CIFS auditing policy isn't persistent with some event settings lost after one day
Applies to
- ONTAP 9
- CIFS Auditing
- CIFS
Issue
CIFS auditing policy isn't persistent with some event settings lost after one day.
Example
- Modify event settings as the following:
::> vserver audit modify -vserver <svm> -events file-ops,file-share,user-account,authorization-policy-change,security-group,cifs-logon-logoff,cap-staging
::> vserver audit show
Vserver State Event Types Log Format Target Directory
----------- ------ ------------------ ---------- ----------------------------
<svm> true file-ops, evtx /vol1/audit
file-share,
user-account,
authorization-
policy-change,
security-group,
cifs-logon-logoff,
cap-staging,
audit-policy-
change
- When showing the audit events the next day, some settings are gone
::> vserver audit show
Vserver State Event Types Log Format Target Directory
----------- ------ ------------------ ---------- ----------------------------
<svm> true user-account evtx /vol1/audit
authorization-
policy-change,
security-group,
audit-policy-
change