What is MDV_aud_* volume and why it cannot be deleted like any other data volume.

1. What is MDV_aud_* volume and why it
cannot be deleted like any other data
volume.
This type of volume is called staging volume for auditing purpose.
IMPORTANT: Once the first vserver audit configuration is created and enabled, the staging (MDV)
volumes are created on all aggregates in the cluster. It does not matter if the vserver has volumes on
the aggregates or not. These volumes are not owned by any SVM, but are shared among all audit-
enabled SVMs with data volumes on that aggregate.
Discovery: If you do discover this volume, that means auditing is or was enabled sometime:
To verify:
Run the following command:
::> vserver audit show
If you see something come-up, it explains why MDV_aud* volume appeared in your environment.
FACT: In normal circumstances (99.9%), you will not notice them. You will perhaps stumble upon
them when you are trying to delete an aggregate for whatever reasons, and that’s when you will try
to make sense of it. However, you will find it difficult to get rid of it b’cos they are not your normal
data volumes. Therefore it is always a good idea to google or look for assistance on the NetApp
support site before you go ahead with force delete way. Hope it helps another customer who is
googling for the answers. Resolution follows next.

2. If a staging volume (MDV_aud*) needs to be deleted, perform the following steps:
1) Remove auditing from the vservers. Perform this on each vserver:
::> vserver audit disable -vserver <vserver>
::> vserver audit delete -vserver <vserver>
This will automatically remove 'MDV_aud*' volumes, you need not delete them, they will be
disappeared.
2) Verify that a staging volume no longer exists on each aggregate:
::> volume show -volume MDV_aud* -fields aggregate
If you need auditing, simple re-enable it and the staging volumes will re-appear.
According to NetApp: It is not recommended to force delete this volume due to an un-predictable
repercussion on the cluster. However, if you are destroying an aggregate eventually, then deleting
this volume may have a zero impact, but as NetApp said it is not recommended.
ashwinwriter@gmail.com
Sep, 2019