2011-08-09 06:23 AM
If I miss some files in /etc/log/, for example if I have auditlog, auditlog.0 and auditlog.5 should I be worried about that or has it just been very quiet and nothing has happened? I expect the system to create empty files even if nothing happens so that I can know that nothing happened but don't know for sure if NetApps do. There are an actual gap in dates in the files too.
Kristoffer & Ben
2011-08-09 05:17 PM
I'm not aware of any reason why that would happen. I would keep monitor the situation and if logfiles continue to disappear or fail to generate in the first place I would open a Tech Support case with the GSC.
It's also worthwhile checking the share/export permissions on C$, ETC$ and /vol/<rootvol> to ensure someone isn't accessing and messing around with things they shouldn't be....