ONTAP Discussions

Auditing "change permissions"

connoisseur

Hi there.

 

I´m trying to accomidate a customer to set up auditing on their SMB vserver.

 

There are no problem activating it, and it writes to the log file.

But it´s not capturing the event the customer is after.

 

They want to see if anyone change permission on a folder.

Is that even possible?

 

As i understand it´s "4670: Permissions on an object were changed" that they need.

 

I have read tr-4189 and found the list of event IDs the controller is logging.
4670 is not avaialable... but 4663 is and it captures "Read/Write Object Get/Set Object attributes"

 

Should the "change permission" be available in that eventID, or is it impossible to audit folder permission changes on a NetApp vserver?

 

(Running cDOT 8.3.1)

0 REPLIES 0
Announcements
NetApp on Discord Image

We're on Discord, are you?

Live Chat, Watch Parties, and More!

Explore Banner

Meet Explore, NetApp’s digital sales platform

Engage digitally throughout the sales process, from product discovery to configuration, and handle all your post-purchase needs.

NetApp Insights to Action
I2A Banner
Public