I build a OnTAP simulator lab server and want to collect audit log...
so I create a CIFS volume to let user place their data (eningeering), the root mount (/) I name is nsroot
create a volume which name is audit...
I create audit role and enable it
(1).vserver audit create -vserver netapp-svm1 -destination "/nsroot/audit" -events file-ops -format xml -rotate-size 10MB -rotate-limit 10
(2).vserver audit enable -vserver netapp-svm1
I try to create a testing on engineer volume and audit volume , and add some content to these files...but the audit xml file seem no detect any change event....
Could I ask when I create such audit role....for my SVM...what scope that audit log could monitor ?? ( root mount / engineering & audit) or only audit volume ??
about file-ops parameter....does it could monitor any file action (create/modity/rename/delete&permission change )??