snapshots and saw it goes back to time when he had data in place. Knowing that the data deleted from volume is still locked in aggregate’s snapshot I was feeling good that I have done a good job by having some space reserved for aggregate level snapshot, which no one ever advocated.
Now the next step is to recover the data, but problem was that if I revert aggregate using “snap restore –A” then all the volumes in that aggregate will be reverted which will be bigger problem. So had to go on a different way, use aggregate copy function to copy the aggregate’s snapshot to an empty aggregate and then restore the data from there.
Here’s the cookbook for this.
- The volume you lost data from is a flexible volume
- Identify an aggregate which is empty so it can be used for destination (could be on another controller also)
- Make sure the destination aggregate is either equal or larger than source aggregate
- /etc/hosts.equiv has entry for the filer you want to copy data to and /etc/hosts has its IP address added, in case of copying on same controller loopback address (127.0.0.1) should be added in /etc/hosts file and local filername should be in hosts.equiv file
- Name of aggregate’s snapshot which you want to copy
Let’s say the volume we lost data was ‘vol1’, the aggregate which has this volume is ‘aggr_source’, the aggregate’s snapshot which has lost data is ‘hourly.1’ and empty aggregate where we will be storing data to is ‘aggr_destination’
- Restrict the destination aggregate using ‘aggr restrict aggr_destination’
- Start the aggregate data copy using ‘aggr copy start –s hourly.1 aggr_source aggr_destination’
- Once the copy is completed online the aggregate using ‘aggr online aggr_destination’
- If you have done copy on same controller, system will rename the volume ‘vol1’ of ‘aggr_destination’ to ‘vol1(1)’
- Now export the volume or lun and you have your all lost data available.