ONTAP monitoring integrations

Use events for state changes and metrics for trends. Send EMS off-cluster, poll through supported interfaces, and prove alerts reach a human.

Event and metric paths

Path	Best for	Boundary
SNMP v1/v2c/v3	Inventory, health polling and traps through ONTAP MIBs.	Use v3 where possible; MIBs are not the full performance model.
EMS → syslog/email	Immediate state changes and faults.	Filters determine signal/noise.
REST/exporter	Structured capacity, health and performance.	Pagination, privilege and polling cost matter.
Active IQ/tools	Fleet analytics and workflows.	See AutoSupport/EMS and BlueXP.

SNMP polling and traps

ONTAP supports SNMPv1, v2c and v3. Communities are read-only. Prefer authenticated/encrypted v3 and restrict manager reachability.

cluster::> system snmp show
Contact: storage-operations@example.com
Location: DC-2 / Row C
SNMPv1 Enabled: true
SNMPv3 Enabled: true
Traphosts: 192.0.2.90

cluster::> system snmp community add -vserver cluster1 \
  -community-name monitor-ro -type ro
cluster::> system snmp community show -vserver cluster1
Vserver   Community Name  Access
cluster1  monitor-ro      ro

cluster::> system snmp traphost add -peer-address 192.0.2.90
cluster::> system snmp traphost show
Host             USM User
192.0.2.90       -

Standard and NetApp enterprise MIBs expose node/system health, interfaces and storage objects including aggregates and volumes. Exact objects vary; load the MIBs for your release and test every alert OID.

EMS to syslog and email

Create a destination and bind an existing filter to it. This is the modern path instead of legacy event route recipes.

cluster::> event notification destination create -name noc-syslog \
  -syslog 192.0.2.91
cluster::> event notification create -filter-name important-events \
  -destinations noc-syslog
cluster::> event notification show
Filter Name       Destinations
important-events  noc-syslog

cluster::> event config modify -mail-from ontap@example.com \
  -mail-server smtp.example.com
cluster::> event notification destination create -name storage-oncall \
  -email storage-oncall@example.com
cluster::> event notification create -filter-name important-events \
  -destinations storage-oncall

Test the whole path and confirm timestamp, hostname, severity and ownership at the receiver.

Prometheus and Grafana

A community exporter or custom collector reads ONTAP REST, converts records to Prometheus metrics, and exposes them for Prometheus; Grafana reads the series. Evaluate exporter maintenance, release support and secret handling.

# Illustrative exporter output; not an ONTAP-native endpoint
ontap_volume_used_percent{cluster="cluster1",svm="svm1",volume="data"} 72.4
ontap_volume_iops{cluster="cluster1",volume="data"} 8431
ontap_volume_latency_seconds{cluster="cluster1",volume="data"} 0.0018
ontap_ha_takeover_possible{cluster="cluster1",node="node1"} 1

Bound label cardinality. Volume/node labels help; paths and request IDs can overwhelm the time-series store. See performance monitoring.

REST collectors

Use HTTPS, least-privilege REST logins and field selection. Volume records can include metric data; counter tables live under the cluster counter API. Inspect the target cluster’s REST documentation because fields evolve.

admin-host$ curl --fail --silent --user 'metrics_ro:REDACTED' \
  'https://cluster.example.com/api/storage/volumes?fields=name,svm,space,metric&max_records=100'
{"records":[{"name":"data","space":{"used":777388523520},
 "metric":{"iops":{"total":8431}}}],"num_records":1}

admin-host$ curl --fail --silent --user 'metrics_ro:REDACTED' \
  'https://cluster.example.com/api/cluster/counter/tables?fields=name,description'
{"records":[{"name":"volume","description":"Volume statistics"}],
 "_links":{"next":{"href":"/api/cluster/counter/tables?start..."}}}

The supported prefix is /api/, not /api/v1/. See ONTAP REST API.

Golden signals and starting alerts

Signal	Starter alert	Reason
Latency	Sustained workload-specific deviation.	No universal millisecond threshold.
Ops/throughput	Collapse or saturation plus latency.	Rate alone is load, not distress.
Capacity	Warn at 80%; urgent by exhaustion forecast.	Tune for growth, snapshots and guarantees.
HA	Unhealthy, takeover impossible/active.	Redundancy is impaired.
Replication lag	Exceeds policy/RPO.	The policy defines breach.
EMS	ERROR and higher, plus selected events.	Severity needs local tuning.

Operationalize these with the production checklist.

Scraping gotchas

Pagination: follow _links.next.href.
Authentication: scoped identities, protected secrets, trusted TLS, rotation.
Load/rates: limit concurrency; back off on 429/5xx and avoid all-field polls.
Timeouts: set connect/read limits, jitter polling and distinguish zero from failure.
Duplicates: deduplicate the same EMS event arriving by multiple paths.

admin-host$ curl --fail --connect-timeout 5 --max-time 20 \
  --retry 3 --retry-all-errors --user 'metrics_ro:REDACTED' \
  'https://cluster.example.com/api/cluster?fields=name,version'
{"name":"cluster1","version":{"full":"NetApp Release 9.19.1"}}

Official ONTAP sources

Outputs are illustrative. Validate MIBs, fields, filters and privileges on the target release.