Hello,
We are using the below settings to enable cifs logging. The events are stored in a .evt file which you could open with your Windows event viewer.
options auditlog.enable on
options auditlog.max_file_size 10000000
options nfs.mountd.trace on
options cifs.audit.enable on
options cifs.audit.autosave.ontime.enable on
options cifs.audit.autosave.ontime.interval 7d
options cifs.audit.autosave.file.limit 12
options cifs.audit.saveas /vol/LOG/auditlog.evt
options cifs.audit.logsize 1073741824
options cifs.audit.autosave.onsize.threshold 10m
options cifs.audit.account_mgmt_events.enable on
options cifs.audit.logon_events.enable on
options cifs.audit.file_access_events.enable off
options cifs.audit.liveview.enable off
options ndmpd.connectlog.enabled on
