Auditing "change permissions"

connoisseur — Wed, 04 Jun 2025 18:28:05 GMT

Hi there.

I´m trying to accomidate a customer to set up auditing on their SMB vserver.

There are no problem activating it, and it writes to the log file.

But it´s not capturing the event the customer is after.

They want to see if anyone change permission on a folder.

Is that even possible?

As i understand it´s "4670: Permissions on an object were changed" that they need.

I have read tr-4189 and found the list of event IDs the controller is logging.
4670 is not avaialable... but 4663 is and it captures "Read/Write Object Get/Set Object attributes"

Should the "change permission" be available in that eventID, or is it impossible to audit folder permission changes on a NetApp vserver?

(Running cDOT 8.3.1)

topic Auditing "change permissions" in ONTAP Discussions

Auditing "change permissions"