How to access audit logs?
Applies to
- ONTAP 9
- CIFS
- CIFS Auditing
Answer
- Determine the destination volume of the audit logs from the ONTAP CLI:
vserver audit show -vserver <vserver> -fields destination
Example:
Cluster::> vserver audit show -vserver VS1 -fields destination
vserver destination
------------ -----------
VS1 /audit
- Configure a CIFS share to allow access to the volume listed in step 1 from the ONTAP CLI:
vserver cifs share create -vserver <vserver> -share-name <share_name> -path <path_from_step_1>
Note: By default, ONTAP will grant full control to the Everyone
group, access can be restricted via file level ACLs.
- (Optional) Mount the volume listed in step 1 via NFS.
- The export policy may need to be modified to allow the host to access the volume.
Note: By default, ONTAP converts the binary logs to the EVTX file format.
Additional Information