Understanding CIFS auditing

Understanding event detail displays

Types of event detail displays

The following event detail displays are available:

Network logon
Unsuccessful network logon
Network logoff
Windows file access
UNIX file access
Unsuccessful file access
Lost record event
Clear audit log event

Events that Data ONTAP can audit

The following table lists the events that Data ONTAP can audit.

Event ID	Event	Description	Category
516	AdtEvntDiscard	Audit events were lost	Audit Log
517	AdtLogClear	Audit log was cleared	Audit Log
529	AdtUnknownUser	Unknown user name or bad password	Logon/Logoff
530	AdtCantLogonNow	Account logon time restriction	Logon/Logoff
531	AdtAccountDisabled	Account currently disabled	Logon/Logoff
532	AdtUserAccountExpired	User account has expired	Logon/Logoff
533	AdtCantLogonHere	User can't log on to this computer	Logon/Logoff
534	AdtLogonTypeRestricted	User not granted logon type here	Logon/Logoff
535	AdtPasswordExpired	User's password has expired	Logon/Logoff
536	AdtNetLogonInactive	The NetLogon component is not active	Logon/Logoff
537	AdtUnsuccessfulLogon	Logon failed for reasons other than above	Logon/Logoff
538	AdtUserLogoff	Local or network user logoff	Logon/Logoff
539	AdtLockedOut	Account locked out	Logon/Logoff
540	AdtSuccessfulNetLogon	Network (CIFS) logon	Logon/Logoff
560	AdtObjOpen	Object (file or directory) open	File Access
563	AdtObjOpenForDelete	Object (file or directory) open for deletion	Logon/Logoff

Windows file access detail displays

Windows file access detail displays show the following types of information.

Field	Description
Object Server	The name of the subsystem server process calling the audit check function. This is always SECURITY because this is a security log.
Object Type	The type of object being accessed.
Object Name	The name (such as a file name) of the object being accessed.
New Handle ID	The new handle identifier of the open object.
Operation ID	A unique identifier associating multiple events resulting from a single operation.
Process ID	The identifier of the client process accessing the object.
Primary User Name	The user name of the user requesting the object access. When impersonation is taking place, this is the user name with which the server process is logged on.
Primary Domain	The name of the computer, or SYSTEM if the user identified by Primary User Name is SYSTEM. If the computer is a member of a Windows NT Server domain, this can also be the name of the domain containing the primary user's account.
Primary Logon ID	A unique identifier assigned when the primary user logged on.
Client User Name	Your login.
Client Domain	The name of your computer or the domain containing the client user's account.
Client Logon ID	A unique identifier assigned when the client user logged on.
Accesses	The types of accesses to the object that were attempted.
Privileges	Your privileges.

UNIX file access detail displays

UNIX file access detail displays show the same kind of information as the Windows file access detail displays, but instead of an object name, NFS access appears because the file is accessed through NFS. In addition, UNIX file access detail displays show the following information about the file that you are auditing:

The ID of the volume in which the file is located
The ID of the latest snapshot in which the file is located
The inode of the file

This information enables you to find the file using the find -inum command from an NFS client.

Unsuccessful file access detail displays

Unsuccessful file access detail displays show failed attempts to access a file. For example, an unsuccessful file access occurs when a user tries to access a file but does not have permission to access it.

The display shows the ID of the user who tried to access the file and an indication that the access attempt was unsuccessful.

Lost record event detail displays

If Data ONTAP cannot create an audit record, the lost record event detail displays give a reason, such as the following:

Internal resources allocated for the queueing of audit messages 
have been exhausted, leading to the loss of some audits.

      Number of audit records discarded:           1