We have installed the MMC Snap in for Celerra. On the Data Mover Management I put in the File systems name. Audit Enabled it on. When I look at Source Servers it list all the CIFS Servers hosted on the NAS.

I have gone to a share on the NAS and and sis security advance \ auditing. for me to see if i can capture myself adding deleteing files and such.

Now when I go to the Event viewer all I see are Logoff and logon events for everybody. I just want to see who creates, reads writes and deletes data on a folder in a CIFS share.

The logon\logoff events are for every CIFS server out there. Not sure what I am doing wrong.