Can CIFS Auditing know who delete or modify file?

AllenChang — Wed, 03 Jul 2024 08:52:56 GMT

I create an audit using this command

vserver audit create -vserver fpsvm1 -destination /vol1/audit_log -events file-ops,cifs-logon-logoff -format evtx -rotate-size 100MB -rotate-limit 0

vserver audit enable -vserver fpsvm1

but when I try to modify and delete the file in share,

I can't see any record

Is the auditing full that I want?

Re: Can CIFS Auditing know who delete or modify file?

ChLokesh — Fri, 05 Jul 2024 18:03:15 GMT

Hello Allen,

Please make sure the following prerequisites are met for the auditing to function smooth.

 CIFS must be licensed and enabled on the storage system before enabling auditing.
 The file or directory to be audited must be in a MIXED or NTFS volume or qtree.
 You cannot audit CIFS events for a file or directory in a UNIX volume or qtree unless Storage-Level Access Guard is enabled.
 You must specify access events to record from windows end (Sacls)
 Event auditing is turned off by default.

topic Can CIFS Auditing know who delete or modify file? in ONTAP Discussions

Can CIFS Auditing know who delete or modify file?

Re: Can CIFS Auditing know who delete or modify file?