We are facing an issue with our auditing tool. We have an service which is listening has a connection to our NetApp for auditing purpose. As long as we have this service running and the connection is up we get all log messages from the NetApp. This is our connection string: vserver fpolicy engine-connect -vserver *** -policy-name *** -node *** -server ***
But sometimes this service or the server itself need an restart and we would like to buffer the logs.
Is there a possibility to buffer the cifs logs on the NetApp or is there a recommended way to do it?
You should be able to use the following setting to retain message longer
[-resiliency-max-retention-duration <[<integer>h][<integer>m][<integer>s]>] - Maximum Notification Retention DurationThis parameter specifies the duration for which the notifications are written to files inside the storage controller during network outage. The value for this field must be between 0s and 600s. By default, it is set to 180s.
Even with a 10 minutes buffering from NetApp it could be difficult to gather all auditing logs and we are afraid to loose some logs. How do you solve it? With a backup or write it to a local file? What could be the options for that?