Event log detail displays

How to examine an event in detail

You examine an event in detail by double-clicking it and looking at the resulting event details display. There are the following kinds of event details displays:

Windows file access detail displays

Windows file access detail displays show the following information displayed in the detail screens.

Field Description
Object Server The name of the subsystem server process calling the audit check function. This is always SECURITY, because this is a security log.
Object Type The type of object being accessed.
Object name The name (such as a file name) of the object being accessed.
New Handle ID The new handle identifier of the open object.
Operation ID A unique identifier associating multiple events resulting from a single operation.
Process ID The identifier of the client process accessing the object.
Primary User Name The user name of the user requesting the object access. When impersonation is taking place, this is the user name with which the server process is logged on.
Primary Domain The name of the computer, or SYSTEM if the user identified by Primary User Name is SYSTEM. If the computer is a member of a Windows NT Server domain, this can also be the name of the domain containing the primary user's account.
Primary Logon ID A unique identifier assigned when the primary user logged on.
Object User Name Your login.
Client Domain The name of your computer or the domain containing the client user's account.
Client Logon ID A unique identifier assigned when the client user logged on.
Accesses The types of accesses to the object that were attempted.
Privileges Your privileges.

UNIX file access detail displays

UNIX file access detail displays show the same kind of information as the Windows file access event detail screens, but instead of an object name, NFS access appears because the file is being accessed through NFS. In addition, UNIX file access detail displays show the following information about the file that you are monitoring:

This information enables you to find the file using the ls -i command.

Unsuccessful file access detail display

An unsuccessful file access detail display appears when a user could not access a file. For example, an unsuccessful file access occurs when a user tries to access a file but does not have permission to access it.

The display shows the ID of the user who tried to access the file and an indication that the access attempt was unsuccessful.

Lost record event detail display

If the system could not create an audit record, the Lost record event detail display gives a reason, such as the following reason:

Internal resources allocated for the queueing of audit messages 
have been exhausted, leading to the loss of some audits.

      Number of audit records discarded:           1

Copyright © 1999, Network Appliance, Inc. All rights reserved.

Part No. 210-02334
File: cifs18.htm
Last updated: 02/24/99 12:16:32