Is there any way to find out the user responsible for changes to SMB shares attributes whether is from ONTAP or Windows File Explorer side
Applies to
ONTAP 9+
Answer
- Yes, there are multiple locations to check depending on how the change was made:
- From the ONTAP CLI of via an application leveraging ZAPI or RESTAPI, you can check the AUDIT-MLOG-TXT.GZ section in asup
- This should provide the IP address that sent the request and user used as well as some details about the details of the command used.
- For SMB or MSRPC(Microsoft Management Console) Cifs auditing would have needed to be setup prior, specifically for the
file-share
andfile-ops
event types.
- From the ONTAP CLI of via an application leveraging ZAPI or RESTAPI, you can check the AUDIT-MLOG-TXT.GZ section in asup