researching file size of fs and its content

do you have checkpoints enabled for this file system ?

Hi,

open the Celerra Monitor, and check for "Space Usage History".

Gustavo Barreto.

found the monitor and found the date when the size has dicreased. is there a loghs on celerra that will show what has been deleted and by whom?
I guess I can open the checkpoint (previous version ) in windows and compair folder by folder but it might take forever....

Message was edited by:
kaba

Hi,

if it is a CIFS environment, you can enable audit to see the user operations, but in a NFS environment, as far as I know it's not possible, unless you use a third party tool.

Gustavo Barreto.

if you had auditing enabled on the CIFS server ..and archived those logs often enough where they don't' get overwritten, you could have a chance to find something. There are third party products that help with capturing/reporting auditing information, search Celerra forum for "auditing"

Auditing has the followinf:
Audit system events
Audit logon events
Audit object access
Audit priviledge use
Audit process tracking
Audit policy change
Audit account management
Audit directory service access
Audit account logon events

which one will tell me if anyfiles/folders were deleted?

I have tried open the file and I see the event. But when I delete the file it does not audit that

Message was edited by:
kaba

OK. looks like it is not human readable when it comes to deleting the object

Open file

Object Open:
Object Server: Security Account Manager
Object Type: SAM_SERVER
Object Name: LAFILE
New Handle ID: 0072f629
Operation ID: {open}
Delete file:

Object Open:
Object Server: Security Account Manager
Object Type: SAM_SERVER
Object Name: LAFILE
New Handle ID: 0072f629
Operation ID: {6c047349,446c6c04}

This ID 446c6c04 is identical when deleting files.
Is it by design or cosmetic bug?