NetApp Community Update
This site will enter Read Only mode on July 23 as we prepare to move to a new platform. You will still be able to view content, but posting and replying will be temporarily disabled.
We're excited to launch our new Community experience on July 30 and more information will follow soon.
Stay connected during the transition - Join our Discord community today.

ONTAP Discussions

NFS audit urgent help needed on 7-mode

ASH2017
5,239 Views

Hi All,

 

Has someone configured native NFS auditing ?

 

According to documents, steps seems straight forward except for point 5 & 6.

https://library.netapp.com/ecmdocs/ECMP1196993/html/GUID-0E810555-2144-4894-80F0-9E3FB33E8755.html

 

I have following setings on my filer for NFS auditing, but no files is being generated.

 

 

cifs.audit.autosave.ontime.enable on
cifs.audit.autosave.ontime.interval 2m
cifs.audit.enable off
cifs.audit.file_access_events.enable on
cifs.audit.liveview.allowed_users
cifs.audit.liveview.enable on
cifs.audit.logon_events.enable on
cifs.audit.logsize 5368709120
cifs.audit.nfs.enable on
cifs.audit.nfs.filter.filename /vol/vol0/etc/log/nfs-audit.txt
cifs.audit.saveas /etc/log/adtlog.evt

 

My questions, can someone helpe me get thsi working ?

 

Thanks,

-Ashwin

1 REPLY 1

marthasimons
4,945 Views

cifs.audit.autosave.ontime.enable on
cifs.audit.autosave.ontime.interval 2m
cifs.audit.enable off
cifs.audit.file_access_events.enable on
cifs.audit.liveview.allowed_users
cifs.audit.liveview.enable on
cifs.audit.logon_events.enable on
cifs.audit.logsize 5368709120
cifs.audit.nfs.enable on
cifs.audit.nfs.filter.filename /vol/vol0/etc/log/nfs-audit.txt
cifs.audit.saveas /etc/log/adtlog.evt

 

Yes it is working

Public