Cataloging Software / what files are deleted - Solution wanted

[forum-netapp-co]

Our 7-mode netapp has very poor solutions to find out, who has delete a file on a SMB Share. Also netapp has no software solution to indexing / catalog the files on a daily basis so I could take a look to older states of our files to find out - what files are disappeard.

Until now I found only 1 software Solution, which could make us happy. Its from Jam Software SpaceObServer. Sadly the software runs not stable. Maybe we have to much files (ca. 3.000.000) We tested it in Windows 10 / Server 2016 with mysql, mssql - no way the software is to buggy.

Is there a Software-Solution known like SpaceObServer but working also with large amount of files?

The simple Solution wie need ist only a daily list, what files are delated on the shares.

It seams netapp has no big focus on enterprise, because they have no solution out of the box.

[sgrant]

Hello, You have the ability in Data ONTAP to audit events on the controller. These are stored in the /etc/logs folder in a .EVT format, meaning they are viewable by Windows Event Viewer. Once enabled they are written by default every day, unless they fill before.

Please see:

How to set up CIFS auditing on the controller: https://kb.netapp.com/support/s/article/how-to-set-up-cifs-auditing-on-the-controller
How to set up file level auditing for deleted files: https://kb.netapp.com/support/s/article/how-to-set-up-file-level-auditing-for-deleted-files

However, please be aware of the possible performance impact:

Warning: be cautious of setting the log file size high and then setting cifs.audit.liveview.enable to on. The conversion process of the log file to .evt format can cause CIFS performance penalty.

Also,

Too many CIFS audit files degrade performance: https://kb.netapp.com/support/s/article/too-many-cifs-audit-files-degrade-performance

You can also consider utilising the fPolicy feature, see page 160 of the Data ONTAP 8.2 File Access and Protocols Management Guide For 7-Mode:
https://library.netapp.com/ecm/ecm_download_file/ECMP1401220. Where You can use FPolicy to allow partner applications connected to your storage systems to monitor and set file access permissions.

Hope the info helps.

Thanks,

Grant.

[forum-netapp-co]

Hi - yes we have activated the auditing in .evt Files. Our distributor said, the netapp box could only log anything (read, write, deleteing) and not only the deletion of files. So the evtl are almost useless. Better than nothing - but in practice not usable.

So you know a good cataloging third-party Software?

[sgrant]

Please see our list of supported vendors:

https://kb.netapp.com/support/s/article/what-are-the-fpolicy-partner-solutions-for-clustered-data-ontap?language=en_US

Cheers,

Grant.