Monitoring Filesystem Events

Question

Hi,is there an option to monitor specific CIFS Events within the provided Filesystem like Creation or Deletion of Files or folders by users? We've got the challenge to find out who or which process deletes a specific CIFS UNC path regularly

Thank you

Rainer_EMC · Answer

Yes - via CIFS (Windows) auditing See the CIFS manual

afp92Tq1w012558 · Answer

Hi, Please check the knowledge base solution : emc69251  .And also document Using Windows Administrative Tools with Celerra in powerlink . Thanks Vanitha

Tileca · Answer

You probably mean configuring audit by GPO? Which one has to be configured for monitoring file or directory acitvities? (is 'Audit object access' sufficient) Thx

Rainer_EMC · Answer

No not GPO Enable auditing on the DM, expand and relocate the audit logs, configure audit ACLs and monitor via security.evt

ScotN · Answer

Is there a way to trigger an SNMP trap or e-mail based on a defined event in the audit log ?

Rainer_EMC · Answer

Which audit log ?

ScotN · Answer

I think it would be the audit evt log. Ideally I think we would want to activate the audit log for a CIFS share or shares. setup some sort of nas_event to trigger a trap Set the audit log to auto rotate.

Rainer_EMC · Answer

No

CIFS auditing is CIFS specific - it's "events" don't reach the control station where nas_event is processed.

It is designed to be Windows compatible and to be used with Windows tools remotely

Please see the Monitoring manual on which events are possible

ScotN · Answer

Hmmm Anyone know of a Microsoft native or 3rd party tool to collect and trigger on Windows events on remote servers ?

Celerra

Monitoring Filesystem Events

Was this post helpful?