topic Re: Logging/Auditing changes to CIFS shares (add, del, modify, etc) in Network and Storage Protocols

Logging/Auditing changes to CIFS shares (add, del, modify, etc)

GARDINEC_EBRD — Thu, 05 Jun 2025 06:18:20 GMT

HI All,

Sorry, I can't help feeling I should know this, but I just can't find what I'm looking for. We have a number of vfilers providing CIFS file sharing. We have a team of 1st line support people who have rights to create, remove and modify shares via the Windows MMC. I'd like to be able to keep a log of these changes, but I can't seem to find out how/where to do this. I've turned on CIFS audit logging, but only seem to see login/logout events. I've turned on the option cifs.audit.account_mgmt_events.enable, but it doesn't seem to have changed what is logged in the event logs.

Anyone have any clues on this?

Thanks,

Craig

Re: Logging/Auditing changes to CIFS shares (add, del, modify, etc)

scottgelb — Thu, 27 Sep 2012 13:31:35 GMT

Since an ontap command or API, do you see it on the auditlog file?

Re: Logging/Auditing changes to CIFS shares (add, del, modify, etc)

GARDINEC_EBRD — Thu, 27 Sep 2012 14:46:33 GMT

Hi Scott,

Thanks for your reply. Do you mean /etc/log/auditlog? If so, yeah, I checked in there, but didn't see anything relating to the change to the CIFS share either.

Craig

Re: Logging/Auditing changes to CIFS shares (add, del, modify, etc)

scottgelb — Thu, 27 Sep 2012 14:50:17 GMT

Yes… thank you. Does it show in the vfiler /etc/log/auditlog root volume or are you checking vfiler0? I’ll have to test it out too

Re: Logging/Auditing changes to CIFS shares (add, del, modify, etc)

GARDINEC_EBRD — Thu, 27 Sep 2012 14:55:29 GMT

Ah...yes, should have been more specific, sorry. This is in the /etc/log dir of the physical filer (vfiler0). The vfiler's /etc/log dir only contains the *.alf and *.evt files

Re: Logging/Auditing changes to CIFS shares (add, del, modify, etc)

sgrant — Fri, 20 Dec 2013 13:13:40 GMT

Hi Craig, a bit late to the party and hope you've already found the answer, if not then I believe your problem maybe that you need to enable the events to be logged...

This can be completed either via:

The Auditing feature under the Windows Explorer Security tab being enabled within the Windows file system.
Or, using the fsecurity command, but this is at a storage level outside of Windows that can also be applied to the volume or qtree.

Just remember: "Be sure to select only the events that must be audited because selecting too many audit options might affect system performance."

A good TR on the subject is TR-3595 (http://www.netapp.com/us/media/tr-3595.pdf)

Hope that helps.

Cheers,
Grant.