NetApp
Configuration > Protocols > CIFS : Configuring CIFS : Configuring CIFS and NFS auditing
Configuring CIFS and NFS auditing
You can configure CIFS and NFS auditing on your storage system to troubleshoot access problems, check for suspicious activity on a system, or investigate a security breach.
Before you begin 
•
The file or directory to be audited must be in a mixed or NTFS volume or qtree.
•
Access for individual files and directories must be activated according to Windows documentation.
Steps 
1.
From the Home tab, double-click the appropriate storage system.
2.
In the navigation pane, click Configuration > Protocols > CIFS.
3.
In the Auditing area, click Edit.
4.
In the Edit Auditing dialog box, select the appropriate check boxes to enable CIFS and NFS auditing.
5.
If you are setting up NFS auditing, click Browse and select the appropriate NFS audit filter file.
6.
Specify the general settings for the audit log file.
7.
Select the check boxes corresponding to the types of events you want to audit.
8.
Click Save and Close to save your changes and close the dialog box.