CIFS / NTFS Auditing

[tyrone_owen_1]

Hi,

I am really struggling with the concept of CIFS / NTFS auditing.

'vserver audit command enables or disables auditing, defines log location files, manages log rotation,
and so on.'

The vserver create command also includes the following parameters:

{file-ops|cifs-logon-logoff|cap-staging|file-share|audit-policy-change|user-account|authorization-policy-change|security-group}

The vserver create command seems to include file/folder event logging, so why do I need to then go on to use the 'vserver security file-directory ntfs' commands to create SACLs on files and folders?

Thanks

[hmoubara]

Hello

Can you share which documentation you following when setting up auditing.

Thanks

[tyrone_owen_1]

Hi

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-E31BC272-031E-4933-9892-2C96E77848D6.html

[hmoubara]

Hello,

I am not seeing where in the documentation it is telling you to create SACLs:

vserver security file-directory ntfs ??

You should be able to enable auditing and set it to whatever options you would like the auditing to be logged.

Check the link below:

https://docs.netapp.com/ontap-9/topic/com.netapp.doc.dot-cifs-nfs-audit/GUID-EF25376D-4460-4493-B260-C2FDAAB6B151.html

Thanks 

[tyrone_owen_1]

Hi,

Here:https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-2D266735-3959-4144-8DA9-C068EEBC202E.html&resultof=%22%43%... 

Thanks,

Ty