By erickustarz on Oct 16, 2006
ZFS - now with history!
When disaster strikes and you'd really like to know what people have been doing to your pool, what do you do? Until now, there was nothing elegant. Enter 'zpool history'.
# zpool create hewitt c1d0 # zfs create hewitt/jen # zfs create hewitt/jen/love # zpool history History for 'hewitt': 2006-10-16.17:54:02 zpool create hewitt c1d0 2006-10-16.17:54:11 zfs create hewitt/jen 2006-10-16.17:54:15 zfs create hewitt/jen/love #
All subcommands of zfs(1M) and zpool(1M) that modify the state of the pool get logged persistently to disk. That means no matter where you take your pool or what machine is currently accessing it (such as in the SunCluster failover case), your history follows. Sorta like your permanent record.
Now you have a convenient way of finding out if someone did something bad to your pool...
bad_admin# zfs set checksum=off hewitt bad_admin# zfs destroy hewitt/jen/love good_admin# zpool history History for 'hewitt': 2006-10-16.17:54:02 zpool create hewitt c1d0 2006-10-16.17:54:11 zfs create hewitt/jen 2006-10-16.17:54:15 zfs create hewitt/jen/love 2006-10-16.17:54:35 zfs set checksum=off hewitt 2006-10-16.17:57:29 zfs destroy hewitt/jen/love #
The history log is implemented using a ring buffer of <packed record length, record nvlist> tuples. More details can be found in spa_history.c, which contains the main kernel code changes for 'zpool history'. The history log's size is 1% of your pool, with a maximum of 32MB and a minimum of 128KB. Note: the original creation of the pool via 'zpool create' is never overwritten.
If you add a new subcommand to zfs(1m) or zpool(1M), all you need to do is call zpool_log_history(). If you build a new consumer of 'zpool history' (such as a GUI), then you need to call zpool_get_history(), and parse the nvlist. A good example of that is in get_history_one().
In the future, we will add the ability to also log uid, hostname, and zonename. We're also looking at adding "internal events" to the log since some subcommands actually take more than one txg, and we'd like to log history every txg (this would be more for developers and debuggers than admins).
These changes are in snv_51, and i would expect s10_u4 (though that schedule hasn't been decided yet).
Enjoy making history.