NetApp
7-mode/HA pair/V-Series : Configuration : Protocols : CIFS : Managing CIFS auditing : Configuring CIFS and NFS auditing
Configuring CIFS and NFS auditing
You can configure CIFS and NFS auditing on your storage system to troubleshoot access problems, check for suspicious activity on a system, or investigate a security breach.
Before you begin 
CIFS auditing on System Manager requires the following:
•
The file or directory to be audited must be in a mixed or NTFS volume or qtree.
•
Access for individual files and directories must be activated according to Windows documentation.
Steps 
1.
From the Home tab, double-click the appropriate storage system to display a subtree of management features.
2.
Under the selected host storage system, click Configuration > Protocols > CIFS to display the CIFS window.
3.
If the appropriate tab is not displayed, click the Configuration tab.
4.
In the Auditing pane, click Edit to display the Edit Auditing dialog box.
5.
If you are setting up NFS auditing, click Browse and select the appropriate NFS audit filter file.
6.
If you want to use a different file than the default, click Browse and select the appropriate file.
7.
If you want to use a different file size than the default, type the new file size.
The audit log file size can be between 512KB and 64 GB.
8.
Select the check boxes corresponding to the types of events you want to audit, then click OK to save your changes.