Hi,

Thanks, I checked VNX CIFS guide, in Event log Auto archive section i read the instructions and applied it. I am getting error as " Error Writing the value's new contents ", Checked KB article for this issue 000374610 i have set as per the KB article but still getting error.

I needed some clarity on File . What is the rite way to mention the path as per the document its mentions the file either saves in c:\.etc\audit\security or a file system path. How to mention the file system path ? i create a 10 GB file system with SMB share. gave the path as c:\swoef205\Auditlogs but it does not work.  What the correct way path i have to give and how to fix this error ?

Thanks in Advance.

Shiva.

Hi,

After the path mentioned as c:\FS\logs i was able to give the file path it worked and i was able to enable Autoarchiveenable. It works i was able to set 1 hour archive.

The solution works and thanks alot.

The issue was with Path once correct path was provided c:\FS\logs error dint appear. May be in the audit logs document if the path format is explained it would be  a good information.

Hi,

same as in VNX the currently in use security.evt is locked and cannot be copied.

my advice is:

relocate .evt files to a data file system (from the default .etc in the rootfs)

enable auto archiving

setup a job from a client to copy the archived .evt files periodically if necessary

the copy could be done using CIFS, NFS, ftp/scp, ...

on this archived files you can then run event viewer or any other command that understands .evt format

there should be a knowledgebase article about relocation and setting up security event log rotation

or see the VNX CIFS manual under event log auto archive - its the same steps using regedit on Unity as on VNX

Rainer

thanks for the feedback

did you find out what the reason for the initial regedit error was ?