Enable CIFS auditing - GiveBack delay Event Message

[DONBARTON1]

I am testing enabling CIFS auditing. 

After the 'vserver audit create' command, I noticed the following event messages logged. 

wafl.vol.create.clusterVolOnCFOaggr: Creating volume 'MDV_aud_b8bc6ea641ea5b21ac25bf731b9657d' on an aggregate with a CFO HA policy. File access delays will occur for a period following giveback.

Then noticed an MDV volume like the one referenced above was created on all aggrs including the root aggrs.  I am guessing this is the reason for the warning being on a CFO Aggr. 

Am I missing a step?  Should I be concerned about this warning?  I want to enable auditing, but I don't really want the MDV volume on the root aggr, or to cause file access delays.  Should I be concerned by this configuration?

Thanks in advance!

[aladd]

The MDV volumes are normal to be distributed across  the cluster as such.

The message displayed is only a notification that it has created the volume for auditing purposes, and that file access during giveback operations may be delayed for a short period.

You can find additional information here:

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-EA958194-3CE9-4022-B6CD-A66E263FD4F8.html&resultof=%22%6d%...

[DONBARTON1]

Thank you for the reply.  I agree with your explanation.  What throws me off is the message is an error severity, because we are creating a volume on a CFO aggr which OnTap doesn't want, but by design, OnTap creates the MDV volume on a CFO aggr.  

From the link you provided, I see that it says, one staging volume per-aggregate.  So I will take this as NetApp understands that they are creating a scenario where file access will be delayed during giveback by enabling auditing?

Have you, or anyone else out there enabled auditing and experienced issues?  I enabled on secondary and tertiary arrays, but not on prod yet.

[aladd · Accepted solution]

Hi @DONBARTON1 ,

That's correct the acknowledgement is to the file access delay.

Concerning enabling Auditing, aside from the previously stated, it would be a good idea to keep an eye on aggregate space available, but this is part of normal storage administration already.