Network and Storage Protocols

The cifs.audit.enable option is turned off automatically

NAVEENJ
2,814 Views

Hello All,

 

We have been facing logging problem in our netapp (ontap 8.1). CIFS.AUDIT.Enable option gets turned off automatically. I read one of the article, unfortunaltey it doesn't apply to us since we have enough space on our volume. everytime we need to turn on manually this option and it works for few days. Let me know if you need some logs.

 

http://community.netapp.com/t5/Network-Storage-Protocols-Discussions/The-cifs-audit-enable-option-is-turned-off-automatically/td-p/15338?db=5

 

this is our current configuration-

 

options cifs.audit
cifs.audit.account_mgmt_events.enable off
cifs.audit.autosave.file.extension timestamp
cifs.audit.autosave.file.limit 100
cifs.audit.autosave.onsize.enable on
cifs.audit.autosave.onsize.threshold 100%
cifs.audit.autosave.ontime.enable off
cifs.audit.autosave.ontime.interval 5h
cifs.audit.enable on
cifs.audit.file_access_events.enable on
cifs.audit.liveview.allowed_users
cifs.audit.liveview.enable off
cifs.audit.logon_events.enable off
cifs.audit.logsize 268435456
cifs.audit.nfs.enable off
cifs.audit.nfs.filter.filename
cifs.audit.saveas /etc/log/adtlog.evt

 

thanks for your time in advance.

4 REPLIES 4

hariprak
2,792 Views

Hi,

 

This problem occurs when the root volume is full.
Can you please re-confirm the root volume space with the command "df -m vol0"

 

Thanks

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

JGPSHNTAP
2,789 Views

Also, you need to enable auditing on the NTFS side in order to dump to the .evt

NAVEENJ
2,698 Views

thanks. options are already enabled.

NAVEENJ
2,699 Views

Thanks for your reply. here are the results.

 

df -m /vol/root_vol/
Filesystem               total       used      avail capacity  Mounted on
/vol/root_vol/        291840MB    52155MB   239684MB      18%  /vol/root_vol/
/vol/root_vol/.snapshot    15360MB      585MB    14774MB       4%  /vol/root_vol /.snapshot

 

Also, as stated earlier- is happens on random basis. Once we turn on auditing manually, it works fine for few days.

Public