Overview of ZFS Snapshots

A snapshot is a read-only copy of a file system or volume. Snapshots can be created almost instantly, and they initially consume no additional disk space within the pool. However, as data within the active dataset changes, the snapshot consumes disk space by continuing to reference the old data, thus preventing the disk space from being freed.

ZFS snapshots include the following features:

The persist across system reboots.
The theoretical maximum number of snapshots is 2⁶⁴.
Snapshots use no separate backing store. Snapshots consume disk space directly from the same storage pool as the file system or volume from which they were created.
Recursive snapshots are created quickly as one atomic operation. The snapshots are created together (all at once) or not created at all. The benefit of atomic snapshot operations is that the snapshot data is always taken at one consistent time, even across descendent file systems.

Snapshots of volumes cannot be accessed directly, but they can be cloned, backed up, rolled back to, and so on. For information about backing up a ZFS snapshot, see Sending and Receiving ZFS Data.

Creating and Destroying ZFS Snapshots
Displaying and Accessing ZFS Snapshots
Rolling Back a ZFS Snapshot

Creating and Destroying ZFS Snapshots

Snapshots are created by using the zfs snapshot command, which takes as its only argument the name of the snapshot to create. The snapshot name is specified as follows:

filesystem@snapname
volume@snapname

The snapshot name must satisfy the naming requirements in ZFS Component Naming Requirements.

In the following example, a snapshot of tank/home/ahrens that is named friday is created.

# zfs snapshot tank/home/ahrens@friday

You can create snapshots for all descendent file systems by using the -r option. For example:

# zfs snapshot -r tank/home@now
# zfs list -t snapshot
NAME                       USED  AVAIL  REFER  MOUNTPOINT
rpool/ROOT/zfs2BE@zfs2BE  78.3M      -  4.53G  -
tank/home@now                 0      -    26K  -
tank/home/ahrens@now          0      -   259M  -
tank/home/anne@now            0      -   156M  -
tank/home/bob@now             0      -   156M  -
tank/home/cindys@now          0      -   104M  -

Snapshots have no modifiable properties. Nor can dataset properties be applied to a snapshot. For example:

# zfs set compression=on tank/home/ahrens@now
cannot set compression property for 'tank/home/ahrens@now': snapshot
properties cannot be modified

Snapshots are destroyed by using the zfs destroy command. For example:

# zfs destroy tank/home/ahrens@now

A dataset cannot be destroyed if snapshots of the dataset exist. For example:

# zfs destroy tank/home/ahrens
cannot destroy 'tank/home/ahrens': filesystem has children
use '-r' to destroy the following datasets:
tank/home/ahrens@tuesday
tank/home/ahrens@wednesday
tank/home/ahrens@thursday

In addition, if clones have been created from a snapshot, then they must be destroyed before the snapshot can be destroyed.

For more information about the destroy subcommand, see Destroying a ZFS File System.

Holding ZFS Snapshots

If you have different automatic snapshot policies such that older snapshots are being inadvertently destroyed by zfs receive because they no longer exist on the sending side, you might consider using the snapshots hold feature.

Holding a snapshot prevents it from being destroyed. In addition, this feature allows a snapshot with clones to be deleted pending the removal of the last clone by using the zfs destroy -d command. Each snapshot has an associated user-reference count, which is initialized to zero. This count increases by one whenever a hold is put on a snapshot and decreases by one whenever a hold is released.

In the previous Solaris release, a snapshot could only be destroyed by using the zfs destroy command if it had no clones. In this Solaris release, the snapshot must also have a zero user-reference count.

You can hold a snapshot or set of snapshots. For example, the following syntax puts a hold tag, keep, on tank/home/cindys/snap@1.

# zfs hold keep tank/home/cindys@snap1

You can use the -r option to recursively hold the snapshots of all descendent file systems. For example:

# zfs snapshot -r tank/home@now
# zfs hold -r keep tank/home@now

This syntax adds a single reference, keep, to the given snapshot or set of snapshots. Each snapshot has its own tag namespace and hold tags must be unique within that space. If a hold exists on a snapshot, attempts to destroy that held snapshot by using the zfs destroy command will fail. For example:

# zfs destroy tank/home/cindys@snap1
cannot destroy 'tank/home/cindys@snap1': dataset is busy

If you want to destroy a held snapshot, use the -d option. For example:

# zfs destroy -d tank/home/cindys@snap1

Use the zfs holds command to display a list of held snapshots. For example:

# zfs holds tank/home@now
NAME           TAG   TIMESTAMP                 
tank/home@now  keep  Thu Jul 15 11:25:39 2010

# zfs holds -r tank/home@now
NAME                  TAG   TIMESTAMP                 
tank/home/cindys@now  keep  Thu Jul 15 11:25:39 2010  
tank/home/mark@now    keep  Thu Jul 15 11:25:39 2010  
tank/home@now         keep  Thu Jul 15 11:25:39 2010

You can use the zfs release command to release a hold on a snapshot or set of snapshots. For example:

# zfs release -r keep tank/home@now

If the snapshot is released, the snapshot can be destroyed by using the zfs destroy command. For example:

# zfs destroy -r tank/home@now

Two new properties identify snapshot hold information:

The defer_destroy property is on if the snapshot has been marked for deferred destruction by using the zfs destroy -d command. Otherwise, the property is off.
The userrefs property is set to the number of holds on this snapshot, also referred to as the user-reference count.

Renaming ZFS Snapshots

You can rename snapshots, but they must be renamed within the same pool and dataset from which they were created. For example:

# zfs rename tank/home/cindys@083006 tank/home/cindys@today

In addition, the following shortcut syntax is equivalent to the preceding syntax:

# zfs rename tank/home/cindys@083006 today

The following snapshot rename operation is not supported because the target pool and file system name are different from the pool and file system where the snapshot was created:

# zfs rename tank/home/cindys@today pool/home/cindys@saturday
cannot rename to 'pool/home/cindys@today': snapshots must be part of same 
dataset

You can recursively rename snapshots by using the zfs rename -r command. For example:

# zfs list
NAME                         USED  AVAIL  REFER  MOUNTPOINT
users                        270K  16.5G    22K  /users
users/home                    76K  16.5G    22K  /users/home
users/home@yesterday            0      -    22K  -
users/home/markm              18K  16.5G    18K  /users/home/markm
users/home/markm@yesterday      0      -    18K  -
users/home/marks              18K  16.5G    18K  /users/home/marks
users/home/marks@yesterday      0      -    18K  -
users/home/neil               18K  16.5G    18K  /users/home/neil
users/home/neil@yesterday       0      -    18K  -
# zfs rename -r users/home@yesterday @2daysago
# zfs list -r users/home
NAME                        USED  AVAIL  REFER  MOUNTPOINT
users/home                   76K  16.5G    22K  /users/home
users/home@2daysago            0      -    22K  -
users/home/markm             18K  16.5G    18K  /users/home/markm
users/home/markm@2daysago      0      -    18K  -
users/home/marks             18K  16.5G    18K  /users/home/marks
users/home/marks@2daysago      0      -    18K  -
users/home/neil              18K  16.5G    18K  /users/home/neil
users/home/neil@2daysago       0      -    18K  -

Displaying and Accessing ZFS Snapshots

By default, snapshots are no longer displayed in the zfs list output. You must use the zfs list -t snapshot command to display snapshot information. Or, enable the listsnapshots pool property. For example:

# zpool get listsnapshots tank
NAME  PROPERTY       VALUE      SOURCE
tank  listsnapshots  off        default
# zpool set listsnapshots=on tank
# zpool get listsnapshots tank
NAME  PROPERTY       VALUE      SOURCE
tank  listsnapshots  on         local

Snapshots of file systems are accessible in the .zfs/snapshot directory within the root of the file system. For example, if tank/home/ahrens is mounted on /home/ahrens, then the tank/home/ahrens@thursday snapshot data is accessible in the /home/ahrens/.zfs/snapshot/thursday directory.

# ls /tank/home/ahrens/.zfs/snapshot
tuesday wednesday thursday

You can list snapshots as follows:

# zfs list -t snapshot
NAME                        USED  AVAIL  REFER  MOUNTPOINT
pool/home/anne@monday          0      -   780K  -
pool/home/bob@monday           0      -  1.01M  -
tank/home/ahrens@tuesday   8.50K      -   780K  -
tank/home/ahrens@wednesday 8.50K      -  1.01M  -
tank/home/ahrens@thursday      0      -  1.77M  -
tank/home/cindys@today     8.50K      -   524K  -

You can list snapshots that were created for a particular file system as follows:

# zfs list -r -t snapshot -o name,creation tank/home
NAME                  CREATION
tank/home@now         Wed Jun 30 16:16 2010
tank/home/ahrens@now  Wed Jun 30 16:16 2010
tank/home/anne@now    Wed Jun 30 16:16 2010
tank/home/bob@now     Wed Jun 30 16:16 2010
tank/home/cindys@now  Wed Jun 30 16:16 2010

Disk Space Accounting for ZFS Snapshots

When a snapshot is created, its disk space is initially shared between the snapshot and the file system, and possibly with previous snapshots. As the file system changes, disk space that was previously shared becomes unique to the snapshot, and thus is counted in the snapshot's used property. Additionally, deleting snapshots can increase the amount of disk space unique to (and thus used by) other snapshots.

A snapshot's space referenced property value is the same as the file system's was when the snapshot was created.

You can identify additional information about how the values of the used property are consumed. New read-only file system properties describe disk space usage for clones, file systems, and volumes. For example:

$ zfs list -o space
NAME               AVAIL   USED  USEDSNAP  USEDDS  USEDREFRESERV  USEDCHILD
rpool              25.4G  7.79G         0     64K              0      7.79G
rpool/ROOT         25.4G  6.29G         0     18K              0      6.29G
rpool/ROOT/snv_98  25.4G  6.29G         0   6.29G              0          0
rpool/dump         25.4G  1.00G         0   1.00G              0          0
rpool/export       25.4G    38K         0     20K              0        18K
rpool/export/home  25.4G    18K         0     18K              0          0
rpool/swap         25.8G   512M         0    111M           401M          0

For a description of these properties, see Table 6-1.

Rolling Back a ZFS Snapshot

You can use the zfs rollback command to discard all changes made to a file system since a specific snapshot was created. The file system reverts to its state at the time the snapshot was taken. By default, the command cannot roll back to a snapshot other than the most recent snapshot.

To roll back to an earlier snapshot, all intermediate snapshots must be destroyed. You can destroy earlier snapshots by specifying the -r option.

If clones of any intermediate snapshots exist, the -R option must be specified to destroy the clones as well.

Note - The file system that you want to roll back is unmounted and remounted, if it is currently mounted. If the file system cannot be unmounted, the rollback fails. The -f option forces the file system to be unmounted, if necessary.

In the following example, the tank/home/ahrens file system is rolled back to the tuesday snapshot:

# zfs rollback tank/home/ahrens@tuesday
cannot rollback to 'tank/home/ahrens@tuesday': more recent snapshots exist
use '-r' to force deletion of the following snapshots:
tank/home/ahrens@wednesday
tank/home/ahrens@thursday
# zfs rollback -r tank/home/ahrens@tuesday

In this example, the wednesday and thursday snapshots are destroyed because you rolled back to the earlier tuesday snapshot.

# zfs list -r -t snapshot -o name,creation tank/home/ahrens
NAME                  CREATION
tank/home/ahrens@now  Wed Jun 30 16:16 2010

Identifying ZFS Snapshot Differences (`zfs diff`)

You can determine ZFS snapshot differences by using the zfs diff command.

For example, the following two snapshots are created:

$ ls /tank/home/timh
fileA
$ zfs snapshot tank/home/timh@1014
$ ls /tank/home/timh
fileA  fileB
$ zfs snapshot tank/home/timh@01015

Identify the snapshot differences. For example:

$ zfs diff tank/home/timh@1014 tank/home/timh@1015
M       /tank/home/timh/
+       /tank/home/timh/fileB

In the above output, the M indicates that the directory has been modified. The + indicates that fileB exists in the later snapshot.

The following output indicates that a file in a snapshot has been renamed.

$ mv /tank/cindys/fileB /tank/cindys/fileC
$ zfs snapshot tank/cindys@0915
$ zfs diff tank/cindys@0914 tank/cindys@0915
M       /tank/cindys/
R       /tank/cindys/fileB -> /tank/cindys/fileC

The following table summarizes the file or directory changes that are identified by the zfs diff command.

File or Directory Change	Identifier
File or directory is modified or file or directory link changed	M
File or directory is present in the older snapshot but not in the newer snapshot	—
File or directory is present in the newer snapshot but not in the older snapshot	+
File or directory is renamed	R

For more information, see zfs(1M).

Managing Automatic ZFS Snapshots

The Time Slider snapshot tool automatically snapshots ZFS file systems and allows you to browse and recover snapshots of file systems. This tool provides the following features:

SMF snapshot service instances that schedule reoccurring snapshots
Automatic snapshots are scheduled from the zfssnap crontab
Older snapshots are removed based on a predefined percentage of file system space used
Browse and recover files from snapshots by using the GNOME file manager

You will need to add yourself to the zfssnap role to use the GNOME file manager to modify Time Slider behavior.

When the Time Slider tool is enabled, ZFS file system snapshots are created based on the following criteria:

frequent     snapshots every 15 mins, keeping 4 snapshots
hourly         snapshots every hour, keeping 24 snapshots
daily         snapshots every day, keeping 31 snapshots
weekly         snapshots every week, keeping 7 snapshots
monthly         snapshots every month, keeping 12 snapshots

How to Manage Automatic ZFS Snapshots

Become an administrator.
Enable the Time Slider service, which is disabled by default.
You can enable or disable these services from the command line or from the System->Preferences->Time Slider Setup menu. From this menu, you can also customize which ZFS file systems to snapshot and adjust the file system capacity setting for when snapshots are removed.

Review the default automatic snapshot service instances that are started when the Time Slider service is enabled.

# svcs | grep auto-snapshot
online       Oct_22   svc:/system/filesystem/zfs/auto-snapshot:frequent
online       Oct_22   svc:/system/filesystem/zfs/auto-snapshot:hourly
online       Oct_22   svc:/system/filesystem/zfs/auto-snapshot:weekly
online       Oct_22   svc:/system/filesystem/zfs/auto-snapshot:monthly
online       Oct_22   svc:/system/filesystem/zfs/auto-snapshot:daily

Confirm that automatic snapshots are created.

For example:

# zfs list -t snapshot
NAME                                                   USED  AVAIL  REFER  MOUNTPOINT
rpool@zfs-auto-snap:weekly-2008-11-13-15:39            0      -     46.5K  -
rpool@zfs-auto-snap:daily-2008-11-13-15:39             0      -     46.5K  -
rpool@zfs-auto-snap:hourly-2008-11-13-15:39            0      -     46.5K  -
rpool@zfs-auto-snap:frequent-2008-11-13-15:39          0      -     46.5K  -
rpool/ROOT@zfs-auto-snap:weekly-2008-11-13-15:39       0      -     18K  -
rpool/ROOT@zfs-auto-snap:daily-2008-11-13-15:39        0      -     18K  -
rpool/ROOT@zfs-auto-snap:hourly-2008-11-13-15:39       0      -     18K  -
rpool/ROOT@zfs-auto-snap:frequent-2008-11-13-15:39     0      -     18K  -
.
.
.

Disable or enable specific automatic snapshot services for the top-level dataset and all descendent datasets from the command line.
For example:
```
# zfs set com.sun:auto-snapshot=false rpool
# zfs set com.sun:auto-snapshot=true rpool/ROOT/opensolaris
```
Choose to only take snapshots under a given schedule for a dataset and all direct descendent datasets from the command line.
For example:
```
# zfs set com.sun:auto-snapshot=false rpool/export
# zfs set com.sun:auto-snapshot:weekly=true rpool/export
```

Change the frequency of a given snapshot schedule from the command line.