Skip to main content
The NetApp ONTAP connector ships as beta. It has been verified against a simulator, not yet against a customer appliance — see What “beta” means here.
Bag of words queries an on-premises ONTAP cluster’s REST API so the agent can investigate storage incidents in place: inventory, topology, performance, events and the rest of the diagnostic surface, presented as tables. All network I/O is GET-only. There is no write path in this connector at all.

​
What the catalog looks like

The connector ships a frozen catalog built from the ONTAP 9.14.1 Swagger contract, exposing several hundred selectable tables — aggregates, volumes, LUNs, SVMs, nodes, network interfaces, snapshots, events, and the per-object metrics tables that go with them. That catalog is an execution allowlist, not a claim of availability: it bounds what the connector is allowed to call, and a given appliance may not serve every resource in it. Pick the tables you need when you set up the connection rather than indexing everything. A few properties are deliberate, because the output is meant to be evidence:
  • Missing values stay missing. Nothing is imputed or defaulted.
  • Source identity and query provenance are preserved on the rows.
  • Ceilings fail loudly. A query that would exceed max_rows fails explicitly rather than returning silently truncated results.
  • FlexGroup constituents are separate. volume_constituents carries the physical layout of FlexGroup members and is excluded from logical volume totals, so a constituent is never double-counted against its parent.

​
Before you start

  • An ONTAP account with HTTP application access and read-only diagnostic permissions. A dedicated read-only account is the right shape here — the connector never needs more.
  • The cluster management LIF must be reachable from the Bag of words backend over HTTPS.
  • If the cluster uses a private CA, have its PEM certificate ready. Certificate verification is always on; the certificate field is how you make it succeed, not how you skip it.

​
Fields

​
Authentication

Username / Password — userpass (system scope, the only mode) There is no per-user scope: one shared read-only identity serves the connection.

​
What “beta” means here

The connector was built and verified against an ONTAP simulator on the 9.14.1 REST contract. It has not yet been through an acceptance pass on a customer appliance. In practice that means:
  • Resources in the catalog may not all exist, or may not all be populated, on your cluster’s version and configuration.
  • Validate on a non-production cluster first, and expect to narrow the selected tables to the ones your appliance actually serves.
  • Field names should be treated as less stable than on a generally-available connector.

​
Troubleshooting

Paste the cluster’s CA certificate into ca_certificate. Verification is always enabled and there is no switch to turn it off — allow_http exists only for an isolated simulator, not as a way around a certificate problem.
Check whether it would have exceeded max_rows. The connector refuses to return a partial result set silently; narrow the query’s scope or time range, or raise the ceiling.
The catalog is an allowlist derived from the 9.14.1 contract, not a statement that your appliance serves every resource in it. Confirm the feature is licensed and configured on the cluster.
Make sure you are querying volumes and not volume_constituents. The latter is FlexGroup member layout, intentionally excluded from logical totals.