Audit log

[SMH]

A customer asked about Audit log.
If I set Auditing in the Security Advanced tab of the window properties, where do the logs go?
Do I create a shared volume so that the logs for each SVM or Share item are recorded?
I would appreciate it if you could tell me about this issue.

[ChLokesh · Accepted solution]

Hello,

I believe you have already done the storage side configuration for this CIFS audit.

https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-KBs/How_to_set_up_NAS_auditing_in_ONTAP_9

You can run a “vserver audit show” to check where the logs are getting stored.

cluster1::> vserver audit show
Vserver     State  Event Types Log Format Target Directory
----------- ------ ----------- ---------- --------------------
vs1         false  file-ops    evtx       /audit_log

You can map the same Target Directory path on to one of your windows clients to access the audit logs.

The audit file gets created automatically within the same vserver while configuraing the audits. 

Hope this information helps.