Hi I Have spent the better part of a day, again, searching EMC community and support docs and Google on this topic. I have found outdated links to KB articles and tried to find a simple how to that doesn't lead to yet another how to which does not work.
NAS 7.1.79 on a VG8.
I need to enable file auditing for a share from a VDM on server_9. These are the issues I have run into trying to find a working recipe.
Does anyone have a simple cli example or recommendations on how to accomplish this ? I looked at server_cifs options but the documentation for that pretty much stops at the man page.
Anything would help especially if you know what I would need to do from CLI.
Most of what you'll need to do, you won't be able to do on a Windows box past Win7 / Server 2008. I keep an older VM around with older Java specifically to make this work. EMC hasn't worked too hard on keeping all of the pieces are parts updated. You might get some help from Support,if you open an SR.
You dont need the Unisphere GUI to manage CIFS auditing - there is nothing in it about auditing.
So no Java necessary either
The best description is the the PDF manual called "Using Windows Administrative Tools on VNX" available from support.emc.com
what you need to do:
From Windows configure the audit policy for the data mover to enable it - using the Data Mover security smap-in on mmc
from Windows regedit change the audit log size - you may also want to relocate it since the DM root has limited space
from Windows regedit optionally configure log rotation - see "Event log auto archive" - see the VNX CIFS manual
use Windows explorer to set audit ACLs
use Windows event viewer to look at the audit logs
Some of this can also be done via GPOs
keep in mind for some reason you get an error when opening an active log directly - you need to copy it first of one one of the rotated ones
since the audit logs live on a file system owned by the data mover it would make more sense to copy them from the data mover using CIFS / NFS or ftp
From the control station you could try server_file