The cifs.audit.enable option is turned off automatically

[NAVEENJ]

Hello All,

We have been facing logging problem in our netapp (ontap 8.1). CIFS.AUDIT.Enable option gets turned off automatically. I read one of the article, unfortunaltey it doesn't apply to us since we have enough space on our volume. everytime we need to turn on manually this option and it works for few days. Let me know if you need some logs.

http://community.netapp.com/t5/Network-Storage-Protocols-Discussions/The-cifs-audit-enable-option-is-turned-off-automatically/td-p/15338?db=5

this is our current configuration-

options cifs.audit
cifs.audit.account_mgmt_events.enable off
cifs.audit.autosave.file.extension timestamp
cifs.audit.autosave.file.limit 100
cifs.audit.autosave.onsize.enable on
cifs.audit.autosave.onsize.threshold 100%
cifs.audit.autosave.ontime.enable off
cifs.audit.autosave.ontime.interval 5h
cifs.audit.enable on
cifs.audit.file_access_events.enable on
cifs.audit.liveview.allowed_users
cifs.audit.liveview.enable off
cifs.audit.logon_events.enable off
cifs.audit.logsize 268435456
cifs.audit.nfs.enable off
cifs.audit.nfs.filter.filename
cifs.audit.saveas /etc/log/adtlog.evt

thanks for your time in advance.

[hariprak]

Hi,

This problem occurs when the root volume is full.
Can you please re-confirm the root volume space with the command "df -m vol0"

Thanks

[JGPSHNTAP]

Also, you need to enable auditing on the NTFS side in order to dump to the .evt

[NAVEENJ]

thanks. options are already enabled.

[NAVEENJ]

Thanks for your reply. here are the results.

df -m /vol/root_vol/
Filesystem               total       used      avail capacity  Mounted on
/vol/root_vol/        291840MB    52155MB   239684MB      18%  /vol/root_vol/
/vol/root_vol/.snapshot    15360MB      585MB    14774MB       4%  /vol/root_vol /.snapshot

Also, as stated earlier- is happens on random basis. Once we turn on auditing manually, it works fine for few days.