topic The cifs.audit.enable option is turned off automatically in Network and Storage Protocols

The cifs.audit.enable option is turned off automatically

NAVEENJ — Wed, 04 Jun 2025 22:14:04 GMT

Hello All,

We have been facing logging problem in our netapp (ontap 8.1). CIFS.AUDIT.Enable option gets turned off automatically. I read one of the article, unfortunaltey it doesn't apply to us since we have enough space on our volume. everytime we need to turn on manually this option and it works for few days. Let me know if you need some logs.

http://community.netapp.com/t5/Network-Storage-Protocols-Discussions/The-cifs-audit-enable-option-is-turned-off-automatically/td-p/15338?db=5

this is our current configuration-

options cifs.audit
cifs.audit.account_mgmt_events.enable off
cifs.audit.autosave.file.extension timestamp
cifs.audit.autosave.file.limit 100
cifs.audit.autosave.onsize.enable on
cifs.audit.autosave.onsize.threshold 100%
cifs.audit.autosave.ontime.enable off
cifs.audit.autosave.ontime.interval 5h
cifs.audit.enable on
cifs.audit.file_access_events.enable on
cifs.audit.liveview.allowed_users
cifs.audit.liveview.enable off
cifs.audit.logon_events.enable off
cifs.audit.logsize 268435456
cifs.audit.nfs.enable off
cifs.audit.nfs.filter.filename
cifs.audit.saveas /etc/log/adtlog.evt

thanks for your time in advance.

Re: The cifs.audit.enable option is turned off automatically

hariprak — Wed, 27 Jan 2016 13:02:37 GMT

Hi,

This problem occurs when the root volume is full.
Can you please re-confirm the root volume space with the command "df -m vol0"

Thanks

Re: The cifs.audit.enable option is turned off automatically

JGPSHNTAP — Wed, 27 Jan 2016 14:41:19 GMT

Also, you need to enable auditing on the NTFS side in order to dump to the .evt

Re: The cifs.audit.enable option is turned off automatically

NAVEENJ — Mon, 01 Feb 2016 05:05:44 GMT

Thanks for your reply. here are the results.

df -m /vol/root_vol/
Filesystem               total       used      avail capacity Mounted on
/vol/root_vol/        291840MB    52155MB   239684MB      18% /vol/root_vol/
/vol/root_vol/.snapshot    15360MB      585MB    14774MB       4% /vol/root_vol /.snapshot

Also, as stated earlier- is happens on random basis. Once we turn on auditing manually, it works fine for few days.

Re: The cifs.audit.enable option is turned off automatically

NAVEENJ — Mon, 01 Feb 2016 05:07:00 GMT

thanks. options are already enabled.