Event auditing

You can audit file access events

Data ONTAP enables you to monitor reads and writes of a specified file on the filer by a specified user. The procedure for doing so is the same as for Windows NT.

Note: The file on the filer must be in a mixed or ntfs volume or qtree. You cannot audit events on a file in a UNIX volume or qtree.

You can specify the logging of successes, failures, or both for each type of event as described in "Setting a system ACL on a file." You can view the events on the filer using the Windows Event Viewer, as described in "Viewing events in a security log."

Why use event auditing

You use event auditing to troubleshoot access problems, to check for suspicious activity on a system, or to investigate a security breach.

If someone who should have access to a file cannot get access, examining the event can provide a clue to resolving the problem.
If a file has been changed in a way that indicates a security breach, event auditing might provide clues about the nature of the breach if subsequent changes occur.

Active event log naming

The active event log is the file to which system writes access logging information. The default active event log is /etc/log/adtlog.evt. You can specify another active event log with the cifs.access_logging.filename option. You can change active event logs at any time. The other logs remain available for reading until you delete them.

Log access

Anyone can read an event log. You cannot write to an event log or clear one, but you can delete one.

Part No. 210-02334
File: cifs17.htm
Last updated: 02/24/99 12:16:32