HomeResourcesField Guides › NetApp ONTAP Command Reference

Field Guide · Storage Operations

NetApp ONTAP Command Reference for Storage Administrators

Six hundred and seventy-four commands, two generations of the operating system, one page. The twelve curated families below cover the commands NetApp administrators reach for daily — 7-Mode and clustered ONTAP side by side, safety-rated, one click to copy. Underneath them sits the full searchable explorer: the complete deduplicated command inventory with live search and filters, so "what was that anti-ransomware show command?" is a keystroke, not a documentation dive.

Who this is for: NetApp administrators · storage administrators · anyone operating FAS/AFF estates or legacy 7-Mode systems

Curated: 85 commands across 12 families · Explorer: 674 commands, searchable · Validated against ONTAP 9.x; 7-Mode rows marked · Reviewed by WUC Storage Infrastructure Engineering · Last validated: 2026-07-24

Coverage674 commands · 12 curated families
GenerationsClustered ONTAP 9.x · 7-Mode marked
ExplorerLive search · category + platform filters
RiskSafety-badged; explorer is show-commands
Read timeReference — search it, don’t read it

!!Command safety model

The most dangerous thing on this page is the wrong SSH session. ONTAP prompts look identical across clusters, and every serious NetApp incident story starts with a command meant for the lab landing on production. Before anything rated Disruptive or Destructive: read the prompt, run cluster identity show, and say the cluster name out loud. The badges below rate each curated command; everything in the explorer is a show-family read-only command unless its badge says otherwise.
BadgeMeaning
Read-onlyInspects state. Safe in production, any time.
DisruptiveChanges state, moves workloads, or restarts services. Change-window material.
DestructiveDeletes data or rewinds volumes. Verify twice; some of these have no undo.

01Using the ONTAP CLI well

Five habits that make the clustered CLI feel like a power tool instead of a maze. Tab completes and ? explains — at any point in a command, ? lists what can come next. -fields picks your columns (and bare -fields ? lists every field a command offers — field names are the compact forms, ostype not “OS Type”). -instance shows everything about one object when the summary row is not enough. Privilege levels gate the sharp tools: set -privilege advanced unlocks more, set -privilege diagnostic should be typed only when Support asks. Scope with -vserver — in clustered ONTAP most data-serving commands are SVM-scoped, and forgetting the scope shows you everything or nothing.

Command — the session opener
cluster identity show
Output
          Cluster UUID: 4ea7a442-86d1-11e0-ae1c-123478563412
          Cluster Name: bos-aff-01
 Cluster Serial Number: 1-80-000099
      Cluster Location: Boston
       Cluster Contact: storage-team@nexora.local

02System & Hardware

Identity, versions, hardware inventory and health — the commands every session starts with, in both generations of the OS.

CommandWhat it doesPlatformBadge
sysconfig -aShow system configuration7-ModeRead-only
sysconfig -sShow serial number7-ModeRead-only
sysconfig -vShow hardware details7-ModeRead-only
uptimeShow system uptime7-ModeRead-only
versionShow system version7-ModeRead-only
cluster identity showShow cluster identityONTAP 9Read-only
cluster showShow nodes in the clusterONTAP 9Read-only
system health status showShows the health status of the system.ONTAP 9Read-only
system node showDisplays information about the nodes in the cluster.ONTAP 9Read-only
system node show -fields serialnumberShow node serial numbersONTAP 9Read-only
system node show -instanceShow hardware detailsONTAP 9Read-only

03Storage & Aggregates

Aggregates, disks and physical capacity. The 7-Mode aggr/disk verbs and their clustered storage aggregate/storage disk equivalents.

CommandWhat it doesPlatformBadge
aggr show_spaceShow aggregate space usage7-ModeRead-only
aggr statusShow all aggregates7-ModeRead-only
disk showShow disk information7-ModeRead-only
disk show -nShow failed disks7-ModeRead-only
disk show -vShow disk firmware details7-ModeRead-only
vol statusShow volume status7-ModeRead-only
vol status -fShow failed disks7-ModeRead-only
storage aggregate showShow all aggregatesONTAP 9Read-only
storage aggregate show-spaceShow aggregate space usageONTAP 9Read-only
storage disk showShow disk informationONTAP 9Read-only
storage disk show -brokenShow failed disksONTAP 9Read-only
storage disk show -fields firmware-revisionShow disk firmware detailsONTAP 9Read-only
storage disk show 1.0.12Show disk information for specific diskONTAP 9Read-only
storage disk show 1.0.12,1.0.13Show disk information for multiple disksONTAP 9Read-only
volume showShow volume statusONTAP 9Read-only

04Volumes

Volume lifecycle and space. Note how 7-Mode vol verbs map onto clustered volume commands with an SVM scope.

CommandWhat it doesPlatformBadge
vol create <vol_name> -aggregate <aggr_name> -size <size>Creates a new volume.ONTAP 9Disruptive
vol offline <vol_name>Takes a volume offline.ONTAP 9Disruptive
vol online <vol_name>Brings a volume online.ONTAP 9Read-only
vol showDisplays all volumes.ONTAP 9Read-only

05SAN & LUN

Block-side essentials — pairs naturally with the LUN serial correlation guide.

CommandWhat it doesPlatformBadge
lun create -vserver <vserver_name> -path <path> -size <size>Creates a LUN.ONTAP 9Disruptive
lun map -vserver <vserver_name> -path <lun_path> -igroup <igroup>Maps a LUN to an initiator group.ONTAP 9Read-only
lun showDisplays all LUNs.ONTAP 9Read-only

06Networking

Interfaces, LIFs, routes and ports across both generations.

CommandWhat it doesPlatformBadge
ifconfig -aShow network interfaces7-ModeRead-only
ifstat -aShow network statistics7-ModeRead-only
route -sShow routing table7-ModeRead-only
vif statusShow vif status7-ModeRead-only
network interface modify -vserver <vserver_name> -lif <lif_name> -ip <new_ip>Modifies the IP address of a LIF.ONTAP 9Disruptive
network interface showShow network interfacesONTAP 9Read-only
network port ifgrp showShow vif statusONTAP 9Read-only
network port showShow network statisticsONTAP 9Read-only
network route showShow routing tableONTAP 9Read-only

07Cluster & HA

Cluster membership and storage failover. The takeover/giveback pair is where this family stops being read-only — see the warning above the table.

storage failover takeover moves a live workload between controllers. Takeover and giveback are routine during planned maintenance and catastrophic when typed on the wrong node or during instability. Always run storage failover show first, confirm the partner state, and know why you are failing over before you do.
CommandWhat it doesPlatformBadge
cf disableDisable cluster failover7-ModeDisruptive
cf enableEnable cluster failover7-ModeDisruptive
cf partnerShow cluster partner details7-ModeRead-only
cf statusShow cluster failover status7-ModeRead-only
cluster ha modify -configured trueEnables high availability (HA) for the cluster.ONTAP 9Disruptive
cluster peer create -peer-address <address>Creates a cluster peer relationship.ONTAP 9Disruptive
cluster peer showShow cluster peer statusONTAP 9Read-only
storage failover modify -enabled falseDisable cluster failoverONTAP 9Disruptive
storage failover modify -enabled trueEnable cluster failoverONTAP 9Disruptive
storage failover showShow cluster failover statusONTAP 9Read-only

08NAS Protocols (NFS & CIFS)

File-side service state for both protocols.

CommandWhat it doesPlatformBadge
cifs statusShow CIFS status7-ModeRead-only
nfs statusShow NFS status7-ModeRead-only
vserver cifs statusShow CIFS statusONTAP 9Read-only
vserver nfs statusShow NFS statusONTAP 9Read-only

09Snapshots & Backup

Snapshot listing, creation and restore. snap restore rewinds an entire volume — treat it with SnapRestore-license respect.

snap restore is a volume-level time machine with no undo. It reverts the entire volume to the snapshot — everything written since is gone. Single-file restores and clones exist precisely so this command stays rare.
CommandWhat it doesPlatformBadge
CommandDescriptionONTAP 9Read-only
snapshot create -vserver <vserver_name> -volume <vol_name> -snapshot <snap_name>Creates a snapshot.ONTAP 9Disruptive
snapshot delete -vserver <vserver_name> -volume <vol_name> -snapshot <snap_name>Deletes a snapshot.ONTAP 9Destructive
snapshot restore -vserver <vserver_name> -volume <vol_name> -snapshot <snap_name>Restores a volume from a snapshot.ONTAP 9Read-only
snapshot showDisplays all snapshots.ONTAP 9Read-only

10Performance, QoS & Statistics

Live statistics and system load in both CLIs.

CommandWhat it doesPlatformBadge
psShow running processes7-ModeRead-only
sysstat -x 1Show system performance stats7-ModeRead-only
qos performance showDisplays QoS performance statistics.ONTAP 9Read-only
statistics start -object <object>Starts collecting statistics for a specific object (e.g., volume, LUN).ONTAP 9Read-only
sysstatDisplays real-time system performance statistics.ONTAP 9Read-only
system node run -node * -command sysstat -x 1Show system performance statsONTAP 9Read-only
volume show -fields performanceShows performance-related information for volumes.ONTAP 9Read-only

11Events, Jobs & AutoSupport

The event log, background jobs, and AutoSupport — the first three places to look when something already went wrong.

CommandWhat it doesPlatformBadge
autosupport invokeManually trigger AutoSupport7-ModeRead-only
autosupport statusShow AutoSupport status7-ModeRead-only
rdfile /etc/messagesShow messages log7-ModeRead-only
tail -n 50 /etc/messagesShow last N lines of messages log7-ModeRead-only
cluster log showShow messages logONTAP 9Read-only
cluster log show -tail 50Show last N lines of messages logONTAP 9Read-only
system node autosupport check showCheck if AutoSupport enabledONTAP 9Read-only
system node autosupport invoke -type allSend all AutoSupport data without time or size limit, as requested by technical supportONTAP 9Read-only
system node autosupport invoke -type performanceGenerate a Performance AutoSupport as requested by technical supportONTAP 9Read-only
system node autosupport invoke -type testManually trigger AutoSupportONTAP 9Read-only
system node autosupport showShow AutoSupport statusONTAP 9Read-only

12Security & Access

Logins, roles and audit basics from the curated set; the explorer below holds the full security command tree (72 commands, anti-ransomware included).

CommandWhat it doesPlatformBadge
security login create -username <user> -application <app> -authmethod <method>Creates a new user login.ONTAP 9Disruptive
security login modify -username <user> -role <role>Modifies a user's role.ONTAP 9Disruptive
security login showDisplays user login information.ONTAP 9Read-only
vserver cifs users-and-groups local-user create -vserver <vserver_name> -user-name <user>Creates a local CIFS user.ONTAP 9Disruptive

13Licensing

What is licensed, in each generation.

CommandWhat it doesPlatformBadge
licenseShow installed licenses7-ModeRead-only
system license showShow installed licensesONTAP 9Read-only

EXThe full explorer — 674 commands, searchable

Every unique command from the WUC inventory — the twelve families above plus the deep command trees (vserver alone has 165 entries, security 72 including the full anti-ransomware set, metrocluster 24). Type to search across command text and descriptions; filter by family or platform; click Copy on any row. Runs entirely in your browser.

CommandFamilyPlatform

An ONTAP estate that only one person understands?

WUC engineers operate NetApp FAS, AFF and legacy 7-Mode systems under post-OEM maintenance — health assessments, capacity and performance reviews, MetroCluster and SnapMirror DR validation, and the documentation your next hire will thank you for.

Talk to engineering →

FAQFrequently asked questions

Q01Why do 7-Mode commands still matter in 2026?

Because 7-Mode filers are still running in the field — long past end of support, often holding data nobody has migrated — and the engineer who meets one needs the old verbs. The curated tables mark every 7-Mode row so the two vocabularies never blur.

Q02Is everything in the explorer safe to run?

The explorer inventory is overwhelmingly show-family — read-only by construction. The curated tables carry explicit badges where a command changes state. When in doubt, the safety model at the top applies: identify the cluster, read the badge, then type.

Q03What is the fastest way to learn what a command does?

Ask the CLI itself: append ? for the syntax tree, or run man <command> on the cluster shell. The explorer gets you the exact command name; the built-in help does the rest without leaving your session.

Q04Why does a command from the explorer return nothing on my cluster?

Three usual reasons: the feature is not licensed or configured (MetroCluster and SnapLock commands on a cluster without them), the command needs a higher privilege level (set -privilege advanced), or it is SVM-scoped and you have not passed -vserver.

Q05How current is this inventory?

Validated against ONTAP 9.x in July 2026. ONTAP adds commands with each release and rarely removes them; anything here should exist on a current cluster, while your cluster may offer newer commands not yet inventoried.

Q06Can I get this as a spreadsheet?

This page is the living version — searchable and always the latest revision. If your team wants the raw inventory for offline use, ask your WUC engineer; the underlying dataset exports cleanly.

RFReferences

  1. NetApp — ONTAP command reference (authoritative, per release)
  2. NetApp — ONTAP 9 documentation
  3. NetApp Support — 7-Mode legacy documentation archive

From the same practice

WE

About WUC Engineering

Storage engineers at WUC Technologies operate NetApp estates — FAS, AFF, MetroCluster and legacy 7-Mode — under post-OEM storage maintenance engagements across enterprise data centers.

Still SSH-ing into a filer nobody else will touch?

Most NetApp estates we assess run fine until the one person who knows them leaves. WUC engineers deliver operational assessments, runbook documentation, and ongoing maintenance for ONTAP environments inside and outside OEM support — including the 7-Mode systems everyone else refuses to look at.

  • ONTAP health and configuration assessments
  • SnapMirror / MetroCluster DR validation
  • 7-Mode support and migration planning
  • Post-OEM hardware maintenance for FAS/AFF
e.g. Cisco, Dell, NetApp - and when your next contract renews.

Prefer to talk it through first? Book a technical consultation → · View managed services

All hostnames, cluster names, SVMs and values shown in outputs are synthetic reference values. No customer environment is depicted. NetApp and ONTAP are trademarks of NetApp, Inc. WUC Technologies is not affiliated with NetApp.

Get a Custom Solution