About Audit Logs (/etc/log/auditlog)

Audit Log logs all administrative actions performed on a filer. You can see Audit Logs in the /etc/log/auditlog file.

Audit Log provides information on actions performed on a filer that helps a system administrator to see what action was performed on the filer, which system was used to perform the action, and who performed the action. As such, Audit Log is also useful for maintaining security.

If the option auditlog.enable is enabled, the system logs all input to the system at the console/telnet shell and sends the input to the Audit Log file via rsh. The data output of the input is also logged in the Audit Log. Administrative servlet invocations (via HTTP, typically from FilerView) and API calls made via the ONTAP interface are also logged in the Audit Log.

By default, Data ONTAP is configured to save an Audit Log. Data ONTAP logs one or more messages for every operation that is performed using telnet, rsh, ssh, filerview, ZAPI, and RLM.

You can specify the maximum size of the Audit Log file using the auditlog.max_file_size option.

Every Saturday at midnight, the /etc/log/auditlog file is copied to /etc/log/auditlog.0, /etc/log/auditlog.0 is copied to /etc/log/auditlog.1, and so on. This also occurs if the Audit Log file reaches the maximum size specified in auditlog.max_file_size.

When you open the Audit Logs page, the auditlog file is displayed by default. You can see the Audit Log file you want (auditlog.1, auditlog.2, and so on) by selecting the respective file from the View File drop-down menu and clicking View.