Introduction:
The contents of a snapshot can be inspected, allowing the user to navigate and examine important pathways. Although snapshots are only a moment point in time and are not dynamic, they can offer vital information for troubleshooting.
Prerequisites:
- Vault binary 1.16.1 or above.
- Create a RAFT snapshot using the below command
vault operator raft snapshot save demo.snap
Steps to inspect:
Command:
vault operator raft snapshot inspect -details=true -depth 3 demo.snap
Expected Output:
ID bolt-snapshot
Size 93290
Index 8957
Term 11
Version 1
Key Name Count Size
---- ---- ----
wal/logs/00000000 54 9KB
sys/counters/activity 5 545B
logical/4ea29c5c-feeb-5ae5-6e33-2725942c5959/oidc_tokens 3 4.9KB
logical/4ea29c5c-feeb-5ae5-6e33-2725942c5959/oidc_provider 2 330B
auth/39b47861-563e-3344-814c-db3f913c5e15/config 1 107B
core/audit 1 104B
core/auth 1 568B
core/autoloaded-license 1 1.2KB
This is the maximum depth it can go as of now: beyond this you would get
Command:
--> vault operator raft snapshot inspect -details=true -depth 1000000000000000000 demo.snap
--> vault operator raft snapshot inspect -details=true -depth 10000000000000000000 demo.snap
invalid value "10000000000000000000" for flag -depth: strconv.ParseInt: parsing "10000000000000000000": value out of range
-depth= adjusts the grouping level of keys, which will affect the count and size calculations.
Command:
vault operator raft snapshot inspect -details demo.snap
Expected Output:
ID bolt-snapshot
Size 93290
Index 8957
Term 11
Version 1
Key Name Count Size
---- ---- ----
wal/logs 54 9KB
index-dr/pages 16 31.8KB
index/pages 14 26.1KB
logical/4ea29c5c-feeb-5ae5-6e33-2725942c5959 5 5.3KB
sys/counters 5 545B
sys/policy 3 3.4KB
sys/token 3 1.1KB
core/cluster 2 236B
vault operator raft snapshot inspect -details=false demo.snap
Expected Output:
ID bolt-snapshot
Size 93290
Index 8957
Term 11
Version 1
-details= = defaults to true and provides additional information about key entries, including child counts and size.
Command:
vault operator raft snapshot inspect -details -depth 3 -filter=core demo.snap
Expected Output:
ID bolt-snapshot
Size 93290
Index 8957
Term 11
Version 1
Key Name Count Size
---- ---- ----
core/audit 1 104B
core/auth 1 568B
core/autoloaded-license 1 1.2KB
core/cluster/feature-flags 1 99B
core/cluster/local 1 137B
core/hsm/barrier-unseal-keys 1 162B
core/index-header-hmac-key 1 99B
core/keyring 1 514B
core/leader/4ec83732-8308-0dcf-5bfa-b2921b6c23e1 1 2.1KB
-filter= filter results by key prefix. Below is an example of filtering by the prefix “core”
Note:- The fields in the output such as key name, count, and size denote the path in the vault database, count of keys, and size of specific db path respectively.