You can save the audit event information in the internal cifsaudit.alf file to the external event log file either manually or automatically. You can also specify a maximum size for the cifsaudit.alf file.
To manually save audit events to the event log file, complete the following steps.
| 1 | ||
Go to Step 3. |
||
Go to Step 2. |
||
| 2 |
options cifs.audit.saveas filename filename is the complete path name of the file to which Data ONTAP logs audit event information. Use .evt as the file extension. Use quotes around path names that contain a space. Examplesoptions cifs.audit.saveas /etc/log/mylog.evt options cifs.audit.saveas "/home/my event log/audit.evt" |
|
| 3 | Enter the following command to update the event log. cifs audit save [ -f ] Omit the -f option if the event log does not exist. Use the -f option to overwrite the existing event log. ResultData ONTAP writes to the event log the event information gathered since the last event log update. |
|
You can specify that audit events are automatically saved to the event log based on one or both of the following:
If you specify both a size threshold and a time interval, audit events will be saved to the event log whenever either the size threshold or the time interval is reached.
To enable or disable automatic saves based on the size of the internal log file, complete the following step.
| 1 |
options cifs.audit.autosave.onsize.enable on | off |
If you have enabled automatic saves based on the size of the internal log file, you can specify the size threshold. The default size threshold for the internal log file is 75%, so that whenever the internal log file is 75% full, the contents are automatically saved to the external event file. You can specify the threshold as a percentage of the size of the internal log file or as an absolute size.
To specify the size threshold at which the internal log file is automatically saved, complete the following step.
The following table shows the units of measure and values you can use to specify the size threshold of the internal log file for automatic saves.
To enable or disable automatic saves based on a time interval, complete the following step.
| 1 |
options cifs.audit.autosave.ontime.enable on | off |
If you have enabled automatic saves based on a time interval, you can specify the time interval. The default time interval is 12 hours, so the contents of the internal log file are saved to the external event file every 12 hours.
To specify a different time interval for automatically saving the internal log file to the external event file, complete the following step.
The following table shows the units of measure and values you can use to specify the time interval for automatic saves.
Each time the internal log file is automatically saved to the external event file, an extension is added to the base name of the event file. You can select one of the following types of extensions to be added:
The filer saves the event files for up to six weeks. You can specify a limit to the number of event files that can be saved.
If you select counter for automatic file naming, the extension is a number value. When an automatic save occurs, the old event files are renamed using sequentially numbered extensions. The newest event file does not have a number value added to it. For example, if the base file name is eventlog, when an automatic save occurs, the newest event file is named eventlog.evt, the previous eventlog.evt file is copied to eventlog1.evt, the eventlog1.evt file is copied to eventlog2.evt, and so on.
To specify counter (numbered) extensions for automatically saved event files, complete the following step.
| 1 |
options cifs.audit.autosave.file.extension counter |
If you select timestamp for automatic file naming, the file name is in the following format:
base name of event file.YYYYMMDDHHMMSS.evt
YYYY is the 4-digit year.
MM is the 2-digit month.
DD is the 2-digit day.
HH is the 2-digit hour.
MM is the 2-digit minute.
SS is the 2-digit second.
To specify timestamp extensions for automatically saved event files, complete the following step.
| 1 |
options cifs.audit.autosave.file.extension timestamp |
To specify the maximum number of event files that can be saved automatically, complete the following step.
| 1 |
options cifs.audit.autosave.limit value |
To specify the maximum size of the cifsaudit.alf file, complete the following step.
If you want CIFS clients to receive SNMP traps for auditing events, you must register the clients using the SNMP feature of Data ONTAP. All registered clients must have SNMP software to listen for SNMP traps.
An SNMP trap is issued whenever any of the following occurs:
To clear the internal cifsaudit.alf file, complete the following step.
To view the external event log (.evt file), complete the following steps.
Copyright © 1994-2003, Network Appliance, Inc. All rights
reserved.
Part No. 210-00323
File: cifs47.htm
Last updated: 01/15/03 15:45:23