Subscribe
Accepted Solution

How find the cifs audit logs?

we got request form user to increase the space for the share drive.  we don't have space in aggregate. so we reduce the snap reserve space for the volume. 

After 2 days we got one more request from user  it seems as though since the capacity has been increased for the below share drive, people are now noticing that some of their information is missing.

1. Is there any effect to reduce the snap reserve space on user data?

2. How find the who his delete the folders in share drive?

3.  I checked the rdfile /etc/log/audit

usdanrmmd1na006> rdfile /etc/log/auditlog.1

Sun Mar 23 04:07:55 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Sun Mar 23 04:07:55 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sun Mar 23 04:07:56 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sun Mar 23 16:50:47 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Sun Mar 23 16:50:47 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sun Mar 23 16:50:47 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Mon Mar 24 04:08:21 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Mon Mar 24 04:08:21 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Mon Mar 24 04:08:21 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Mon Mar 24 16:48:53 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Mon Mar 24 16:48:54 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Mon Mar 24 16:48:54 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Tue Mar 25 04:07:46 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Tue Mar 25 04:07:46 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Tue Mar 25 04:07:47 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Tue Mar 25 14:36:33 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_52751]:password

Tue Mar 25 14:36:39 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:cifs shares

Tue Mar 25 14:36:50 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:cifs shares MS112Home

Tue Mar 25 14:37:01 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:cifs sessions show

Tue Mar 25 14:38:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:vol status /vol/philips_vol013_cifs_MS112Home/MS112HomeQT

Tue Mar 25 14:39:00 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:vol status /vol/philips_vol013_cifs_MS112Home/

Tue Mar 25 14:39:10 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snap list /vol/philips_vol013_cifs_MS112Home/MS112HomeQT

Tue Mar 25 14:39:26 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snap list philips_vol013_cifs_MS112Home

Tue Mar 25 14:40:00 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snapvault status /vol/philips_vol013_cifs_MS112Home/MS112HomeQT

Tue Mar 25 14:40:18 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:snapmirror:snapmirror status

Tue Mar 25 14:41:08 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snapvault snap sched /vol/philips_vol013_cifs_MS112Home/MS112HomeQT

Tue Mar 25 14:41:38 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:snapvault snap sched philips_vol013_cifs_MS112Home

Tue Mar 25 15:09:34 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:

Tue Mar 25 15:09:35 EDT last message repeated 4 times

Tue Mar 25 15:09:40 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_52751]:IN:console shell:exportfs

Tue Mar 25 15:36:06 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_52751]:END:ssh2 shell:

Tue Mar 25 15:50:01 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_53400]:password

Tue Mar 25 15:50:03 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_53400]:IN:console shell:exit

Tue Mar 25 15:50:06 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_53400]:END:ssh2 shell:

Tue Mar 25 16:50:36 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Tue Mar 25 16:50:37 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Tue Mar 25 16:50:37 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Wed Mar 26 04:08:09 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Wed Mar 26 04:08:09 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Wed Mar 26 04:08:09 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Wed Mar 26 09:41:55 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_58014]:password

Wed Mar 26 09:41:59 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h

Wed Mar 26 09:42:23 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:cifs shares share5$

Wed Mar 26 09:43:16 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share5

Wed Mar 26 09:43:30 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share5

Wed Mar 26 09:43:37 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share5 15

Wed Mar 26 09:43:42 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share5

Wed Mar 26 09:43:52 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share5

Wed Mar 26 09:45:14 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:cifs shares

Wed Mar 26 09:46:27 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share6

Wed Mar 26 09:46:44 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share6

Wed Mar 26 09:46:48 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share6 15

Wed Mar 26 09:46:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:snap reserve Share6

Wed Mar 26 09:47:00 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:df -h Share6

Wed Mar 26 10:02:10 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:

Wed Mar 26 10:02:10 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:

Wed Mar 26 10:02:13 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58014]:IN:console shell:exit

Wed Mar 26 10:02:15 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_58014]:END:ssh2 shell:

Wed Mar 26 10:07:26 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_58450]:password

Wed Mar 26 10:07:30 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58450]:IN:console shell:df -h

Wed Mar 26 10:33:08 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_58450]:IN:console shell:exit

Wed Mar 26 10:33:10 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_58450]:END:ssh2 shell:

Wed Mar 26 14:23:33 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_61656]:password

Wed Mar 26 14:23:38 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell:exportfs

Wed Mar 26 15:08:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell:

Wed Mar 26 15:08:53 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell:

Wed Mar 26 15:08:56 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61656]:IN:console shell:exit

Wed Mar 26 15:09:00 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_61656]:END:ssh2 shell:

Wed Mar 26 16:31:20 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_63208]:password

Wed Mar 26 16:31:24 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:date

Wed Mar 26 16:31:28 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:cifs shares

Wed Mar 26 16:31:43 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:snapvault status /vol/philips_vol013_cifs_MS112Home/MS112HomeQT

Wed Mar 26 16:32:02 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:sanpvault status

Wed Mar 26 16:32:12 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:snapvault:snapvault status

Wed Mar 26 16:32:16 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:

Wed Mar 26 16:32:35 EDT last message repeated 4 times

Wed Mar 26 16:32:39 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:snapvault:snapvault

Wed Mar 26 16:33:01 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:

Wed Mar 26 16:33:07 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:snap:snap list

Wed Mar 26 16:40:42 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:

Wed Mar 26 16:40:43 EDT last message repeated 3 times

Wed Mar 26 16:40:44 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_63208]:IN:console shell:exit

Wed Mar 26 16:40:46 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_63208]:END:ssh2 shell:

Wed Mar 26 16:49:50 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Wed Mar 26 16:49:51 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Wed Mar 26 16:49:51 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Thu Mar 27 04:07:36 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Thu Mar 27 04:07:37 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Thu Mar 27 04:07:37 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Thu Mar 27 12:57:17 EDT [usdanrmmd1na006: HTTPPool00:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 12:57:22 EDT [usdanrmmd1na006: HTTPPool03:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 12:57:28 EDT [usdanrmmd1na006: HTTPPool01:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 12:57:32 EDT [usdanrmmd1na006: HTTPPool04:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 12:57:35 EDT [usdanrmmd1na006: HTTPPool00:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 12:57:37 EDT [usdanrmmd1na006: HTTPPool03:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 13:39:03 EDT [usdanrmmd1na006: HTTPPool00:debug]: admin:AUTH:error:Login failed for an unknown user from IP 149.59.23.178. reason "User does not exist"

Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: HTTPPool02:debug]: sysadm:HTTP:/na_admin/

Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: rshd_0:debug]: sysadm:START:rsh shell:[127.0.0.1_59755]

Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: rshd_0:debug]: sysadm@[127.0.0.1_59755]:IN:rsh shell:RSH INPUT COMMAND is priv set -q admin ; version

Thu Mar 27 13:39:22 EDT [usdanrmmd1na006: rshd_0:debug]: sysadm@[127.0.0.1_59755]:END:rsh shell:

Thu Mar 27 13:43:17 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.142_63766]:password

Thu Mar 27 13:43:37 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs share Share1$

Thu Mar 27 13:43:42 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs share Share1

Thu Mar 27 13:43:55 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs shares Share1$

Thu Mar 27 13:44:17 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:df -h /vol/Share1/Share1QT

Thu Mar 27 13:45:19 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:cifs shares Share6$

Thu Mar 27 13:45:31 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.142_63766]:IN:console shell:exit

Thu Mar 27 13:45:34 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.142_63766]:END:ssh2 shell:

Thu Mar 27 13:57:27 EDT [usdanrmmd1na006: sshd_1:debug]: sysadm:START:ssh2 shell:[161.88.16.141_64926]:password

Thu Mar 27 13:57:48 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_64926]:IN:console shell:cifs shares Share1$

Thu Mar 27 13:58:08 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_64926]:IN:console shell:snapvault status /vol/Share1/

Thu Mar 27 13:58:26 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_64926]:IN:console shell:snapvault status /vol/Share1/Share1QT

Thu Mar 27 14:57:19 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_64926]:END:ssh2 shell:

Thu Mar 27 16:50:32 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Thu Mar 27 16:50:32 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Thu Mar 27 16:50:32 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Fri Mar 28 04:08:34 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Fri Mar 28 04:08:34 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Fri Mar 28 04:08:35 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Fri Mar 28 16:50:09 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Fri Mar 28 16:50:10 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Fri Mar 28 16:50:10 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sat Mar 29 04:08:06 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Sat Mar 29 04:08:06 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sat Mar 29 04:08:06 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sat Mar 29 16:49:55 EDT [usdanrmmd1na006: sshd_0:debug]: code1\usdanrmmd1-sys97:AUTH:error:Login failed for user code1\usdanrmmd1-sys97 from IP 149.59.162.147. reason "User not authenticated"

Sat Mar 29 16:49:55 EDT [usdanrmmd1na006: sshd_1:debug]: pmsadmin:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sat Mar 29 16:49:56 EDT [usdanrmmd1na006: sshd_2:debug]: control:AUTH:error:Login failed for an unknown user from IP 149.59.162.147. reason "User does not exist"

Sat Mar 29 23:22:12 EDT [usdanrmmd1na006: sshd_0:debug]: sysadm:START:ssh2 shell:[161.88.16.141_61523]:password

Sat Mar 29 23:22:43 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:snapmirror status

Sat Mar 29 23:22:49 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:snapvault status

Sat Mar 29 23:22:56 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:qtree status

Sat Mar 29 23:25:03 EDT [usdanrmmd1na006: rc:debug]: sysadm@[161.88.16.141_61523]:IN:console shell:exit

Sat Mar 29 23:25:06 EDT [usdanrmmd1na006: telnet_0:debug]: sysadm@[161.88.16.141_61523]:END:ssh2 shell:

Please help us on this.. User is blaming me .. how can i prove there is no problem from our end.

Re: How find the cifs audit logs?

There is no CIFS auditing unless you enabled it.  The default is off.  You can check this by typing options cifs.audit.enable to see if it's on or off.

Re: How find the cifs audit logs?

It is on only.

Is there any effect to reduce the snap reserve space

Re: How find the cifs audit logs?

Reducing the aggregate or volume snap reserve space should not cause you to lose files.

Re: How find the cifs audit logs?

Snap reserve is space reserved for snapshot so there is no point that reducing it cause data loss .

Secondly as a storage admin you cant find who has deleted the file on share level because you dont have any auditing for this .

If the user is complaining for data loss check for snapshot and try to restore.