Identify how the qtree was deleted
Applies to
- Qtree
- ONTAP 9
Issue
Qtree was deleted .
From EMS
Mon Dec 02 14:00:39 +0900 [Cluster node 01: mgwd: qtree.delete.start:notice]: Deleting qtree "work01" in volume "ib1" on SVM.
[?] Mon Dec 02 14:00:44 +0900 [Cluster node 01: mgwd: qtree.delete.success:notice]: Successfully deleted qtree "work01" in volume "ib1" on SVM.
[?] Mon Dec 02 14:00:52 +0900 [Cluster node 01: mgwd: qtree.delete.start:notice]: Deleting qtree "work02" in volume "ib1" on SVM.
[?] Mon Dec 02 14:02:17 +0900 [Cluster node 01: mgwd: qtree.delete.success:notice]: Successfully deleted qtree "work02" in volume "ib1" on SVM.
From Audit M-log:
On (Cluster node 01 : 0538309670)
0000001d.0012e345 00427ad8 Mon Dec 02 2024 14:00:52 +09:00 [kern_audit:info:3456] 8503e800000af1fe :: Cluster node 01:http :: 172.29.24.28:34338 :: Cluster node 01:netapp-admin :: DELETE /api/storage/qtrees/342348d6-8fdf-11ee-8710-d039eab1fc53/2 : ["X-Dot-Client-App: SMc"] {} :: Pending
0000001d.0012e346 00427ad8 Mon Dec 02 2024 14:00:52 +09:00 [kern_audit:info:3456] 8503e800000af1fe :: Cluster node 01:http :: 172.29.24.28:34338 :: Cluster node 01:netapp-admin :: DELETE /api/storage/qtrees/342348d6-8fdf-11ee-8710-d039eab1fc53/2 : ["X-Dot-Client-A
0000001d.0012e2a6 00427a5c Mon Dec 02 2024 14:00:38 +09:00 [kern_audit:info:3456] 8503e800000af1bd :: Cluster node 01:http :: 172.29.24.28:46434 :: Cluster node 01:netapp-admin :: DELETE /api/storage/qtrees/342348d6-8fdf-11ee-8710-d039eab1fc53/1 : ["X-Dot-Client-App: SMc"] {} :: Pending
0000001d.0012e2a8 00427a5c Mon Dec 02 2024 14:00:39 +09:00 [kern_audit:info:3456] 8503e800000af1bd :: Cluster node 01:http :: 172.29.24.28:46434 :: Cluster node 01:netapp-admin :: DELETE /api/storage/qtrees/342348d6-8fdf-11ee-8710-d039eab1fc53/1 : ["X-Dot-Client-App: SMc"] {} :: Success:
0000001
pp: SMc"] {} :: Success:
Explaination :
This indicates that the deletion operation was executed and completed successfully by the user netapp-admin using the client application SMc from the IP address 172.29.24.28.