Skip to main content
NetApp Knowledge Base

CIFS auditing policy isn't persistent with some event settings lost after one day

Views:
282
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
nas
Last Updated:

Applies to

  • ONTAP 9
  • CIFS Auditing
  • CIFS

Issue

CIFS auditing policy isn't persistent with some event settings lost after one day.

Example

  • Modify event settings as the following:

::> vserver audit modify -vserver <svm> -events file-ops,file-share,user-account,authorization-policy-change,security-group,cifs-logon-logoff,cap-staging 

::> vserver audit show                          
Vserver     State  Event Types        Log Format Target Directory
----------- ------ ------------------ ---------- ----------------------------
 <svm>      true   file-ops,          evtx       /vol1/audit
                   file-share,
                   user-account,
                   authorization-
                   policy-change,
                   security-group,
                   cifs-logon-logoff,
                   cap-staging,
                   audit-policy-
                   change

  • When showing the audit events the next day, some settings are gone

::> vserver audit show                          
Vserver     State  Event Types        Log Format Target Directory
----------- ------ ------------------ ---------- ----------------------------
<svm>        true  user-account                 evtx       /vol1/audit
                   authorization-
                   policy-change,
                   security-group,
                   audit-policy-
                   change

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

Scan to view the article on your device