What are you attempting to audit? Is it the CIFS file system .. such as read's, delete's, permission changes etc? If so, CIFS still needs to be set to audit like that of the native NTFS structure. You will need to do this via explorer by:
- right clicking the directory or file
- security
tab
- advanced
- auditing
- adding a common group or suspected
user
- selecting what you are attempting to audit
-Jon
"Bui, Marcus" <Marcus.Bui@aiminvestments.com> wrote in message news:0D1B378426DB3B4DB200AF4738F3E9E7090FD101@USHOUXML04...
I have F820 running DOT 6.4.2P6 with CIFS only. I noticed the cifs audit log does not log all events. The audit log is dump and saved every night at midnight via a rsh script. Looking through several log file, there are only a few entries in each of the file. All of the entries are within 16 minutes after midnight when the audit file is dump. These are the settings. I compare it with two other Filers, F880c DOT 6.4.2P12, with the same settings the audit log worked fine.cifs.audit.enable on
cifs.audit.file_access_events.enable on
cifs.audit.logon_events.enable on
cifs.audit.logsize 204800000
cifs.audit.saveas /etc/log/adtlog.evtAny ideas?thanks,
Marcus Bui
Confidentiality Note: The information contained in this message, and any attachments, may contain confidential and/or privileged material. It is intended solely for the person or entity to which it is addressed. Any review, retransmission, dissemination, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.