I've moved the default CIFS event logs to a seperate filesystem mounted to the same VDM (512MB file system) using the registry modification as per:

http://knowledgebase.emc.com/emcice/documentDisplay.do;jsessionid=34F7A79B9F6FF3022114FBD5CB24D3A5?docType=1006&clusterName=DefaultCluster&resultType=5002&groupId=1&page=&docProp=$solution_id&docPropValue=emc69252&passedTitle=null.

After enabling auditing I can see the new security.evt filling up nicely. Using the Computer Management MMC, I changed the log retention to "Overwrite events as needed" and tried to increase the log file from the default 65536 KB to something larger.  No matter what value I use, it will always revert back to 65536 KB after I check the settings again.  I verified that the log does start overwriting old events once it reaches this limit of 64MB.

I see that there is also a registry key on the CIFS server for, MaxSize, which has the value 67108864 (which is about 64MB).  Tried changing this but it seems to get reset back to it's value as well.

Has anyone got the CIFS security event logs to become larger than this 64MB limit I'm running into?  I've seen other posts about increasing the limits well above this so I'm wondering what's going on here.

Oh, and I have a second question: Can multiple CIFS server use the same security log on a file system mounted to the physical data mover?  Is this a good thing to do?  I'm currently using a seperate file system for each VDM (one CIFS server per VDM).  I understand that it would filled very quickly, but if I could sort out the file size limitation it wouldn't be an issue.  What happens in a fail over situation?  I suppose I would have to replicate the file system we are using to hold the security logs as well.

Environment:

NAS version 5.6.50-2

Celerra NS-G8

Using Windows Server 2003 as the CIFS clients and for configuring the CIFS