Appendix B

Event Log and Audit Policy Mapping

About this appendix

This appendix explains how Event Log and Audit group policies are applied differently by Data ONTAP than by Windows systems.

About policy mapping

If Group Policy Object (GPO) support is enabled on your storage system, Data ONTAP processes and applies all relevant GPOs. Most of the relevant group policy settings are applied uniformly on Windows systems and NetApp storage systems.

However, two types of policy--Event Log and Audit (Local Policies)--are applied differently on storage systems because the underlying logging and auditing technologies are different. Event Log and Audit GPOs are applied to storage systems by mapping and setting corresponding Data ONTAP options. The effect of mapping these options is similar but not identical to Event Log and Audit policy settings.

The following tables show the Data ONTAP options that are set when the corresponding GPOs are applied. For more information about the options, see the options(1) man page.

Event Log mapping values

For each row in the following table, the right column shows the Data ONTAP options that are set when the Event Log policies (and settings and examples, if appropriate) in the left column are applied.

Policy name and setting	Data ONTAP options
Name: Maximum security log size	`cifs.audit.logsize`
Name: Retention method for security log Setting: Overwrite events by days Example: 7 days	`cifs.audit.autosave.file.extension timestamp cifs.audit.autosave.file.limit 0 cifs.audit.autosave.onsize.threshold 100 cifs.audit.autosave.onsize.enable on cifs.audit.autosave.ontime.interval 7d cifs.autid.autosave.ontime.enable on cifs.audit.saveas /etc/log/adtlog.evt cifs.audit.enable on`
Name: Retention method for security log Setting: Overwrite events as needed	`cifs.audit.autosave.file.extension timestamp cifs.audit.autosave.file.limit 1 cifs.audit.autosave.onsize.threshold 100 cifs.audit.autosave.onsize.enable on cifs.audit.autosave.ontime.enable off cifs.audit.saveas /etc/log/adtlog.evt cifs.audit.enable on`
Name: Retention method for security log Setting: Do not overwrite events (clear log manually)	`cifs.audit.autosave.file.extension timestamp cifs.audit.autosave.file.limit 0 cifs.audit.autosave.onsize.threshold 100 cifs.audit.autosave.onsize.enable on cifs.audit.autosave.ontime.enable off cifs.audit.saveas /etc/log/adtlog.evt cifs.audit.enable on`

Audit mapping values

For each row in the following table, the right column shows the Data ONTAP options that are set when the Audit policies (and settings and examples, if appropriate) in the left column are applied.

Policy name and setting	Data ONTAP options
Name: Audit account logon events Audit logon events Setting: Both policies are defined but neither sets audit attempts.	`cifs.audit.logon_events.enable off`
Name: Audit account logon events Audit logon events Setting: Both policies are defined, and audit attempts are set to Success, Failure, or Success & Failure	`cifs.audit.enable on cifs.audit.logon_events.enable on`
Name: Audit directory service access Audit object access Setting: Both policies are defined but neither sets audit attempts.	`cifs.audit.file_access_events.enable off`
Name: Audit directory service access Audit object access Setting: Both policies are defined, and audit attempts are set to Success, Failure, or Success & Failure	`cifs.audit.enable on cifs.audit.file_access_events.enable on`
Other Audit policies and settings.	No mapping action is performed.