Home › Resources › Field Guides › NetApp ONTAP Command Reference
Field Guide · Storage OperationsNetApp ONTAP Command Reference for Storage Administrators
Six hundred and seventy-four commands, two generations of the operating system, one page. The twelve curated families below cover the commands NetApp administrators reach for daily — 7-Mode and clustered ONTAP side by side, safety-rated, one click to copy. Underneath them sits the full searchable explorer: the complete deduplicated command inventory with live search and filters, so "what was that anti-ransomware show command?" is a keystroke, not a documentation dive.
!!Command safety model
cluster identity show, and say the cluster name out loud. The badges below rate each curated command; everything in the explorer is a show-family read-only command unless its badge says otherwise.
| Badge | Meaning |
|---|---|
| Read-only | Inspects state. Safe in production, any time. |
| Disruptive | Changes state, moves workloads, or restarts services. Change-window material. |
| Destructive | Deletes data or rewinds volumes. Verify twice; some of these have no undo. |
01Using the ONTAP CLI well
Five habits that make the clustered CLI feel like a power tool instead of a maze. Tab completes and ? explains — at any point in a command, ? lists what can come next. -fields picks your columns (and bare -fields ? lists every field a command offers — field names are the compact forms, ostype not “OS Type”). -instance shows everything about one object when the summary row is not enough. Privilege levels gate the sharp tools: set -privilege advanced unlocks more, set -privilege diagnostic should be typed only when Support asks. Scope with -vserver — in clustered ONTAP most data-serving commands are SVM-scoped, and forgetting the scope shows you everything or nothing.
cluster identity show Cluster UUID: 4ea7a442-86d1-11e0-ae1c-123478563412
Cluster Name: bos-aff-01
Cluster Serial Number: 1-80-000099
Cluster Location: Boston
Cluster Contact: storage-team@nexora.local02System & Hardware
Identity, versions, hardware inventory and health — the commands every session starts with, in both generations of the OS.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
sysconfig -a | Show system configuration | 7-Mode | Read-only | |
sysconfig -s | Show serial number | 7-Mode | Read-only | |
sysconfig -v | Show hardware details | 7-Mode | Read-only | |
uptime | Show system uptime | 7-Mode | Read-only | |
version | Show system version | 7-Mode | Read-only | |
cluster identity show | Show cluster identity | ONTAP 9 | Read-only | |
cluster show | Show nodes in the cluster | ONTAP 9 | Read-only | |
system health status show | Shows the health status of the system. | ONTAP 9 | Read-only | |
system node show | Displays information about the nodes in the cluster. | ONTAP 9 | Read-only | |
system node show -fields serialnumber | Show node serial numbers | ONTAP 9 | Read-only | |
system node show -instance | Show hardware details | ONTAP 9 | Read-only |
03Storage & Aggregates
Aggregates, disks and physical capacity. The 7-Mode aggr/disk verbs and their clustered storage aggregate/storage disk equivalents.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
aggr show_space | Show aggregate space usage | 7-Mode | Read-only | |
aggr status | Show all aggregates | 7-Mode | Read-only | |
disk show | Show disk information | 7-Mode | Read-only | |
disk show -n | Show failed disks | 7-Mode | Read-only | |
disk show -v | Show disk firmware details | 7-Mode | Read-only | |
vol status | Show volume status | 7-Mode | Read-only | |
vol status -f | Show failed disks | 7-Mode | Read-only | |
storage aggregate show | Show all aggregates | ONTAP 9 | Read-only | |
storage aggregate show-space | Show aggregate space usage | ONTAP 9 | Read-only | |
storage disk show | Show disk information | ONTAP 9 | Read-only | |
storage disk show -broken | Show failed disks | ONTAP 9 | Read-only | |
storage disk show -fields firmware-revision | Show disk firmware details | ONTAP 9 | Read-only | |
storage disk show 1.0.12 | Show disk information for specific disk | ONTAP 9 | Read-only | |
storage disk show 1.0.12,1.0.13 | Show disk information for multiple disks | ONTAP 9 | Read-only | |
volume show | Show volume status | ONTAP 9 | Read-only |
04Volumes
Volume lifecycle and space. Note how 7-Mode vol verbs map onto clustered volume commands with an SVM scope.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
vol create <vol_name> -aggregate <aggr_name> -size <size> | Creates a new volume. | ONTAP 9 | Disruptive | |
vol offline <vol_name> | Takes a volume offline. | ONTAP 9 | Disruptive | |
vol online <vol_name> | Brings a volume online. | ONTAP 9 | Read-only | |
vol show | Displays all volumes. | ONTAP 9 | Read-only |
05SAN & LUN
Block-side essentials — pairs naturally with the LUN serial correlation guide.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
lun create -vserver <vserver_name> -path <path> -size <size> | Creates a LUN. | ONTAP 9 | Disruptive | |
lun map -vserver <vserver_name> -path <lun_path> -igroup <igroup> | Maps a LUN to an initiator group. | ONTAP 9 | Read-only | |
lun show | Displays all LUNs. | ONTAP 9 | Read-only |
06Networking
Interfaces, LIFs, routes and ports across both generations.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
ifconfig -a | Show network interfaces | 7-Mode | Read-only | |
ifstat -a | Show network statistics | 7-Mode | Read-only | |
route -s | Show routing table | 7-Mode | Read-only | |
vif status | Show vif status | 7-Mode | Read-only | |
network interface modify -vserver <vserver_name> -lif <lif_name> -ip <new_ip> | Modifies the IP address of a LIF. | ONTAP 9 | Disruptive | |
network interface show | Show network interfaces | ONTAP 9 | Read-only | |
network port ifgrp show | Show vif status | ONTAP 9 | Read-only | |
network port show | Show network statistics | ONTAP 9 | Read-only | |
network route show | Show routing table | ONTAP 9 | Read-only |
07Cluster & HA
Cluster membership and storage failover. The takeover/giveback pair is where this family stops being read-only — see the warning above the table.
storage failover takeover moves a live workload between controllers. Takeover and giveback are routine during planned maintenance and catastrophic when typed on the wrong node or during instability. Always run storage failover show first, confirm the partner state, and know why you are failing over before you do.| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
cf disable | Disable cluster failover | 7-Mode | Disruptive | |
cf enable | Enable cluster failover | 7-Mode | Disruptive | |
cf partner | Show cluster partner details | 7-Mode | Read-only | |
cf status | Show cluster failover status | 7-Mode | Read-only | |
cluster ha modify -configured true | Enables high availability (HA) for the cluster. | ONTAP 9 | Disruptive | |
cluster peer create -peer-address <address> | Creates a cluster peer relationship. | ONTAP 9 | Disruptive | |
cluster peer show | Show cluster peer status | ONTAP 9 | Read-only | |
storage failover modify -enabled false | Disable cluster failover | ONTAP 9 | Disruptive | |
storage failover modify -enabled true | Enable cluster failover | ONTAP 9 | Disruptive | |
storage failover show | Show cluster failover status | ONTAP 9 | Read-only |
08NAS Protocols (NFS & CIFS)
File-side service state for both protocols.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
cifs status | Show CIFS status | 7-Mode | Read-only | |
nfs status | Show NFS status | 7-Mode | Read-only | |
vserver cifs status | Show CIFS status | ONTAP 9 | Read-only | |
vserver nfs status | Show NFS status | ONTAP 9 | Read-only |
09Snapshots & Backup
Snapshot listing, creation and restore. snap restore rewinds an entire volume — treat it with SnapRestore-license respect.
snap restore is a volume-level time machine with no undo. It reverts the entire volume to the snapshot — everything written since is gone. Single-file restores and clones exist precisely so this command stays rare.| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
Command | Description | ONTAP 9 | Read-only | |
snapshot create -vserver <vserver_name> -volume <vol_name> -snapshot <snap_name> | Creates a snapshot. | ONTAP 9 | Disruptive | |
snapshot delete -vserver <vserver_name> -volume <vol_name> -snapshot <snap_name> | Deletes a snapshot. | ONTAP 9 | Destructive | |
snapshot restore -vserver <vserver_name> -volume <vol_name> -snapshot <snap_name> | Restores a volume from a snapshot. | ONTAP 9 | Read-only | |
snapshot show | Displays all snapshots. | ONTAP 9 | Read-only |
10Performance, QoS & Statistics
Live statistics and system load in both CLIs.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
ps | Show running processes | 7-Mode | Read-only | |
sysstat -x 1 | Show system performance stats | 7-Mode | Read-only | |
qos performance show | Displays QoS performance statistics. | ONTAP 9 | Read-only | |
statistics start -object <object> | Starts collecting statistics for a specific object (e.g., volume, LUN). | ONTAP 9 | Read-only | |
sysstat | Displays real-time system performance statistics. | ONTAP 9 | Read-only | |
system node run -node * -command sysstat -x 1 | Show system performance stats | ONTAP 9 | Read-only | |
volume show -fields performance | Shows performance-related information for volumes. | ONTAP 9 | Read-only |
11Events, Jobs & AutoSupport
The event log, background jobs, and AutoSupport — the first three places to look when something already went wrong.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
autosupport invoke | Manually trigger AutoSupport | 7-Mode | Read-only | |
autosupport status | Show AutoSupport status | 7-Mode | Read-only | |
rdfile /etc/messages | Show messages log | 7-Mode | Read-only | |
tail -n 50 /etc/messages | Show last N lines of messages log | 7-Mode | Read-only | |
cluster log show | Show messages log | ONTAP 9 | Read-only | |
cluster log show -tail 50 | Show last N lines of messages log | ONTAP 9 | Read-only | |
system node autosupport check show | Check if AutoSupport enabled | ONTAP 9 | Read-only | |
system node autosupport invoke -type all | Send all AutoSupport data without time or size limit, as requested by technical support | ONTAP 9 | Read-only | |
system node autosupport invoke -type performance | Generate a Performance AutoSupport as requested by technical support | ONTAP 9 | Read-only | |
system node autosupport invoke -type test | Manually trigger AutoSupport | ONTAP 9 | Read-only | |
system node autosupport show | Show AutoSupport status | ONTAP 9 | Read-only |
12Security & Access
Logins, roles and audit basics from the curated set; the explorer below holds the full security command tree (72 commands, anti-ransomware included).
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
security login create -username <user> -application <app> -authmethod <method> | Creates a new user login. | ONTAP 9 | Disruptive | |
security login modify -username <user> -role <role> | Modifies a user's role. | ONTAP 9 | Disruptive | |
security login show | Displays user login information. | ONTAP 9 | Read-only | |
vserver cifs users-and-groups local-user create -vserver <vserver_name> -user-name <user> | Creates a local CIFS user. | ONTAP 9 | Disruptive |
13Licensing
What is licensed, in each generation.
| Command | What it does | Platform | Badge | |
|---|---|---|---|---|
license | Show installed licenses | 7-Mode | Read-only | |
system license show | Show installed licenses | ONTAP 9 | Read-only |
EXThe full explorer — 674 commands, searchable
Every unique command from the WUC inventory — the twelve families above plus the deep command trees (vserver alone has 165 entries, security 72 including the full anti-ransomware set, metrocluster 24). Type to search across command text and descriptions; filter by family or platform; click Copy on any row. Runs entirely in your browser.
| Command | Family | Platform |
|---|
An ONTAP estate that only one person understands?
WUC engineers operate NetApp FAS, AFF and legacy 7-Mode systems under post-OEM maintenance — health assessments, capacity and performance reviews, MetroCluster and SnapMirror DR validation, and the documentation your next hire will thank you for.
Talk to engineering →FAQFrequently asked questions
Q01Why do 7-Mode commands still matter in 2026?
Because 7-Mode filers are still running in the field — long past end of support, often holding data nobody has migrated — and the engineer who meets one needs the old verbs. The curated tables mark every 7-Mode row so the two vocabularies never blur.
Q02Is everything in the explorer safe to run?
The explorer inventory is overwhelmingly show-family — read-only by construction. The curated tables carry explicit badges where a command changes state. When in doubt, the safety model at the top applies: identify the cluster, read the badge, then type.
Q03What is the fastest way to learn what a command does?
Ask the CLI itself: append ? for the syntax tree, or run man <command> on the cluster shell. The explorer gets you the exact command name; the built-in help does the rest without leaving your session.
Q04Why does a command from the explorer return nothing on my cluster?
Three usual reasons: the feature is not licensed or configured (MetroCluster and SnapLock commands on a cluster without them), the command needs a higher privilege level (set -privilege advanced), or it is SVM-scoped and you have not passed -vserver.
Q05How current is this inventory?
Validated against ONTAP 9.x in July 2026. ONTAP adds commands with each release and rarely removes them; anything here should exist on a current cluster, while your cluster may offer newer commands not yet inventoried.
Q06Can I get this as a spreadsheet?
This page is the living version — searchable and always the latest revision. If your team wants the raw inventory for offline use, ask your WUC engineer; the underlying dataset exports cleanly.
RFReferences
- NetApp — ONTAP command reference (authoritative, per release)
- NetApp — ONTAP 9 documentation
- NetApp Support — 7-Mode legacy documentation archive
→From the same practice
- NetApp LUN Serial Number in VMware — NAA correlation + live decoder
- Cisco MDS Zoning for NetApp AFF Dual-Fabric Setups
- PowerScale (Isilon) OneFS Command Reference
- Post-OEM storage maintenance
Still SSH-ing into a filer nobody else will touch?
Most NetApp estates we assess run fine until the one person who knows them leaves. WUC engineers deliver operational assessments, runbook documentation, and ongoing maintenance for ONTAP environments inside and outside OEM support — including the 7-Mode systems everyone else refuses to look at.
- ONTAP health and configuration assessments
- SnapMirror / MetroCluster DR validation
- 7-Mode support and migration planning
- Post-OEM hardware maintenance for FAS/AFF
Prefer to talk it through first? Book a technical consultation → · View managed services
All hostnames, cluster names, SVMs and values shown in outputs are synthetic reference values. No customer environment is depicted. NetApp and ONTAP are trademarks of NetApp, Inc. WUC Technologies is not affiliated with NetApp.