topic Re: CIFS Audit log forwarding to Splunk Server in ONTAP Discussions

CIFS Audit log forwarding to Splunk Server

StorageIT — Wed, 04 Jun 2025 10:03:05 GMT

Hello Community We want to check which client IPs access a Cifs share and map/check the whole stuff in Splunk. Is a CIFS audit log forward to a Splunk server possible? If yes how? Any Documentation available how to configure? I find in the NetApp documentation only general information about the "audit" log forwarding but not explicitly about the CIFS audit. If it is not possible via Splunk, what solution does NetApp offer here? Many Thanks in advance. Juergen

Re: CIFS Audit log forwarding to Splunk Server

aladd — Tue, 22 Mar 2022 01:55:43 GMT

You can forward CIFS audit logs to a syslog server. The following may be helpful in the needed configuration:

https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_manage_administrative_Vserver_audit_logs_in_ONTAP_9

https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_set_up_CIFS_auditing_with_clustered_Data_ONTAP

https://docs.netapp.com/us-en/ontap/system-admin/changes-audit-logging-ontap-9-concept.html

https://docs.netapp.com/us-en/ontap/system-admin/forward-command-history-log-file-destination-task.html

Re: CIFS Audit log forwarding to Splunk Server

STORAGE_CIT — Tue, 22 Mar 2022 09:01:39 GMT

Thanks. Yes for the normal "audit" log its clear. it will use the syslog framework.

My Question was regarding "cifs audit" logs and forward directly into Splunk for parsing.

Re: CIFS Audit log forwarding to Splunk Server

aladd — Tue, 22 Mar 2022 09:33:54 GMT

Correct. CIFS audit logs cannot be pushed to another server, only accessed through a CIFS share.

Reference from documentation:

https://www.netapp.com/pdf.html?item=/media/16330-tr-4189pdf.pdf

Pg. 12