NetApp Cluster Mode Configuration for Auditing Files and Folder Changes

Lepide can integrate with NetApp Cluster mode to provide audit on files and folder changes. The auditing is currently supported for CIFS shared.

Auditing for NetApp Cluster requires two things to be enabled: NetApp native auditing + NTFS Auditing and the steps to do this are as follows:

1. Enable NetApp Auditing:

  • Create a volume for Lepide for 20GB in size under the same SVM that need to be audited

  • We require dedicated user credentials for Lepide to do the configuration. This user must have Change Permission on the C$ of SVM

  • Run the following command in Putty to enable the auditing. The Destination Volume is the same as created in the first point above

vserver audit create -vserver <Name_SVM> -destination "/<Name_Volume>" -format XML -rotate-size 1MB -rotate-limit 15000

and then run this command:

vserver audit enable -vserver <SVM_Name>

Note:

  • The volume size must be 20GB

  • The Lepide user should have change permission on C$

  • The two parameters should be set as per the command: -rotate-size 1MB -rotate-limit 15000

  • It may be necessary to investigate the ONTap Manager to verify things and so please have the following information available:

    • Name of the Share that are needed to audit.

    • Volume name those shares belongs to.

    • Junction path of each share.

We will need to create a txt file which includes the share information that is needed to audit and it needs to be in this format:

volume#junction#share

2. Enable NTFS Auditing:

Once the NetApp level auditing is enabled, it is then required to enable NTFS Auditing. This is required to be done only on those shares that are needed to audit.

Check the shares and make sure that the NTFS Auditing should be set as:

A screenshot of a computer

AI-generated content may be incorrect.