ONTAP Discussions

Enable CIFS auditing - GiveBack delay Event Message

DONBARTON1

I am testing enabling CIFS auditing. 

 

After the 'vserver audit create' command, I noticed the following event messages logged. 

 

wafl.vol.create.clusterVolOnCFOaggr: Creating volume 'MDV_aud_b8bc6ea641ea5b21ac25bf731b9657d' on an aggregate with a CFO HA policy. File access delays will occur for a period following giveback.

 

Then noticed an MDV volume like the one referenced above was created on all aggrs including the root aggrs.  I am guessing this is the reason for the warning being on a CFO Aggr. 

 

Am I missing a step?  Should I be concerned about this warning?  I want to enable auditing, but I don't really want the MDV volume on the root aggr, or to cause file access delays.  Should I be concerned by this configuration?

 

Thanks in advance!

3 REPLIES 3

Re: Enable CIFS auditing - GiveBack delay Event Message

aladd

The MDV volumes are normal to be distributed across  the cluster as such.

 

The message displayed is only a notification that it has created the volume for auditing purposes, and that file access during giveback operations may be delayed for a short period.

 

You can find additional information here:

 

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-EA958194-3CE9-4022-B6CD-A66E263FD4F8.html&resultof=%22%6d%...

Re: Enable CIFS auditing - GiveBack delay Event Message

DONBARTON1

Thank you for the reply.  I agree with your explanation.  What throws me off is the message is an error severity, because we are creating a volume on a CFO aggr which OnTap doesn't want, but by design, OnTap creates the MDV volume on a CFO aggr.  

 

From the link you provided, I see that it says, one staging volume per-aggregate.  So I will take this as NetApp understands that they are creating a scenario where file access will be delayed during giveback by enabling auditing?

 

Have you, or anyone else out there enabled auditing and experienced issues?  I enabled on secondary and tertiary arrays, but not on prod yet.

Re: Enable CIFS auditing - GiveBack delay Event Message

aladd

Hi @DONBARTON1 ,

 

That's correct the acknowledgement is to the file access delay.

 

Concerning enabling Auditing, aside from the previously stated, it would be a good idea to keep an eye on aggregate space available, but this is part of normal storage administration already.

View solution in original post

NetApp Insights to Action
I2A Banner
All Community Forums
Public