topic Re: NetApp Log Auditing in ONTAP Discussions

NetApp Log Auditing

InterNetworkingAG — Wed, 04 Jun 2025 10:21:01 GMT

Hi there,

We are facing an issue with our auditing tool. We have an service which is listening has a connection to our NetApp for auditing purpose. As long as we have this service running and the connection is up we get all log messages from the NetApp. This is our connection string: vserver fpolicy engine-connect -vserver *** -policy-name *** -node *** -server ***

But sometimes this service or the server itself need an restart and we would like to buffer the logs.

Is there a possibility to buffer the cifs logs on the NetApp or is there a recommended way to do it?

Thanks for the feedback and regards

Pascal

Re: NetApp Log Auditing

GidonMarcus — Wed, 23 Jun 2021 10:35:56 GMT

You should be able to use the following setting to retain message longer

[-resiliency-max-retention-duration <[<integer>h][<integer>m][<integer>s]>] - Maximum Notification Retention DurationThis parameter specifies the duration for which the notifications are written to files inside the storage controller during network outage. The value for this field must be between 0s and 600s. By default, it is set to 180s.

from

https://docs.netapp.com/ontap-9/topic/com.netapp.doc.dot-cm-cmpr-991/vserver__fpolicy__policy__external-engine__modify.html

Re: NetApp Log Auditing

InterNetworkingAG — Tue, 13 Jul 2021 14:18:14 GMT

Thanks a lot.

Sorry for the late reply i was on vacations.

Re: NetApp Log Auditing

InterNetworkingAG — Mon, 19 Jul 2021 13:44:11 GMT

A got a follow up question.

Even with a 10 minutes buffering from NetApp it could be difficult to gather all auditing logs and we are afraid to loose some logs. How do you solve it? With a backup or write it to a local file? What could be the options for that?

Regards

Pascal

Re: NetApp Log Auditing

Mjizzini — Tue, 20 Jul 2021 10:28:21 GMT

I would recommend connecting one more Fpolicy servers. I will carry the load when needed as well as will be the backup for the primary server.