The file system audit policy specifies access restrictions for clients connecting through unauditable protocols (if access is allowed or denied), and specifies audit log details. The audit log policy specifies naming, location in the file system, size, the log roll over policy, and the backup policy.
-
Navigate to
, and click
add to display the
Add File System Audit Policy page.
Field/Item Description EVS/File System Lists the currently selected EVS and file system, to which the audit policy will apply. Click change to go to the Select a File System page, where you can select a different EVS and file system. Access via Unsupported Protocols When clients attempt to access the file system through a protocol that does not support auditing (such as NFSv2), this setting determines if those clients are permitted to access the file system. You can select either: - Deny Access. Client access to the file system using unauditable protocols (such as NFSv2) is denied.
- Allow Access. Allows client access to the file system using unauditable protocols (such as NFSv2), but does not create any auditing events.
Audited Protocols When clients attempt to access the file system through a protocol that does not support auditing (such as NFSv2), this setting determines if those clients are permitted to access the file system. You can select either: - smb. Only the SMB protocol is audited. Access to SMB is always allowed, and access via other protocols is determined via the Other Protocol Support option.
- smb, nfsv3. Both the SMB and NFSv3 protocols are audited. Access to SMB and NFSv3 is always allowed, and access via other protocols is determined via the Other Protocol Support option.
External Stops the audit records from being stored locally (including audit log backups) and instead only makes them available to an external audit log server. To configure an external logging server, use the audit-syslog CLI command or for third-party audit logging applications, configure an audit log consolidated cache and then read the audit logs using the Windows EVENTLOG protocol. Active Log File Name Specify the file name for the file system audit log. The file name must have an .evt extension. The default file name is audit.evt. Logging Directory Specify the directory within the file system in which the file system audit log files are saved. You can use the browse button to search for an existing directory, or enter the name of a directory to be created. Maximum Log File Size Specify the maximum size of the active audit log file in KiB or MiB. The default size is 512 KiB. The maximum log file size is 50 MiB. Log roll over policy Determines what the system does once the active audit log file is full (when it reaches the Maximum Log File Size). You can select either: - Wrap, which causes the system to delete the oldest existing audit entry to allow room for a new entry.
- New, which causes the system to create a new active audit log file. The default is New.
Backup Interval Specify the time (in minutes) between automatic backups of the active audit log. The backup interval must be between 5 and 14400 minutes (10 days). A value of 0 disables the automatic backups. The default is 0. Number of files to retain Specify the number of backup audit log files to retain. The default is 10. The maximum number of files to retain is 50.