topic Forwarding CIFS Audit logs to splunk server in ONTAP Discussions

Forwarding CIFS Audit logs to splunk server

Prudhviraj17 — Wed, 04 Jun 2025 09:43:53 GMT

Is there a possibility to forward the CIFS audit logs to Splunk? I know NetApp does not have a capability to send the logs to Splunk.
i have tried couple of options like making a hard link of audit logs share in windows server as a folder and tried to forward from there to Splunk but the result was negative. Splunk is unable to pull the logs.
Tried with NFS as well but the result remain same.

Can someone help me if there are any options to try?

Re: Forwarding CIFS Audit logs to splunk server

Ontapforrum — Wed, 08 Nov 2023 10:46:27 GMT

Have a look at the following thread:

1) CIFS audit logs cannot be pushed to another server, only accessed through a CIFS share.

2) You can forward CIFS audit logs to a syslog server.

https://community.netapp.com/t5/ONTAP-Discussions/CIFS-Audit-log-forwarding-to-Splunk-Server/td-p/433210#:~:text=Correct.,accessed%20through%20a%20CIFS%20share