topic Re: CIFS share auditing for deleting/modifing/moving items in ONTAP Discussions

CIFS share auditing for deleting/modifing/moving items

FelixZhou — Fri, 13 Dec 2019 21:33:42 GMT

on EMC VNX, we can redirect the auditing log to different file system. Not sure if we can do the same on NetApp AFF. we will need to trace the file and folder deleting, modifying and moving actions on CIFS shares. Any sugestions will be appreciated.

thanks

Re: CIFS share auditing for deleting/modifing/moving items

Ontapforrum — Sat, 14 Dec 2019 02:26:44 GMT

For reference:
How to set up CIFS auditing with clustered Data ONTAP
https://kb.netapp.com/app/answers/answer_view/a_id/1030726

FAQ: ONTAP/Data ONTAP Log Overview
https://kb.netapp.com/app/answers/answer_view/a_id/1001023

This is a general audit.log file, it is sent by the AutoSupport tool to the specified recipients. You can also forward the content securely to external destinations that you specify; for example, a Splunk or a syslog server.

Re: CIFS share auditing for deleting/modifing/moving items

FelixZhou — Sun, 15 Dec 2019 17:02:22 GMT

thanks for replay. It looks more on auditing of NetApp user activities rather than on data changes. if any further information on this, please share.

Re: CIFS share auditing for deleting/modifing/moving items

Ontapforrum — Mon, 16 Dec 2019 10:31:05 GMT

I think you are looking for 'file' access events.

There are also 3rd Party FPOLICY servers which is supported with cDOT, which also does the CIFS audit in more depth with a GUI (Front-end app).

FAQ: FPolicy: Auditing
https://kb.netapp.com/app/answers/answer_view/a_id/1000982

More reference material:
Deciding whether to use the SMB/CIFS and NFS Auditing and Security Tracing Guide:
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.cdot-famg-cifs%2FGUID-39EA9A84-7543-4C3E-912E-387F232755F8.html&lang=en

Clustered Data ONTAP CIFS Auditing Quick Start Guide:
https://www.netapp.com/us/media/tr-4189.pdf

https://kb.netapp.com/app/answers/answer_view/a_id/1030726

SMB/CIFS and NFS Auditing and Security Tracing Guide:
https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-01F56118-DE39-4DD0-ACAC-567E394A514A.html&lang=en

Re: CIFS share auditing for deleting/modifing/moving items

liu — Tue, 29 Apr 2025 09:12:20 GMT

There are detailed documents about the audit in this link

How to set up NAS auditing in ONTAP 9 - NetApp Knowledge Base

NAS auditing for CIFS and NFS - FAQ - NetApp Knowledge Base