Access logs audit

[SVHO]

We would like to start looking at certain shares regarding access,  modify, deletion the files.  The logs should contain one month of data.  Can this be done?

Also, we have a IBM SIEM which the logs could be sent to.   We are on the following version: NetApp Release 9.14.1P6

Thanks,

TT

[chamfer]

Hi @SVHO (TT),

I would start my reading the documents here Learn about auditing file access using ONTAP for both the SMB and NFS protocols .  NAS auditing will meet your requirements for share access, modify, deletion.

Sending NAS logging data to your SIEM needs to be done via a 3rd party collector, NetApp ONTAP cannot send it directly.  I would say that this is by design to reduce computational load on the NetApp, plus your 3rd party collector can do logging transform before you send it.

I hope that this helps.