Does audit log record snapshot access through previous version tab (Windows)?

Question

Does anybody know whether or not Isilon audit log function captures snapshot access through Windows Previous Version tab?

For example, if a user opens a file from Previous Version tab in Windows Folder Properties and accesses to Isilon's snapshot, does Isilon audit log records the action in its log?

Thank you,

dynamox · Accepted Answer

yes, there will be an entry and it will reference the original file location

isilonpoc-2: [409: Wed Dec 27 14:58:10 2017] {"id":"43cafdb5-eb40-11e7-a246-0050568f78d1","timestamp":1514404690590053,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"SMB2","zoneID":1,"zoneName":"System","eventType":"create","createResult":"OPENED","isDirectory":false,"desiredAccess":128,

"clientIPAddr":"10.110.13.36","createDispo":1,"userSID":"S-1-5-21-4279633407-28481931-2677731258-308429","userID":1000000,"fileName":"\\ifs\\clustername\\cifs\\bob\\Home\\scripts\\ok","ntStatus":0,"fsId":1,"partialPath":"\\scripts\\ok","rootInode":4309909598,"inode":4312050860}}

Uehara Y. · Answer

Thank you, dynamox-san!

Isilon

Does audit log record snapshot access through previous version tab (Windows)?

Was this post helpful?

Register Now! for Secure Secrets with Kubernetes & DevSecOps - and grab a lab!

Dell Technologies at SpiceWorld 2022