Skip to main content
NetApp Knowledge Base

Search

  • Filter results by:
    • View attachments
    Searching in
    About 1 results
    • https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-KBs/Why_are_Event_IDs_4656_and_4663_reported_simultaneously_in_Audit_logs
      In Audit logs, Event IDs 4656 and 4663 getting reported simultaneously and corresponding to a third party auditing tool (AD AuditPlus) indicates that the same user has created and deleted the same fil...In Audit logs, Event IDs 4656 and 4663 getting reported simultaneously and corresponding to a third party auditing tool (AD AuditPlus) indicates that the same user has created and deleted the same file path at the same time stamp The above behavior is specific to files with the extensions .docx and .xls. Simultaneous deletion and creation operations in audit logs can occur when an object is being replaced or updated/modified. It never results in deletion of actual file/folder