CIFS Auditing |
The Configure CIFS Auditing page enables you to set up CIFS auditing on the filer to troubleshoot access problems, check for suspicious activity on a system, or investigate a security breach.
Data ONTAP enables you to monitor reads and writes of a specified file on the filer by a specified user.
The file on the filer must be in a mixed or NTFS volume or qtree. You cannot audit events on a file in a UNIX volume or qtree.
You can specify the logging of successes, failures, or both, for any type of event.
The event log contains file access information as a result of auditing. It is in Windows NT format and can be viewed by the Event Viewer.
By default, the event log is /etc/log/adtlog.evt, which contains the access event information. You can specify another file as the event log and an alternative maximum file size.
You cannot update the event log when it is being viewed by a client. To prevent losing event information that is gathered when the event log is open, Data ONTAP does not write to the event log as event information is being collected. Instead, it updates the event log when you manually save the log from FilerView.
|
Field |
Description |
|
Object Server |
Name of the subsystem server process calling the audit check function. This is always SECURITY, because this is a security log. |
|
Object Type |
Type of object being accessed. |
|
Object Name |
Name (such as a file name) of the object being accessed. |
|
New Handle ID |
New handle identifier of the open object. |
|
Operation ID |
Unique identifier associating multiple events resulting from a single operation. |
|
Process ID |
Identifier of the client process accessing the object. |
|
Primary User Name |
User name of the user requesting the object access. When impersonation is taking place, this is the user name with which the server process is logged on. |
|
Primary Domain |
Name of the computer, or SYSTEM, if the user identified by Primary User Name is SYSTEM. If the computer is a member of a Windows NT server domain, this can also be the name of the domain containing the primary user's account. |
|
Primary Logon ID |
Unique identifier assigned when the primary user logged in. |
|
Object User Name |
Your login name. |
|
Client Domain |
Name of your computer or the domain containing the client user's account. |
|
Client Logon ID |
Unique identifier assigned when the client user is logged in. |
|
Accesses |
Types of accesses to the object that were attempted. |
|
Privileges |
Your privileges. |