CIFS auditing stops on the vfiler due to no space left on the volume for audit logs
Applies to
- 7 Mode
- CIFS auditing
Issue
- CIFS auditing stops on the vfiler with the following errors
- EMS log
Sat Jul 28 02:39:28 EDT [vfiler1@node1: ALF00: cifs.auditfile.logFile.IOError:error]: ALF I/O error 0x1c (No space left on device) on file /vol/vol1/audit-logs/auditlog.evt.tmp: creating file.
[?] Sat Jul 28 02:39:28 EDT [vfiler1@node1: ALF00: cifs.audit.tmpfile.IOerr:error]: Access Logging Facility (ALF) I/O error 0x1c (No space left on device) on file /etc/log/cifsaudit.alf: I/O error while writing event records to temporary file. Use the command 'cifs audit start' to restart CIFS auditing.
[?] Sat Jul 28 02:39:28 EDT [vfiler1@node1: ALF00: cifs.auditfile.enable.off:info]: ALF: CIFS auditing stopped.
- Audit log
Sat Jul 28 03:30:01 EDT [vfiler1@node1:registry_control:debug]: root: MODIFY:$/etc/registry.local:options.cifs.audit.enable:off
Sat Jul 28 03:30:01 EDT [vfiler1@node:registry_control:debug]: root: MODIFY:options.cifs.audit.enable:off