Understanding CIFS auditing

About CIFS auditing

Data ONTAP audits logon, logoff, and file access events similarly to Windows. There are some differences, however, in how you enable auditing and how you configure the file that logs audit event information.

Events that Data ONTAP can audit

You can enable auditing for the following categories of events:

Logon and logoff events
File access events

Prerequisites for auditing file access events

Following are the prerequisites for auditing file access events:

The file or directory to be audited must be in a mixed or NTFS volume or qtree. You cannot audit events for a file or directory in a UNIX volume or qtree.
You must activate access auditing for individual files and directories according to your Windows documentation.

Where Data ONTAP logs audit event information

Audit event information is stored in an internal log file, /etc/log/cifsaudit.alf. You should periodically save the contents of this file to an external event log file either manually or by setting up automatic saving of this file. By default, the external event log is the /etc/log/adtlog.evt file. You can specify another file as the event log. If the specified file does not already exist, Data ONTAP creates the file when it saves information to the file. The directory containing the file, however, must exist; otherwise, an error message appears after you specify the file.

Size and format of the internal and external log files

You can specify the maximum size of the internal cifsaudit.alf log file between 524,288 bytes (512K) and 68,719,476,736 bytes (64 GB). The default size is 524,288 bytes.

The external event log (.evt file) that is generated from the cifsaudit.alf file will be larger, because the compressed contents of the cifsaudit.alf file are expanded and reformatted in the external event log file. The external event log is in Windows format. You can view it with Microsoft Event Viewer. The cifsaudit.alf log file is internally formatted and cannot be viewed with Event Viewer.

How Data ONTAP updates the event log

To save audit event information to the external event log, you can issue the cifs audit save command or enable automatic saving of the event information. Data ONTAP does not update the event log when the log is being viewed by a client. However, the file access information gathered when the event log is open is not lost. Data ONTAP updates the event log the next time you issue the cifs audit save command or an automatic save occurs.

It is important to issue the cifs audit save command frequently or enable frequent automatic saves to prevent loss of event information. If your event generation rate is very high, the cifsaudit.alf file will fill quickly and may overwrite older events before they are saved to the event log.

For detailed information

The following sections discuss configuring Data ONTAP to collect event information, saving and clearing event information, and understanding event log detail displays: