Skip to main content

Adjust settings for automatically generated ONTAP ARP snapshots

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.11.1, you can use the CLI to control the retention settings for Autonomous Ransomware Protection (ARP) snapshots that are automatically generated in response to suspected ransomware attacks.

Note If you are running ONTAP 9.16.1 or later, see Adjust settings for automatically generated ARP/AI snapshots.
Before you begin

You can only modify ARP snapshot options on a node SVM and not on other SVM types.

Note The settings listed in this section apply to ONTAP 9.11.1 through 9.15.1. If you have upgraded to ONTAP 9.16.1 or later, use the ARP/AI snapshot settings.
Steps

  1. Show all current ARP snapshot settings:

    options -option-name arw*

  2. Show selected current ARP snapshot settings:

    options -option-name <arw_setting_name>

  3. Modify ARP snapshot settings:

    options -option-name <arw_setting_name> -option-value <arw_setting_value>

    You can modify the following settings (ONTAP 9.11.1 through 9.15.1):

    Setting Description Supported versions with ARP

    arw.snap.max.count

    Specifies the maximum number of ARP snapshots that can exist in a volume at any given time. Older copies are deleted to ensure that the total number of ARP snapshots stays within this limit.

    ONTAP 9.11.1 to 9.15.1

    arw.snap.create.interval.hours

    Specifies the interval in hours between ARP snapshots. A new ARP snapshot is created when a data entropy-based attack is suspected and the most recently created snapshot is older than the specified interval.

    ONTAP 9.11.1 to 9.15.1

    arw.snap.normal.retain.interval.hours

    Specifies the duration in hours for which an ARP snapshot is retained. When an ARP snapshot reaches the retention threshold, it is deleted.

    ONTAP 9.11.1 to 9.15.1 (deprecated in 9.17.1 and later)

    arw.snap.max.retain.interval.days

    Specifies the maximum duration in days for which an ARP snapshot can be retained. Any ARP snapshot older than this duration is deleted when there is no attack reported on the volume.

    Note The maximum retention interval is ignored if a moderate threat is detected. The ARP snapshot created in response to the threat is retained until you respond to the threat. When you mark a threat as a false positive, ONTAP deletes the ARP snapshots for the volume.

    ONTAP 9.11.1 to 9.15.1 (deprecated in 9.17.1 and later)

    arw.snap.create.interval.hours.post.max.count

    Specifies the interval in hours between ARP snapshots when the volume already contains the maximum number of ARP snapshots. When the maximum number is reached, an ARP snapshot is deleted to make room for a new copy. Use this option to reduce the creation speed to retain older copies.

    ONTAP 9.11.1 to 9.15.1 (deprecated in 9.17.1 and later)

    arw.snap.new.extns.interval.hours

    Specifies the interval in hours between ARP snapshots created when a new file extension is detected. A new ARP snapshot is created when a new file extension is observed and the previous such snapshot is older than the specified interval. This option exists independently of arw.snap.create.interval.hours, which specifies the interval for entropy-based snapshots.

    ONTAP 9.11.1 to 9.15.1 (deprecated in 9.17.1 and later)

    arw.snap.surge.interval.days

    Specifies the interval in days between ARP snapshots created in response to IO surges. This option also specifies the retention period in days for an ARP surge snapshot.

    ONTAP 9.11.1 to 9.15.1
Related information