Performing common tasks

Configuring audit logging

About the audit log

An audit log is a record of commands executed at the console, through a Telnet shell, or by using the rsh command. The audit log data is logged in the /etc/log directory in a file called auditlog. Administrative HTTP operations, such as those resulting from the use of FilerView, are also logged. The maximum size of the auditlog file is specified by the auditlog.max_file_size option. By default, Data ONTAP is configured to save an audit log.

The /etc/log/auditlog file restart schedule

Every Saturday at midnight, the /etc/log/auditlog file is copied to /etc/log/auditlog.0, /etc/log/auditlog.0 is copied to /etc/log/auditlog.1, and so on. This also occurs if the auditlog file reaches the maximum size specified by auditlog.max_file_size.

Assuming they do not get full, the system saves auditlog files for six weeks.

Configuring audit logging

To configure audit logging, complete the following steps.

Step	Action
1	If audit logging is turned off, enter the following command to turn audit logging on: options auditlog.enable on Otherwise, go to Step 2.
2	To change the maximum size of the audit log file, enter the following command: options auditlog.max_file_size value value is the maximum size in bytes. The default value is 10000000 (10 MB).

Step

Action

If audit logging is turned off, enter the following command to turn audit logging on:

options auditlog.enable on

Otherwise, go to Step 2.

To change the maximum size of the audit log file, enter the following command:

options auditlog.max_file_size value

value is the maximum size in bytes. The default value is 10000000 (10 MB).