mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop

[Ravisagar]

Wed Jan 20 00:26:50 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2021-01-20 00:26:50.
Wed Jan 20 00:26:51 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2021-01-20 00:26:51.
Wed Jan 20 00:26:51 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages transmission resumed.) occurred at 2021-01-20 00:26:51.

ONTAP 9.7, any idea why these messages are seen in EMS?

[paul_stejskal]

It's related to CIFS auditing I believe. I don't see a system with AutoSupports with that host name, where it is enabled. If they were I could check logs.

You might check if "vserver security trace filter show" has any security traces running.

[Ravisagar]

PLEASE NOTE:

All content posted on the NetApp Community is publicly searchable and viewable. Participation in the NetApp Community is voluntary.

In accordance with our Code of Conduct and Community Terms of Use, DO NOT post or attach the following:

• Software files (compressed or uncompressed)
• Files that require an End User License Agreement (EULA)
• Confidential information
• Personal data you do not want publicly available
• Another’s personally identifiable information (PII)
• Copyrighted materials without the permission of the copyright owner

Continued non-compliance may result in NetApp Community account restrictions or termination.

Employees must ensure private information is not being shared in a public category!

-----------------------------------------------------------------------------------------------------------------------------------------------

Hi Paul, I saw this alert and warning, hence changed the hostname a bit, I will ping you the hostname seperately.

[MarinALBULESCU]

@Ravisagardid you find the cause in your case? I have the same issue and discovered some ONTAPI calls from a pii_encrypt tool.