Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. IT Analytics Help
  3. Section IV. End user
  4. Solutions administration
  5. Storage optimization rule prerequisites and logic

Storage optimization rule prerequisites and logic

Simply enabling a rule does not guarantee that relevant data will be collected. The following table lists prerequisites and dependencies for successful reporting. For an overview of each rule, refer to the following.

See Configure Storage Optimization rules.

Table: Storage optimization rule prerequisites and logic

Storage Optimization Rule

Prerequisites

Rule Processing Logic

Cloud Rules and Logic

AWS Orphan Snapshots

  • AWS EC2 snapshot data must be collected

  • Collected snapshots do not have EC2 instances

  • Checks if a corresponding EC2 instance is found

  • Rule parameters are used to exclude small volumes, new snapshots, and snapshots with specific states

AWS Orphan Volumes

  • AWS EC2 volumes without snapshots must be collected

  • Collected volumes do not have EC2 instances

  • Checks if a corresponding EC2 instance is found

  • Checks if a corresponding EC2 Snapshot is found

  • Rule parameters are used to exclude small volumes and new volumes so that it can ignore volumes that have been orphaned for only a few days

Data Protection Rules and Logic

Data Domain Compression

  • NetBackup data must be collected

  • Data Domain Inventory and file-level compression data must be collected within the last 30 days

  • Rule parameters are used to exclude new clients, small capacity, and high compression ratios because low compression ratios can be used to identify optimization opportunities

  • Note: Initial backups may have only a small system effective compression ratio

High Backup Retention Jobs

  • Backup jobs must be collected.

  • Collected jobs must be backup events with a status of success or warning, and cannot be expired.

  • Rule parameters are used to exclude small jobs, and jobs with low backup retention

Sources Backed Up by Multiple Servers

  • Backup jobs must be collected.

  • Rule parameter is used to include jobs that finish within last few days.

File Analytics Rules and Logic

Inactive Large Files

  • File Analytics data must be collected

  • Rule parameters are used to include/exclude host and file types; specify size of small files to exclude and the number of days for active files

  • User must determine if an old large file can offer reclaimable space, based on the last access date

File Type Usage

  • File Analytics data must be collected

  • Rule parameters are used to include/exclude host and file types; exclude file types with small number of files and consumed storage

Storage Rules and Logic

Inactive LUNs

  • LUN data must be collected

  • LUN performance data must be collected to determine if I/O activity occurred within the days specified in the rule parameters

  • File systems discovered: mount points and file system names collected

  • Excludes internal LUNs, such as RDFs (EMC Symmetrix remote data facility)

  • Checks if the LUN has a storage path

  • Checks the LUN creation date in order to exclude new LUNs

  • Rule parameters are used to include/exclude new LUNs, thin-provisioned LUNs, small LUNs, and specified RAID types

Overprovisioned Hosts

  • Array LUN data must be collected

  • Host Inventory or VMware data must be collected. Host and file systems discovered and in use: mount points and file system names collected

  • Only SAN storage is supported

  • Checks if the LUN has a storage path

  • Checks file system activity for no used capacity growth in the last 90 days

  • Excludes internal LUNs, such as RDFs (EMC Symmetrix remote data facility)

  • Rule parameters are used to include/exclude thin-provisioned LUNs, small file systems, and low available space

  • Greater precision can be achieved if LUN performance data is collected to determine if there was any read I/O, even when usage has not grown

  • Best Practice: Use a small growth rate percentage to isolate overprovisioned hosts

Unallocated LUNs

  • Array LUN data must be collected

  • Excludes internal LUNs, such as RDFs (EMC Symmetrix remote data facility)

  • Checks that no storage path exists for the LUN

  • Rule parameters are used to include/exclude new LUNs, thin-provisioned LUNs, small LUNs, and specified RAID types

Undiscovered LUNs

  • Array LUN data must be collected

  • Excludes internal LUNs, such as RDFs (EMC Symmetrix remote data facility)

  • Checks if the LUN has a storage path

  • Rule parameters are used to include/exclude new LUNs, thin-provisioned LUNs, small LUNs, and specified RAID types

  • Greater precision can be achieved if VMware or Host Inventory data is collected (to verify that no hosts have been discovered) and if LUN performance data is collected

Unused LUNs

  • Array LUN data must be collected

  • Host Inventory or VMware data must be collected

  • Excludes internal LUNs, such as RDFs (EMC Symmetrix remote data facility)

  • Checks if the LUN has a storage path

  • Checks that no file systems have been discovered

  • Rule parameters are used to include/exclude new LUNs, thin-provisioned LUNs, small LUNs, and specified RAID types

  • Greater precision can be achieved if LUN I/O performance data is collected

Virtualization Rules and Logic

Non-VM Files

  • VMware Inventory data must be collected

  • Datastore Scan data must be collected

  • Rule parameters are used to exclude small and/or recently modified files and specific file types

VM Aged Snapshots

  • VMware Inventory data must be collected

  • Datastore Scan data must be collected

  • Rule parameters are used to exclude small files and new snapshots (based on creation date)

VM Low CPU

  • VMware Inventory data must be collected

  • Examines CPU performance statistics for the last 24 hours

  • 0% CPU usage treated as an idle machine

  • Rule parameters are used to exclude small VM guests and include low CPU usage

VM Not in VM Inventory

  • VMware Inventory data must be collected

  • Datastore Scan data must be collected

  • Checks if VM files have been discovered

  • Rule parameters are used to exclude small and/or recently modified files and specific file types

VM Powered Off

  • VMware Inventory data must be collected

  • Checks if VM guest is off

  • Rule parameters are used to exclude small VM guests and VM guest recently powered off

VM Undiscovered Disks

  • VMware Inventory data must be collected

  • Checks if VM guest is on and state is running

  • Rule parameters are used to exclude small VM guests and include low virtual disk usage

  • Greater precision can be achieved if VM performance data is collected

  • Best Practice: To identify unused, wasted disk space, enter a high value for the Include Low Virtual Disk % parameter

Feedback

Was this page helpful?
Previous

Enable Storage Optimization rules

Next

Risk Mitigation solution overview

Feedback

Was this page helpful?