Skip to main content
 
Splunk Lantern

AWS EBS volumes without a current snapshot

 

Snapshots are backups of an EBS volume that you can use to recover from problems or data loss. While it might be desirable to not take a snapshot of a volume, you should evaluate any volume without a recent snapshot because it might be at risk for data loss. You want a search to help you do that.  

Data required 

AWS: Description data

Procedure

  1. Install the following apps and add-ons:
  2. Ensure that your deployment is ingesting AWS data through one of the following methods:
    • Pulling the data from Splunk via AWS APIs. At small scale, pull via the AWS APIs will work fine.
    • Pushing the data from AWS into Splunk via Lambda/Firehose to Splunk HTTP event collector. As the size and scale of either your AWS accounts or the amount of data to be collected grows, pushing data from AWS into Splunk is the easier and more scalable method.
  3. Use the EBS Insights dashboard in IT Essentials Work to view critical insights about EBS instances deployed across all AWS accounts and regions.

Next steps

Sample results for this search are shown in the table below. The table below shows the volumes that have snapshots that are older than 30 days. This insight could be used to decide which volumes need a recent snapshot or which volumes could be archived and deleted. The lack of a snapshot could be caused by many things, one of which is that the infrastructure is no longer being used. 

account_id id region size type status insight

63605715280

vol-c9831616

ap-southeast-1

80

standard

available

No Recent Snapshot

63605715280

vol-be20b6aa

ap-southeast-1

80

gp2

in-use

No Recent Snapshot

63605715280

vol-c8980101

ap-southeast-1

80

standard

available

No Recent Snapshot

63605715280

vol-c992c7c1

ap-southeast-1

80

standard

available

No Recent Snapshot

Using AWS makes setting up infrastructure easy but can lead to inefficiency and wasted money when resources go unused. Inventory data such as usage, age and location can be used to find efficiencies, which are important in a cloud environment due to usage fees. This type of information can help you maintain infrastructure in the most cost effective way.

Finally, you might be interested in other processes associated with the Managing an Amazon Web Services environment use case.