Snapshots Snapshots are a read-only, point-in-time image of a dataset. Because of their copy-on-write nature, a snapshot will initially consume no extra storage space. A snapshot’s size will grow as the files it contains change in the parent dataset or as files in the parent dataset are deleted. Because of this, a snapshot serves as a low impact backup of a dataset and the files within it may be used to restore altered or deleted ones on the dataset. Deleting a snapshot will release the data records it holds that are not held by the dataset or by another snapshot and return that space to the pool of available space. Snapshot Indexing View the existing snapshots for a dataset by selecting a dataset and clicking on the Snapshots tab in the window’s bottom left corner. On the left, view all snapshots that have been created in the dataset, including rolling snapshots, interval snapshots, and held snapshots. The creation time and expiration date for each snapshot are shown with them. Selecting a snapshot will display information about each file present on the window’s right side. At the top, filter the snapshots to be viewed based on a range of time. Select the Show destroyed box at the top to show destroyed snapshots. A bar spanning over a range of weeks is located at the top. It is color-coded for indexed snapshots (light blue) and replicated snapshots (dark blue). Hints for symbols and colors can be viewed by hovering over Legend in the upper right corner of the snapshots tab. Restoring a file from a Snapshot From the snapshots page, any item in any snapshot can be restored. To do this, click on the dropdown arrow on an item in the snapshot, and select Restore. In the dialog box that shows up, choose whether the restored file should overwrite any existing file, rename the existing, or rename the restored file. Select Restore to complete the action. Snapshot Holds It is sometimes necessary to hold snapshots past the normal expiration period. They can be assigned a tag that will be used to report on and enable an admin to remove all holds across all datasets on the appliance with that hold tag. An expiration date can be set on the hold tag itself. No snapshot will be removed from the dataset if there is a hold tag applied. To release a hold tag you can just click release hold on the appropriate snapshots. If a dataset is deleted, as are the snapshots that existed of the dataset. If there are snapshots with a hold tag in the dataset pending destruction, a prompt will ask to remove and release the holds before it can proceed destroying the dataset. Rolling Snapshots Rolling snapshots are taken every minute and automatically expire. There will always be five rolling snapshots. When the sixth snapshot is created, the oldest snapshot will be deleted, always leaving five. When an incident occurs, all snapshots are held and set to expire seven days later. The option to release the hold may be chosen after remediating the incident. See Incidentd for more information. Disable rolling snapshots by checking the Prevent rolling snapshots box. Disabling Rolling Snapshots requires the selection to Use Custom Protection Policy.