topic Re: Does Netapp track deletions inside a CIFS share in ONTAP Discussions

Does Netapp track deletions inside a CIFS share

mdvillanueva — Wed, 26 Oct 2011 19:47:50 GMT

Hi,

Does Netapp audit file/folder deletions inside a cifs share. We have instance when user would either accidentally move/remove a folder/file and although we can restore using snapshot, we want to know who did it.

Thanks,]

Maico

Does Netapp track deletions inside a CIFS share

scottgelb — Wed, 26 Oct 2011 22:39:30 GMT

Someone correct me if anything has changed, but cifs auditing (off by default) doesn't audit a file deletion. Some of our customers who have required this have tested Varonis (3rd party product that supports NetApp via fpolicy api).

Does Netapp track deletions inside a CIFS share

andrc — Thu, 27 Oct 2011 00:34:49 GMT

I'm pretty sure you can audit file deletions, as stated in this KB you specify groups and events to be audited in the security tab. I seem to remember setting this up in a previous job as important data had been deleted by unknown users a number of times.

Re: Does Netapp track deletions inside a CIFS share

scottgelb — Thu, 27 Oct 2011 01:01:31 GMT

I have used cifs auditing but don’t remember it tracking delete and don’t see it in the kb. It might though… need to test it out and see but I remember something about it logging changes not deletes.

Re: Does Netapp track deletions inside a CIFS share

andrc — Thu, 27 Oct 2011 01:07:52 GMT

I don't remember exactly how as I configured the filer and a Windows admin configured the events to be logged in the security tab, but as I remember once it's configured on the filer there are a number of possible event choices in the security tab, and deletions are one of them.

If I'm wrong I'll put my hand up but I'm pretty sure I remember the Windows guy deleting a test file and it showing up in the .evt audit file

Re: Does Netapp track deletions inside a CIFS share

scottgelb — Thu, 27 Oct 2011 01:50:38 GMT

Per this KB you are right... but I remember seeing an issue with it not logging... I will test later in a VSIM if I get a chance. https://kb.netapp.com/support/index?page=content&id=1010191

Re: Does Netapp track deletions inside a CIFS share

YASIR_IRFAT — Fri, 03 Feb 2012 18:45:05 GMT

Hi,

I had setup auditing for file, add/write/deletion on cifs shares. It does log deletions of files. As deletion comes under "Object-Access", you have to enable it first on filer through,

filer> options cifs.audit.file_access_events.enable on

Then under Folder Properties --> Security tab --> Advanced --> Auditing - Add any user/group you want to audit on the folder and then select access types such as read, list, write, modify, delete etc.. for it.

I have used it and it works fine

Regards,

Yasir Irfat

Re: Does Netapp track deletions inside a CIFS share

enghaug72 — Tue, 22 May 2012 07:40:39 GMT

Hi Yasir.

When I setup as you describe above and select the cifs share/volume I get tons of access denied messages from inside the ~snapshot folder. Which surprises me since folks are taking abourt successfull auditing of the ~snapshot folder in this thread.

When I choose a folder inside the share it allows me to audit that folder. This will be a show stopper for us since the customer has a lot of folders Do you have any thoughts? Am I missing something obvious here..

-Pål-Andre

Re: Does Netapp track deletions inside a CIFS share

columbus_admin — Tue, 22 May 2012 12:21:18 GMT

You cannot audit anything within ~snapshot...that space is 100% read only and auditing requires bits to be flipped by Windows. You can audit Windows files outside ~snapshot, but not within.

- Scott

Re: Does Netapp track deletions inside a CIFS share

DNOINTERNATIONAL — Tue, 22 May 2012 12:40:09 GMT

Thank you for replying Scott!

I solved this by setting the cifs.show_snapshot option to off then from Window:

Auditing is now "on" for the share and all subfolders. cifs.show_snapshot option is again enabeled after all the "bits flipping"

-Pål-Andre

Re: Does Netapp track deletions inside a CIFS share

Harendra — Mon, 27 Jul 2015 01:10:50 GMT

Hi Yasir,

Although I have enabled the audit options and completed all configuration parameters but still I am unable to see the audit tab enabled for me in windows.

could you please help on this.

Thanks in advance.

Re: Does Netapp track deletions inside a CIFS share

JGPSHNTAP — Mon, 27 Jul 2015 12:38:48 GMT

This is pretty straightforward for NTFS auditing on Netapp. Also, unless you are looking for a small sample, native auditing is essentially useless b/c of log rolling....

Re: Does Netapp track deletions inside a CIFS share

ASH2017 — Thu, 21 Jun 2018 09:42:44 GMT

Hi,

I know this is an old post, but can someone point me to steps for auditing : NFS export, without CIFS auditing enabled ?

Thanks,

-Ash

Re: Does Netapp track deletions inside a CIFS share

CHARRE — Fri, 13 Jul 2018 10:29:15 GMT

Hi,

I'am Loic, i have a metrocluster FAS8200 and i activated audit on CIFS Share Volume.

We lose a directory and we found in event log:

System

- Provider

   [ Name] NetApp-Security-Auditing
   [ Guid] {3CB2A168-FE19-4A4E-BDAD-DCF422F13473}

   EventID 9998

   EventName Unlink Object

   Version 101.2

   Source CIFS

   Level 0

Do you know what is this event: Unlink Object ? Do you know what that means ?

Re: Does Netapp track deletions inside a CIFS share

naveens17 — Mon, 16 Jul 2018 18:07:32 GMT

That is what I found in documentation ..

I would suggest integrating ManageEngine + NetApp native auditing can give all the reports and details what your looking for.

NA/NA Data ONTAP Event ID 9998

Unlink Object

OBJECT ACCESS: Object unlinked. This is a Data ONTAP event. It is not currently supported by Windows as a single event.

File Access