The transition to NetApp MS Azure AD B2C is complete. If you missed the pre-registration, you will be invited to reigister at next log in.
Please note that access to your NetApp data may take up to 1 hour.
To learn more, read the FAQ and watch the video.
Need assistance? Complete this form and select “Registration Issue” as the Feedback Category.

ONTAP Discussions

NFS AUDIT LOG ENABLING

Netapp_maniac

Hello Folks ,

 

Can someone guide how to enable audit logs for CIFS shares  on Ontap CVO ?

Do it has to be NFS/CIFS audit enabling ? It is different for NFS and CIFS ?

 

 

Thanks in Advance !

 

1 ACCEPTED SOLUTION

Fabian1993

Depends on the System that you want to use to viewing the logs..

 

You can mount the volume to look into the logfiles..

View solution in original post

11 REPLIES 11

Reverett

Hello,

 

The below kb document has great step by step instructions as well as examples for what different types of audits would look like:

 

https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_enable_auditing_of_NFS_events_on_clustered_Data_ONTAP

 

 

FelixZhou

CIFS/NFS auditing is not enabled by default, you have to enable it on each SVM, as best practice, redirect the audit log to a different small volume, set up log size and rotation.  for CIFS, you can use Window evnetviewer to trace the logs.

For detailed audit request, third party auditing application is required since by native, either NetApp or windows doesn't have enough function/convince to audit CIFS shares.

Netapp_maniac

I have an issue here , when enabled audit log for ntfs clients . I am able to access share(\auditlog) from client machine but unable to view from the logs from eventviewer. when i am trying to open , it says "A device attached to the system is not functioning "

 

Thanks in advance 

Fabian1993

Hey Dude,

 

the Guide what you are looking for is this: https://docs.netapp.com/ontap-9/topic/com.netapp.doc.dot-cifs-nfs-audit/home.html , but are you using CVO Service or the fully CVO?

Netapp_maniac

Could you please help me understand what will be the unix path name as per below command :

 

vserver audit create -vserver <vserver> -destination <unix path> -rotate-size <size>

 

Thanks !!

Fabian1993

You have to create a volume for the log. Than you have to mount the Volume under junction path.

Example for the Command

vserver audit create -vserver vs1 -destination /audit_log

 

 

Netapp_maniac

Volume security style has to be NTFS OR UNIX ?

So will the logs be available in windows/unix machine when the volume is mounted to it ?

 

Thanks !!

Fabian1993

Depends on the System that you want to use to viewing the logs..

 

You can mount the volume to look into the logfiles..

View solution in original post

Netapp_maniac

How can i view logs from unix machine using windows event viewer ?

FelixZhou

you have to install NFS client for Windows to review any NFS export.

Netapp_maniac

Thank you ! This has helped me 🙂

Announcements
NetApp on Discord Image

We're on Discord, are you?

Live Chat, Watch Parties, and More!

Explore Banner

Meet Explore, NetApp’s digital sales platform

Engage digitally throughout the sales process, from product discovery to configuration, and handle all your post-purchase needs.

NetApp Insights to Action
I2A Banner
Public