ZFS Snapshots
What Is a ZFS Snapshot?
A ZFS snapshot is a read-only representation of a ZFS filesystem or volume at a specific point in time. Instead of immediately copying every block into another location, ZFS preserves references to the blocks that existed when the snapshot was created.
Snapshot creation is extremely fast and initially requires essentially no additional data space. Storage consumption increases later when the active dataset changes and older blocks must remain available because one or more snapshots still reference them.
ZFS Snapshots at a Glance
How Do ZFS Snapshots Work?
ZFS uses copy-on-write behavior. Existing blocks are not overwritten in place when data changes. New data is written elsewhere, allowing an existing snapshot to continue referencing the older blocks.
What Happens After a Snapshot?
Consider a dataset containing three files when a snapshot is created. One file is then modified and another is deleted from the live filesystem.
Preserved State
Current State
How to Create a ZFS Snapshot
A snapshot is identified by the dataset name followed by an @ symbol and the snapshot name.
This creates a snapshot named before-upgrade for the dataset tank/data.
Recursive Snapshots
The -r option creates snapshots for the named dataset and all descendant datasets. OpenZFS creates recursive snapshots at the same point in time.
How to List ZFS Snapshots
Accessing Files Inside a ZFS Snapshot
Filesystem snapshots can normally be accessed through the dataset's .zfs/snapshot directory. This makes it possible to retrieve an older version of an individual file without rolling back the entire dataset.
How Much Space Do ZFS Snapshots Use?
A newly created snapshot initially shares the same blocks as the active dataset and therefore requires essentially no additional data storage. Snapshot space usage increases as the live dataset changes.
Snapshots Can Prevent Deleted Data From Freeing Space
Deleting a large file from the active filesystem does not necessarily return that capacity to the pool. If an existing snapshot still references the file's blocks, those blocks must remain allocated.
Long snapshot retention periods combined with rapidly changing datasets can therefore consume substantial storage capacity. Snapshot retention should be planned alongside available pool capacity.
Checking Snapshot Space Usage
Restore a File or Roll Back the Dataset?
Copy Individual Files
When only one or several files need to be recovered, copying them from the snapshot is usually much less disruptive than reverting the entire dataset.
Roll Back the Dataset
A rollback returns the dataset to the selected snapshot state and discards changes made after that point. This is a much more consequential recovery operation.
Rolling Back to a ZFS Snapshot
The zfs rollback command returns a dataset to the state represented by a snapshot. Data written or modified after that snapshot is discarded.
Snapshot Naming and Retention
Consistent snapshot names make recovery and automation easier. Names can identify the snapshot's purpose, date, frequency or the event that triggered its creation.
Example Snapshot Retention Schedule
Snapshot schedules should be matched to workload, available storage and recovery objectives. A policy might retain different snapshot frequencies for different periods.
| Frequency | Example Retention | Potential Purpose |
|---|---|---|
| Hourly | 24–48 hours | Recent accidental changes |
| Daily | 7–30 days | Short-term recovery history |
| Weekly | 4–12 weeks | Medium-term recovery points |
| Monthly | Policy dependent | Longer recovery history |
This is an illustrative schedule, not a universal recommendation. Retention requirements vary significantly by workload and recovery objectives.
Deleting a ZFS Snapshot
Snapshots that are no longer required can be destroyed with zfs destroy.
Destroying a snapshot makes blocks that are no longer referenced by the live dataset or another snapshot eligible to be reclaimed. A snapshot cannot normally be destroyed while it is protected by a hold or required by a dependent clone.
ZFS Snapshots and Send/Receive
Snapshots are also fundamental to ZFS replication. ZFS send streams can represent a snapshot, while incremental streams can transfer changes between snapshot points.
Is a ZFS Snapshot a Backup?
A local ZFS snapshot should not be treated as an independent backup. A snapshot stored in the same pool depends on that pool remaining available. Pool loss, hardware destruction or other failures affecting the entire storage system can make both the active dataset and its local snapshots unavailable.
Snapshots are extremely useful recovery points, but important data should also be protected through an independent backup or replication strategy appropriate to the organization's recovery requirements.
What Are ZFS Snapshots Used For?
ZFS Snapshot Best Practices
ZFS Snapshots FAQ
What is a ZFS snapshot?
A ZFS snapshot is a read-only point-in-time representation of a ZFS filesystem or volume.
Are ZFS snapshots instant?
Snapshot creation is nearly instantaneous because ZFS does not copy the entire dataset when creating the snapshot.
Do ZFS snapshots use disk space?
A new snapshot initially requires essentially no additional data space, but its storage impact grows as the live dataset changes and old blocks remain referenced.
Can a ZFS snapshot recover a deleted file?
Yes, if a retained snapshot contains the earlier file, it can generally be copied back into the active filesystem.
Can you modify a ZFS snapshot?
No. Snapshots are read-only. A writable clone can be created from a snapshot when a writable derivative is required.
What does ZFS rollback do?
Rollback returns a dataset to a snapshot state and discards data changes made after that recovery point.
Why does deleting files not free ZFS space?
One possible reason is that snapshots still reference the deleted files' blocks, preventing those blocks from being reclaimed.
Are ZFS snapshots backups?
Local snapshots are useful recovery points but should not be considered independent backups because they remain dependent on the underlying storage pool.
Can ZFS snapshots be replicated?
Yes. ZFS send and receive use snapshot states for full and incremental replication workflows.