CIFS Auditing


Concepts	Procedures	More Information

The Configure CIFS Auditing page enables you to set up CIFS auditing on the filer to troubleshoot access problems, check for suspicious activity on a system, or investigate a security breach.

What CIFS auditing does

Data ONTAP enables you to monitor reads and writes of a specified file on the filer by a specified user.

The file on the filer must be in a mixed or NTFS volume or qtree. You cannot audit events on a file in a UNIX volume or qtree.

You can specify the logging of successes, failures, or both, for any type of event.

The event log

The event log contains file access information as a result of auditing. It is in Windows NT format and can be viewed by the Event Viewer.

By default, the event log is /etc/log/adtlog.evt, which contains the access event information. You can specify another file as the event log and an alternative maximum file size.

You cannot update the event log when it is being viewed by a client. To prevent losing event information that is gathered when the event log is open, Data ONTAP does not write to the event log as event information is being collected. Instead, it updates the event log when you manually save the log from FilerView.

Field	Description
Object Server	Name of the subsystem server process calling the audit check function. This is always SECURITY, because this is a security log.
Object Type	Type of object being accessed.
Object Name	Name (such as a file name) of the object being accessed.
New Handle ID	New handle identifier of the open object.
Operation ID	Unique identifier associating multiple events resulting from a single operation.
Process ID	Identifier of the client process accessing the object.
Primary User Name	User name of the user requesting the object access. When impersonation is taking place, this is the user name with which the server process is logged on.
Primary Domain	Name of the computer, or SYSTEM, if the user identified by Primary User Name is SYSTEM. If the computer is a member of a Windows NT server domain, this can also be the name of the domain containing the primary user's account.
Primary Logon ID	Unique identifier assigned when the primary user logged in.
Object User Name	Your login name.
Client Domain	Name of your computer or the domain containing the client user's account.
Client Logon ID	Unique identifier assigned when the client user is logged in.
Accesses	Types of accesses to the object that were attempted.
Privileges	Your privileges.