Does CIFS auditing capture file and folder restore from the Previous Versions
Applies to
ONTAP 9+
Answer
- Yes, if SACLs are configured on the folder or file prior the snapshot being taken, the restore from previous versions should capture multiple events.
- These events should be one or more Open, GetInfo, and Read.
- If the restore location is also SACLed you would also see events ther for the Create, Write, and Close, at least.
Additional Information
additionalInformation_text