topic Re: SMB Share Usage Auditing in ONTAP Discussions

SMB Share Usage Auditing

netapp87 — Wed, 04 Jun 2025 09:41:21 GMT

Is there a way to audit the share usage on NetApp ONTAP 9.7? We had a situation that required creating 2 share's pointed to the same path and now we need to remove one of the 2 shares. We are trying to find a way to ensure nobody is using the share before deleting.

For example we have CIFS shares "share1" and "share2" that are both pointed to "/Test". We want to delete "share2", but want to ensure nobody is utilizing "share2" prior to deleting.

I configured native vserver auditing, but it does not seem to provide the event tracking required to identify this. We can view CIFS session info in real time via the NetApp CLI, but trying to find something that will provide historical data over a period of time.

Any ideas on how we might accomplish this?

Re: SMB Share Usage Auditing

TMACMD — Fri, 02 Feb 2024 13:29:21 GMT

I think you are looking for

cifs session show

you can use the -fields argument and specify whichever fields you’d like to see

Re: SMB Share Usage Auditing

netapp87 — Fri, 02 Feb 2024 13:37:40 GMT

Yes, we can see what we need using that cli command, but we cant view historical connection data with that, just real time connections. I was hoping to find a solution that would show all CIFS session connection info for past 24 hours.

Re: SMB Share Usage Auditing

netapp87 — Fri, 02 Feb 2024 13:49:38 GMT

So far best solution we have come up with is to create PowerShell script and gather information from "get-nccifssession" and "get-nccifssessionfile" cmdlets. I configured script to pull data from filer every 10 seconds and export to csv for future analysis, but was wondering if there was anything native that could provide this.