ONTAP Discussions

mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop

Ravisagar
2,978 Views
Wed Jan 20 00:26:50 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2021-01-20 00:26:50.
Wed Jan 20 00:26:51 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2021-01-20 00:26:51.
Wed Jan 20 00:26:51 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages transmission resumed.) occurred at 2021-01-20 00:26:51.

ONTAP 9.7, any idea why these messages are seen in EMS?

3 REPLIES 3

paul_stejskal
2,933 Views

It's related to CIFS auditing I believe. I don't see a system with AutoSupports with that host name, where it is enabled. If they were I could check logs.

 

You might check if "vserver security trace filter show" has any security traces running.

Ravisagar
2,930 Views

PLEASE NOTE:

All content posted on the NetApp Community is publicly searchable and viewable. Participation in the NetApp Community is voluntary.

In accordance with our Code of Conduct and Community Terms of Use, DO NOT post or attach the following:

  • Software files (compressed or uncompressed)
  • Files that require an End User License Agreement (EULA)
  • Confidential information
  • Personal data you do not want publicly available
  • Another’s personally identifiable information (PII)
  • Copyrighted materials without the permission of the copyright owner

Continued non-compliance may result in NetApp Community account restrictions or termination.

Employees must ensure private information is not being shared in a public category!

 

-----------------------------------------------------------------------------------------------------------------------------------------------

Hi Paul, I saw this alert and warning, hence changed the hostname a bit, I will ping you the hostname seperately.

MarinALBULESCU
2,464 Views

@Ravisagardid you find the cause in your case? I have the same issue and discovered some ONTAPI calls from a pii_encrypt tool.

Public