Protecting Data: Snapshots, Versioning, and Undelete

GFS offers three complementary mechanisms for protecting data: snapshots, file-granular versioning (log-xfer), and undelete. This chapter explains when to use each and how they interact with replication.

Snapshots

Snapshots provide a consistent point-in-time recovery reference and support long-term archival. Current best practice is a single snapshot per day on one site; avoid high-frequency (for example hourly) full snapshots.

Taking a real snapshot initiates copy-on-write for files currently open for write, which can be resource-intensive when the underlying storage lacks offloaded cloning. The snapshot’s point-in-time therefore has some "fuzz": files opened for write after the snapshot also copy-on-write their data.

To create a snapshot from the admin CLI, use file-snapshot-create with the --now flag, giving a file path (wildcards are supported to cover an entire share). The path starts with the share’s export path, not its name: /home for the Home share this guide creates with share-create --path /home. A share created in the GUI gets a path derived from its name (/Home), so use whichever path the share actually has — share-list --name Home shows it as Path:.

file-snapshot-create --filename /home/* --now

Expected output:

total 1
/home/.fsnapshot/file/2026-09-23T19-17-45-0644-0

Each snapshotted file appears as a separate, read-only, timestamped copy under .fsnapshot/<original filename>/<timestamp>.

In this guide’s own testing (5.2 and 5.3, MD5-verified against files never previously read at the remote site), snapshot data was readable from every participating site, not only the site where the snapshot was created.

File Versioning and Undelete

log-xfer versioning creates a local version of a file when ownership changes, acting as protection against user errors and conflicts. Undelete preserves deleted files for a set period.

.fsnapshot (covered above, under Snapshots) and .snapshot/current (below) are two distinct, unrelated mechanisms despite the similar directory names. .fsnapshot holds true point-in-time snapshot copies created by file-snapshot-create. .snapshot/current is a live view of the current directory that surfaces retained versions created automatically by log-xfer and undelete — not frozen point-in-time copies.

Undelete and log-xfer retain files in .snapshot/current. Without a snapshot delete schedule (or GFS replication that ages them out), these retained files consume space indefinitely. Pair undelete/versioning with a snapshot schedule to reclaim space. (Ties to DOCS-37 / HS-26900.)