Skip to main content
NetApp Knowledge Base

CIFS auditing stops on the vfiler due to no space left on the volume for audit logs

Views:
302
Visibility:
Public
Votes:
0
Category:
data-ontap-7
Specialty:
7dot
Last Updated:

Applies to

  • 7 Mode
  • CIFS auditing

Issue

  • CIFS auditing stops on the vfiler with the following errors 
  • EMS log 
Sat Jul 28 02:39:28 EDT [vfiler1@node1: ALF00: cifs.auditfile.logFile.IOError:error]: ALF I/O error 0x1c (No space left on device) on file /vol/vol1/audit-logs/auditlog.evt.tmp: creating file.
[?] Sat Jul 28 02:39:28 EDT [vfiler1@node1: ALF00: cifs.audit.tmpfile.IOerr:error]: Access Logging Facility (ALF) I/O error 0x1c (No space left on device) on file /etc/log/cifsaudit.alf: I/O error while writing event records to temporary file. Use the command 'cifs audit start' to restart CIFS auditing.
[?] Sat Jul 28 02:39:28 EDT [vfiler1@node1: ALF00: cifs.auditfile.enable.off:info]: ALF: CIFS auditing stopped.
  • Audit log 
Sat Jul 28 03:30:01 EDT [vfiler1@node1:registry_control:debug]: root: MODIFY:$/etc/registry.local:options.cifs.audit.enable:off
Sat Jul 28 03:30:01 EDT [vfiler1@node:registry_control:debug]: root: MODIFY:options.cifs.audit.enable:off

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

Scan to view the article on your device