Snapshot chains - what happens when you delete a snapshot?

[Mark Edwards]

I think i need a lesson on snapshots, as my brain is hurting! 

Here's a scenario - Lets say I have a base VM, and starting Monday, I create a snapshot at 9AM each day of the week. 

On Friday night, I revert to Wednesday's snapshot. I then create a snapshot 9AM Saturday, and it looks like the image below.

Two questions at this point.

 

1. The "current state" is writing to the Saturday snapshot, correct?
2. The Wednesday snapshot is the parent of the Saturday Snapshot, correct?

Now if i delete the Saturday snapshot (which contains the current state) where do those blocks get written to?

VMware docs are a bit vague at this point on what happens.

Can anyone explain in english what happens, or point me to some better explanation to cement my understanding? ‌‌

 

 

[a_p_]

"Deleting" a snapshot will always merge it's data into its direct parent, which in this case is the Wednesday snapshot.

André

[Mark Edwards]

---

 wrote:

"Deleting" a snapshot will always merge it's data into its direct parent, which in this case is the Wednesday snapshot.

---

I understand that part, what i don't get is:  If the delete merges Saturday's snapshot into Wednesdays snapshot, how is the ability to revert to Wednesday "original" snapshot maintained (given it has now been updated)?

 

Is it tracking the difference between Wednesdays original snapshot and Wednesdays newly updated snapshot?  This is the bit I don't fully understand?

 

Also, VMware's Snapshot FAQ says for a deletion "snapshot files are consolidated and written to the parent snapshot disk and merge with the virtual machine base disk". It states that both happen, is that right?

[a_p_]

Let me answer the second question about the statement in the KB first.
IMO this is not quite correct. The point is that "Delete" will merge snapshot data into its parent, and "Delete All" will merge data from the complete snapshot chain into the be disk.

Now let's go back to your initial question.

When you take a new snapshot, the VMs current state will be preserved, and a new delta (to be precise delta.vmdk, or sesparse.vmdk) file will be created. This is what is represented by "You are here".

When I said that data from the Saturday snapshot will be merged into the Wednesday snapshot, it may not have been very clear. What will happen is that data from the current state "You are here" will be merged with the delta data that was created after you took that "Wednesday" snapshot. This is what's currently represented by the Saturday snapshot. Once the Saturday snapshot is deleted, you will see the new "You are here" as a child of the Wednesday snapshot.
Merging delta data into a file that is a parent (in the chain) for different branches in a snapshot tree would not be a good idea.

Please note that a "Delete All" operation with a snapshot tree in place will merge the current chain into the base disk, and simply delete the delta files of the other forks.

Not sure if that explains it, or confuses you even more, so please don't hesitate to ask if you want/need further explanation.

André

 

[Mark Edwards]

Hi  

Thanks for trying to explain this. I have been testing in my lab and tracking exactly what happens at the file level to get a better understanding.

 

---

 wrote:

The point is that "Delete" will merge snapshot data into its parent

---

From what i'm seeing, what you said above (in bold) doesn't happen at all for the scenario posted.   Also, what you said above, seems to be different to what you said below ?

In the above, you said the deleted blocks are merged with  the parent snapshot vmdk and below you said they are merged with the current state delta vmdk, but it can't be both!  In fact what you said below is exactly what i DO see happening! NOTHING gets written back to the parent snapshot at all in my testing.

 

---

What will happen is that data from the current state "You are here" will be merged with the delta data that was created after you took that "Wednesday" snapshot. This is what's currently represented by the Saturday snapshot. Once the Saturday snapshot is deleted, you will see the new "You are here" as a child of the Wednesday snapshot.

---

In conclusion, does this mean VMware's explanation below on deleting snapshots (from their FAQ) is incorrect?

"Snapshot files are consolidated and written to the parent snapshot disk and merge with the virtual machine base disk. - Technically i'd argue this is misleading, as it isn't the actual "snapshot file that is written to its parent, it is the running delta file (which is a different disk). Also the mention of data being written the virtual machine base disk is only true when there is one snapshot but this isn't clarified.

[Mark Edwards]

Ok I think I now have a clear understanding of what's going on here. Can someone  or  (have a read of the above) and sanity check please? 

[Scott Vessey]

Sounds good to me, as I mentioned the key part is that deleting a snapshot is removing your ability to revert to the state at the time it was taken.

[Mark Edwards]

---

 wrote:
Sounds good to me, as I mentioned the key part is that deleting a snapshot is removing your ability to revert to the state at the time it was taken.

---

Hi Scott, Yep that part was always understood 

What confused me was you both said "the data held in the Saturday snapshot would be merged into the Wednesday/Parent snapshot".

But as i understand it, that isn't correct for this scenario, which means the VMware article is also incorrect! In which case it would be great to get it corrected 

 

 

[a_p_]

Explaining snapshots can be confusing

Now, let me try it from another point of view.

"You are here" always refers to the current active (r/w) .vmdk file, which in case of a VM without snapshots is the base .vmdk file, and for a VM with snapshots is the currently active delta .vmdk file.

Once a snapshot is created, the current .vmdk file (and its parents, if any) becomes a point in time state. This file/state will now be treated as read-only, and a new child/delta file will be created (the new "You are here"), in which modified data will be stored.
As an example, creating the first snapshot will make the base .vmdk the r/o point in time state (e.g. the "Monday 9AM" state as in your case), and the newly created 000001.vmdk its r/w child.

When you delete a snapshot, you are actually deleting the child, and as such the child's changed blocks will be merged to its parent .vmdk file, and the child file as well as the snapshot state will then be deleted.

Reverting to a snapshot ("Go to") will immediately delete (without merging data) the current "You are here" file, and create a new one for the point in time/snapshot to which you reverted.

For your initial question about deleting the Saturday snapshot this means:

• Reverting from the Friday state to the Wednesday snapshot, physically deleted the "You are here" file for the Friday changes, and created a new "You are here" file with the Wednesday snapshot as its parent.
• With creating the Saturday snapshot, that child file became the point in time state for the Saturday snapshot, and a new "You are here" child file got created.
• Deleting the Saturday snapshot from the Snapshot Manager merged this new child's data into the Saturday snapshot's .vmdk file (i.e. its parent file), and made that state the new "You are here" state with the Wednesday snapshot as it's parent.

Does that make sense now?

André

[Mark Edwards]

Thankyou for bearing with me   

 

This is the GOLDEN statement right here >> "When you delete a snapshot, you are actually deleting the child"

 

Exactly!! The child being the running delta vmdk!!   So to conclude, it is actually the DELTA vmdk (as represented by "you are here" ) that is written to its parent (the Saturday snapshot vmdk). It is not the Saturday snapshot (represented by a different vmdk) that is written to its parent (the Wednesday snapshot vmdk), which is what the documentation implies, and where my confusion has arisen.

 

I havn't seen that small but very important detail explained anywhere, and I must say the VMware documentation, is highly misleading.

 

Also you said earlier that deleting Saturday's snapshot would write those changes to the Wednesday snapshot, I'm concluding that isn't now correct? As that's what was partially confusing me.

 

PS: I have edited my posts above to minimize confusion for anyone else coming across this thread.

[Scott Vessey]

Anyone can leave feedback on a KB article, you should see a banner at the bottom of your browser asking if the article was helpful or not, choose no and leave feedback comments.

[Scott Vessey]

You are deleting the ability to revert the state of the VM to when that snapshot was taken.

So, in your example you can no longer revert to the Saturday 9AM state, the data being held in the Saturday snapshot files will be merged into the Wednesday snapshot files.