topic Re: Enable CIFS auditing - GiveBack delay Event Message in ONTAP Discussions

Enable CIFS auditing - GiveBack delay Event Message

DONBARTON1 — Wed, 04 Jun 2025 10:21:01 GMT

I am testing enabling CIFS auditing.

After the 'vserver audit create' command, I noticed the following event messages logged.

wafl.vol.create.clusterVolOnCFOaggr: Creating volume 'MDV_aud_b8bc6ea641ea5b21ac25bf731b9657d' on an aggregate with a CFO HA policy. File access delays will occur for a period following giveback.

Then noticed an MDV volume like the one referenced above was created on all aggrs including the root aggrs. I am guessing this is the reason for the warning being on a CFO Aggr.

Am I missing a step? Should I be concerned about this warning? I want to enable auditing, but I don't really want the MDV volume on the root aggr, or to cause file access delays. Should I be concerned by this configuration?

Thanks in advance!

Re: Enable CIFS auditing - GiveBack delay Event Message

aladd — Tue, 22 Jun 2021 04:13:22 GMT

The MDV volumes are normal to be distributed across the cluster as such.

The message displayed is only a notification that it has created the volume for auditing purposes, and that file access during giveback operations may be delayed for a short period.

You can find additional information here:

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-EA958194-3CE9-4022-B6CD-A66E263FD4F8.html&resultof=%22%6d%64%76%22%20

Re: Enable CIFS auditing - GiveBack delay Event Message

DONBARTON1 — Tue, 22 Jun 2021 12:46:46 GMT

Thank you for the reply. I agree with your explanation. What throws me off is the message is an error severity, because we are creating a volume on a CFO aggr which OnTap doesn't want, but by design, OnTap creates the MDV volume on a CFO aggr.

From the link you provided, I see that it says, one staging volume per-aggregate. So I will take this as NetApp understands that they are creating a scenario where file access will be delayed during giveback by enabling auditing?

Have you, or anyone else out there enabled auditing and experienced issues? I enabled on secondary and tertiary arrays, but not on prod yet.

Re: Enable CIFS auditing - GiveBack delay Event Message

aladd — Wed, 23 Jun 2021 01:03:43 GMT

Hi @DONBARTON1 ,

That's correct the acknowledgement is to the file access delay.

Concerning enabling Auditing, aside from the previously stated, it would be a good idea to keep an eye on aggregate space available, but this is part of normal storage administration already.