Re: CIFS Auditing log from NetApp

Thanks Eric, I wasn't aware of that registry value, so that may prove handy
for other things.

However, NetApp isn't running a real version of Windows. It's running a
Linux variant, which "emulates" CIFS, and as far as I know, it doesn't have
a "registry" equivalent. I believe that's why it really logs to
cifsaudit.alf, then does a periodic bulk-export to the .EVT file format. Not
sure how they're emulating language (string) files etc, but I imagine
they're just intercepting the inbound API calls, working some foo, then
passing the buffer back to the caller.

Unless you know something I don't - and there is a config that works with
NetApp??

Right now, I can log files from almost all our platforms, but the CIFSAudit
log is a problem since it is neither a flat file, nor a true windows system
(so I can't install an agent). I can periodically pull data from the
eventlog, but then that causes me problems with either a) duplicate records
will many of the free/opensource tools for remotely pulling eventlog files
or b) loss of data if the eventlog overwrites. This is why I prefer
real-time a.la syslog style.

Anyone from NetApp on this distrib? I can go through our reseller, but
they're just going to forward the question, so if I can get a response
direct from someone who has actually done this, I'd prefer it - and it would
benefit the list.

On 8/14/06, Eric Fitzgerald <[email protected]> wrote:
>
>   Search for "autobackuplogfiles" in the KB (www.microsoft.com/support/kb
> ).
>
>
>
>
>
> *From:* [email protected][mailto:
> [email protected]] *On
> Behalf Of *Gord Taylor
> *Sent:* Friday, August 11, 2006 6:17 AM
> *To:* loganalysis
> *Subject:* [logs] CIFS Auditing log from NetApp
>
>
>
> I'm looking to consolidate the logs on a NetApp server. For most of the
> logs, this looks pretty simple - standard syslog stuff.
>
> But for the filesystem auditing (cifsaudit), NetApp does a periodic write
> to the adtlog.evt file from (I believe) the cifsaudit.alf file. Anyone
> know if there is a way to PUSH the cifsaudit stuff from the NetApp box
> rather than doing periodic exports of the EVT file???
>
> Thanks in advance.
>

_______________________________________________
LogAnalysis mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/loganalysis