ONTAP monitoring integrations

Event and metric paths

SNMP polling and traps

ONTAP supports SNMPv1, v2c and v3. Communities are read-only. Prefer authenticated/encrypted v3 and restrict manager reachability.

cluster::> system snmp show
Contact: storage-operations@example.com
Location: DC-2 / Row C
SNMPv1 Enabled: true
SNMPv3 Enabled: true
Traphosts: 192.0.2.90

cluster::> system snmp community add -vserver cluster1 \
  -community-name monitor-ro -type ro
cluster::> system snmp community show -vserver cluster1
Vserver   Community Name  Access
cluster1  monitor-ro      ro

cluster::> system snmp traphost add -peer-address 192.0.2.90
cluster::> system snmp traphost show
Host             USM User
192.0.2.90       -

Standard and NetApp enterprise MIBs expose node/system health, interfaces and storage objects including aggregates and volumes. Exact objects vary; load the MIBs for your release and test every alert OID.

EMS to syslog and email

Create a destination and bind an existing filter to it. This is the modern path instead of legacy event route recipes.

cluster::> event notification destination create -name noc-syslog \
  -syslog 192.0.2.91
cluster::> event notification create -filter-name important-events \
  -destinations noc-syslog
cluster::> event notification show
Filter Name       Destinations
important-events  noc-syslog

cluster::> event config modify -mail-from ontap@example.com \
  -mail-server smtp.example.com
cluster::> event notification destination create -name storage-oncall \
  -email storage-oncall@example.com
cluster::> event notification create -filter-name important-events \
  -destinations storage-oncall

Test the whole path and confirm timestamp, hostname, severity and ownership at the receiver.

Prometheus and Grafana

A community exporter or custom collector reads ONTAP REST, converts records to Prometheus metrics, and exposes them for Prometheus; Grafana reads the series. Evaluate exporter maintenance, release support and secret handling.

# Illustrative exporter output; not an ONTAP-native endpoint
ontap_volume_used_percent{cluster="cluster1",svm="svm1",volume="data"} 72.4
ontap_volume_iops{cluster="cluster1",volume="data"} 8431
ontap_volume_latency_seconds{cluster="cluster1",volume="data"} 0.0018
ontap_ha_takeover_possible{cluster="cluster1",node="node1"} 1

Bound label cardinality. Volume/node labels help; paths and request IDs can overwhelm the time-series store. See performance monitoring.

REST collectors

Use HTTPS, least-privilege REST logins and field selection. Volume records can include metric data; counter tables live under the cluster counter API. Inspect the target cluster’s REST documentation because fields evolve.

admin-host$ curl --fail --silent --user 'metrics_ro:REDACTED' \
  'https://cluster.example.com/api/storage/volumes?fields=name,svm,space,metric&max_records=100'
{"records":[{"name":"data","space":{"used":777388523520},
 "metric":{"iops":{"total":8431}}}],"num_records":1}

admin-host$ curl --fail --silent --user 'metrics_ro:REDACTED' \
  'https://cluster.example.com/api/cluster/counter/tables?fields=name,description'
{"records":[{"name":"volume","description":"Volume statistics"}],
 "_links":{"next":{"href":"/api/cluster/counter/tables?start..."}}}

The supported prefix is /api/, not /api/v1/. See ONTAP REST API.

Golden signals and starting alerts

Operationalize these with the production checklist.

Scraping gotchas

• Pagination: follow _links.next.href.
• Authentication: scoped identities, protected secrets, trusted TLS, rotation.
• Load/rates: limit concurrency; back off on 429/5xx and avoid all-field polls.
• Timeouts: set connect/read limits, jitter polling and distinguish zero from failure.
• Duplicates: deduplicate the same EMS event arriving by multiple paths.

admin-host$ curl --fail --connect-timeout 5 --max-time 20 \
  --retry 3 --retry-all-errors --user 'metrics_ro:REDACTED' \
  'https://cluster.example.com/api/cluster?fields=name,version'
{"name":"cluster1","version":{"full":"NetApp Release 9.19.1"}}

File security integrations (OPSWAT / FPolicy)

Monitoring covers health and performance; a separate class of integrations inspects file content on the NAS path. ONTAP's native hook is FPolicy — an asynchronous file-access notification framework that lets an external server see (and optionally block) open, create, rename and setattr events over the ZAPI/REST FPolicy channel.

Third-party file-security gateways integrate this way. OPSWAT's MetaDefender Storage Security, for example, registers as an FPolicy partner to run multiscanning (multiple AV engines), Deep CDR (content disarm and reconstruction of weaponized documents) and DLP checks against files written to ONTAP volumes, quarantining or sanitizing before clients read them back.

cluster::> vserver fpolicy policy event create -event-name scan-open -protocol nfs,cifs \
  -file-operations open,create,rename
cluster::> vserver fpolicy policy create -vserver svm1 -policy-name malware-scan \
  -events scan-open -engine external -server <fpolicy-server>
cluster::> vserver fpolicy policy enable -vserver svm1 -policy-name malware-scan

• Design: screen-write (block malicious writes at ingest) vs screen-read (sanitize on access) changes latency placement and quarantine design.
• Performance: FPolicy adds a synchronous hop on covered operations; exclude backup/replication flows and scratch volumes.
• Resilience: define required-vs-not-required FPolicy server status and test disconnection behavior (fail open vs fail close) before production.
• Complement: pair file scanning with snapshot/Snapshot Immutable plus ransomware hardening — scanning is detection, immutable copies are recovery.

See the FPolicy guide for the full event/engine matrix.

Official ONTAP sources

• Manage SNMP
• SNMP community add
• SNMP traphost add
• Notification destination
• REST API reference
• Cluster performance metrics

Outputs are illustrative. Validate MIBs, fields, filters and privileges on the target release.