After the 'vserver audit create' command, I noticed the following event messages logged.
wafl.vol.create.clusterVolOnCFOaggr: Creating volume 'MDV_aud_b8bc6ea641ea5b21ac25bf731b9657d' on an aggregate with a CFO HA policy. File access delays will occur for a period following giveback.
Then noticed an MDV volume like the one referenced above was created on all aggrs including the root aggrs. I am guessing this is the reason for the warning being on a CFO Aggr.
Am I missing a step? Should I be concerned about this warning? I want to enable auditing, but I don't really want the MDV volume on the root aggr, or to cause file access delays. Should I be concerned by this configuration?
Thank you for the reply. I agree with your explanation. What throws me off is the message is an error severity, because we are creating a volume on a CFO aggr which OnTap doesn't want, but by design, OnTap creates the MDV volume on a CFO aggr.
From the link you provided, I see that it says, one staging volume per-aggregate. So I will take this as NetApp understands that they are creating a scenario where file access will be delayed during giveback by enabling auditing?
Have you, or anyone else out there enabled auditing and experienced issues? I enabled on secondary and tertiary arrays, but not on prod yet.