SMB Share Usage Auditing

[netapp87]

Is there a way to audit the share usage on NetApp ONTAP 9.7? We had a situation that required creating 2 share's pointed to the same path and now we need to remove one of the 2 shares. We are trying to find a way to ensure nobody is using the share before deleting.

For example we have CIFS shares "share1" and "share2" that are both pointed to "/Test". We want to delete "share2", but want to ensure nobody is utilizing "share2" prior to deleting. 

I configured native vserver auditing, but it does not seem to provide the event tracking required to identify this. We can view CIFS session info in real time via the NetApp CLI, but trying to find something that will provide historical data over a period of time.

Any ideas on how we might accomplish this? 

[TMACMD]

I think you are looking for

 cifs session show

 you can use the -fields argument and specify whichever fields you’d like to see

[netapp87]

Yes, we can see what we need using that cli command, but we cant view historical connection data with that, just real time connections. I was hoping to find a solution that would show all CIFS session connection info for past 24 hours. 

[netapp87]

So far best solution we have come up with is to create PowerShell script and gather information from "get-nccifssession" and "get-nccifssessionfile" cmdlets. I configured script to pull data from filer every 10 seconds and export to csv for future analysis, but was wondering if there was anything native that could provide this.