Snapshots Snapshots are a read-only, point-in-time image of a dataset. Because of their copy-on-write nature, a snapshot will initially consume no extra storage space. A snapshot’s size will grow as the files it contains change in the parent dataset or as files in the parent dataset are deleted. Because of this, a snapshot serves as a low impact backup of a dataset and the files within it may be used to restore altered or deleted ones on the dataset. Deleting a snapshot will release the data records it holds that are not held by the dataset or by another snapshot and return that space to the pool of available space. Snapshot Indexing You can view the existing snapshots for a dataset by selecting a dataset and clicking on the Snapshots tab in the window’s bottom left corner. On the left, you can view all snapshots that have been created in the dataset, including rolling snapshots, interval snapshots, and held snapshots. The creation time and expiration date for each snapshot are shown with them. Selecting a snapshot will display information about each file present on the window’s right side. At the top, you can filter the snapshots you would like to view based on a range of time. You can select the Show destroyed box at the top to show destroye snapshots. A bar spanning over a range of weeks is located at the top. It is color-coded for indexed snapshots (light blue) and replicated snapshots (dark blue). Hints for symbols and colors can be viewed by hovering over "Legend" in the upper right corner of the snapshots tab. Restoring a file from a Snapshot From the snapshots page, any item in any snapshot can be restored. To do this, click on the dropdown arrow on an item in the snapshot, and select Restore. In the dialog box that shows up, choose whether the restored file should overwrite any existing file, rename the existing, or rename the restored file. Select ‘Restore’ to complete the action. Snapshot Holds It is sometimes necessary to hold snapshots past the normal expiration period. They can be assigned a tag that will be used to report on and enable an admin to remove all holds across all datasets on the appliance with that hold tag. You can also set an expiration on the hold tag itself. No snapshot will be removed from the dataset if there is a hold tag applied. To release a hold tag you can just click release hold on the appropriate data sets. If you delete a dataset you will delete the snapshots with it. If there are snapshots with a hold tag in the dataset pending destruction it will ask you to remove and release the holds before it can proceed destroying the dataset. Rolling Snapshots Rolling snapshots are taken every minute and automatically expire. There will always be five rolling snapshots. When the sixth snapshot is created, the oldest snapshot will be deleted, always leaving five. When an incident occurs, all snapshots are held and set to expire seven days later. You can choose to release the hold after remediating the incident. See Incidentd for more information. You can disable rolling snapshots by checking the Prevent rolling snapshots box.