This post is more than 5 years old
5 Posts
0
1125
November 7th, 2011 10:00
Is there a way to audit EVERY FS transaction?
Hello.
I have a CELERRA NS-480 (6.0.40-8) with a standalone CIFS server.
Is there a way to audit every action taken on a File System? Some sort pf debugging mode may be that I could enable temporarly?
Thank you in advance
No Events found!
Rainer_EMC
4 Operator
•
8.6K Posts
0
November 8th, 2011 08:00
No you cant.
What are you trying to achieve ?
Rainer
dynamox
9 Legend
•
20.4K Posts
0
November 7th, 2011 10:00
you could enable auditing on the CIFS server and then on the actual object (share, folder, file)
jgolo
5 Posts
0
November 7th, 2011 21:00
Thank you dynamox.
From searching in the forum I found instructions on how to enable CIFS auditing from a MMC, however I currently have access to the system only through websphere and command line. Can this be achieved by Command Line?
Thanks again
dynamox
9 Legend
•
20.4K Posts
0
November 8th, 2011 05:00
all Varonis does is stores events from event viewer in a SQL database, nothing magical ..it has nice reporting though.
landog1
1 Rookie
•
96 Posts
0
November 8th, 2011 05:00
There is a product called Varonis that might suit your needs.
dynamox
9 Legend
•
20.4K Posts
0
November 8th, 2011 05:00
not that i know off, not sure if that setting can be applied to CIFS via AD GPO ..but that could be more hassle than it's worth.
Rainer_EMC
4 Operator
•
8.6K Posts
0
November 8th, 2011 08:00
Varonis can do more – it can use the CEPA API similar to virus scanner instead of the CIFS auditing – so it can also work for NFS
jgolo
5 Posts
0
November 10th, 2011 05:00
Thank you: My stopgap soultion is to monitor all the SMB traffc to and from the NAS with a sniffer (wireshark) and rotating the log files every hour. Eventually I'll configure a WIN CIFS server instead of a standalone one and use windows managment tools and the EMC snapon to audit the FS.
Thak you for your inputs