APIs in Category: sectrace | Vserver API version 1.20

security-trace-filter-create security-trace-filter-delete security-trace-filter-get-iter security-trace-filter-modify security-trace-result-delete security-trace-result-show | This set of ZAPIs allow setting up and managing permission check filters and logs. Permission tracing allows users to trace permission checks that are done during multiprotocol security access. These set of ZAPIs provide an interface to create, delete and modify security tracing filters. They also allow viewing and deleting of trace records that are generated as a result of the trace filters.

NetApp Manage ONTAP

security-trace-filter-create | [top]

> Creates a new Security trace entry.

> Input Name | Range | Type | Description
> client-ip |  | ip-address optional | The IP address of the client.
> enabled |  | enable optional | This is used to enable or disable the filter.
> index | [0..2^32-1] | integer | internally created index for the filter.
> path |  | string optional | Path to match.
> return-record |  | boolean optional | If set to true, returns the security-trace-filter on successful creation. Default: false
> time-enabled | [0..2^32-1] | integer optional | The admin can specify a timeout for this filter after which it would be disabled.
> trace-allow |  | boolean optional | The deny events are traced by default. This option is to record trace results for allow events as well.
> unix-name |  | string optional | Unix user name to trace.
> windows-name |  | string optional | Windows User Name to trace.
> Output Name | Range | Type | Description
> result |  | security-trace-filter-attributes optional | The security-trace-filter created (keys or the entire object if requested)

> Errno | Description
> EINTERNALERROR |  |

security-trace-filter-delete | [top]

> Deletes the specified Security trace entry.

> Input Name | Range | Type | Description
> index | [0..2^32-1] | integer | internally created index for the filter.

> Errno | Description
> EOBJECTNOTFOUND |  |
> EINTERNALERROR |  |

security-trace-filter-get-iter | [top]

> Gives information about one or more Security trace entries.

> Input Name | Range | Type | Description
> desired-attributes |  | security-trace-filter-attributes optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | security-trace-filter-attributes optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the security-trace-filter object. All security-trace-filter objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | security-trace-filter-attributes[] optional | The list of attributes of security-trace-filter objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more security-trace-filter objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

security-trace-filter-modify | [top]

> Modifies settings of a Security trace entry, even if it is in use.

> Input Name | Range | Type | Description
> client-ip |  | ip-address optional | The IP address of the client.
> enabled |  | enable optional | This is used to enable or disable the filter.
> index | [0..2^32-1] | integer | internally created index for the filter.
> path |  | string optional | Path to match.
> time-enabled | [0..2^32-1] | integer optional | The admin can specify a timeout for this filter after which it would be disabled.
> trace-allow |  | boolean optional | The deny events are traced by default. This option is to record trace results for allow events as well.
> unix-name |  | string optional | Unix user name to trace.
> windows-name |  | string optional | Windows User Name to trace.

> Errno | Description
> EOBJECTNOTFOUND |  |
> EINTERNALERROR |  |

security-trace-result-delete | [top]

> Delete the specified security tracing event record.

> Input Name | Range | Type | Description
> node |  | node-name | The cluster node on which the permission tracing event occured.
> seqnum | [0..2^64-1] | integer | The sequence number of the permission tracing event.

> Errno | Description
> EOBJECTNOTFOUND |  |
> EINTERNALERROR |  |

security-trace-result-show | [top]

> Retrieve the list of permission tracing results for the cluster.

> Input Name | Range | Type | Description
> desired-attributes |  | security-trace-results-logs optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | security-trace-results-logs optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the security-trace-result object. All security-trace-result objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | security-trace-results-logs[] optional | The list of attributes of security-trace-result objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more security-trace-result objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

Element definition: enable | [top]

> 'enabled' or 'disabled'

> [none]

Element definition: ip-address | [top]

> IPv4 and IPv6 address

> [none]

Element definition: node-name | [top]

> The node's name

> [none]

Element definition: security-trace-filter-attributes | [top]

> Security trace configuration. When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> client-ip |  | ip-address optional | The IP address of the client. Attributes: optional-for-create, modifiable
> enabled |  | enable optional | This is used to enable or disable the filter. Attributes: optional-for-create, modifiable
> index | [0..2^32-1] | integer optional | internally created index for the filter. Attributes: key, required-for-create, non-modifiable
> path |  | string optional | Path to match. Attributes: optional-for-create, modifiable
> time-enabled | [0..2^32-1] | integer optional | The admin can specify a timeout for this filter after which it would be disabled. Attributes: optional-for-create, modifiable
> trace-allow |  | boolean optional | The deny events are traced by default. This option is to record trace results for allow events as well. Attributes: optional-for-create, modifiable
> unix-name |  | string optional | Unix user name to trace. Attributes: optional-for-create, modifiable
> vserver |  | vserver-name optional | Vserver on which the permission tracing is applied. Attributes: key, non-creatable, non-modifiable
> windows-name |  | string optional | Windows User Name to trace. Attributes: optional-for-create, modifiable

Element definition: security-trace-results-logs | [top]

> List of security tracing results. When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> client-ip |  | ip-address optional | The IP address of the client that triggered the permission tracing event. Attributes: required-for-create, non-modifiable
> index | [0..2^32-1] | integer optional | The index of the filter corresponding to the permission tracing event. Attributes: required-for-create, non-modifiable
> keytime |  | date optional | The date and time of day when the persmission tracing event occured. Attributes: required-for-create, non-modifiable
> node |  | node-name optional | The cluster node on which the permission tracing event occured. Attributes: key, required-for-create, non-modifiable
> path |  | string optional | The path of the file whose access triggered the permission tracing event. Attributes: required-for-create, non-modifiable
> result |  | string optional | A brief explanation of the result of the security check. Attributes: required-for-create, non-modifiable
> security-style |  | security-style optional | The security style of the file system where the persmission tracing event occured. Attributes: required-for-create, non-modifiable Possible values: "security_none" - Security not Set, "security_unix_modebits" - UNIX and UNIX permissions, "security_unix_acl" - UNIX and NFSv4 ACL, "security_unix_sd" - UNIX and NT ACL, "security_mixed_modebits" - MIXED and UNIX permissions, "security_mixed_acl" - MIXED and NFSv4 ACL, "security_mixed_sd" - MIXED and NT ACL, "security_ntfs_modebits" - NTFS and UNIX permissions, "security_ntfs_acl" - NTFS and NT ACL, "security_ntfs_sd" - NTFS and NT ACL, "security_unix" - UNIX, "security_mixed" - MIXED, "security_ntfs" - NTFS, "security_modebits" - UNIX permissions, "security_acl" - ACL, "security_sd" - SD
> seqnum | [0..2^64-1] | integer optional | The sequence number of the permission tracing event. Attributes: key, required-for-create, non-modifiable
> user-name |  | string optional | Windows or Unix user who triggered the permission tracing event. Attributes: required-for-create, non-modifiable
> vserver |  | vserverid optional | The Vserver on which the permission tracing event occured. Attributes: key, non-creatable, non-modifiable

Element definition: date | [top]

> Date (in seconds since Jan. 1, 1970 12:00:00) Range : [0..2^31-1].

> [none]

Element definition: enable | [top]

> 'enabled' or 'disabled'

> [none]

Element definition: ip-address | [top]

> IPv4 and IPv6 address

> [none]

Element definition: node-name | [top]

> The node's name

> [none]

Element definition: security-style | [top]

> Effective security style on file Possible values: "security_none" - Security not Set, "security_unix_modebits" - UNIX and UNIX permissions, "security_unix_acl" - UNIX and NFSv4 ACL, "security_unix_sd" - UNIX and NT ACL, "security_mixed_modebits" - MIXED and UNIX permissions, "security_mixed_acl" - MIXED and NFSv4 ACL, "security_mixed_sd" - MIXED and NT ACL, "security_ntfs_modebits" - NTFS and UNIX permissions, "security_ntfs_acl" - NTFS and NT ACL, "security_ntfs_sd" - NTFS and NT ACL, "security_unix" - UNIX, "security_mixed" - MIXED, "security_ntfs" - NTFS, "security_modebits" - UNIX permissions, "security_acl" - ACL, "security_sd" - SD

> [none]

Element definition: vserver-name | [top]

> The name of the Vserver.

> [none]

Element definition: vserverid | [top]

> Vserver Id

> [none]