Question on CIFS Auditing regarding increasing the size of Celerra Security Log

you can point it to an existing file system or a new one. Security log is per virtual datamover, if you have multiple CIFS servers share the same VDM, security log will contain entries for multiple CIFS servers ..you can filter it of course.

We have four VDM's so do I need to create four security logs? Each VDM has only one CIFS server.

dynamox I just have chatted with EMC customer support they mentioned you require only one log for the entire data mover whatever the number of VDM's it is hosting.

that would make sense to me

one last thing..should all the FS's be under \system32\config

should I follow these below steps. I mean the exact names and paths

• Create a file system called "event_log" and a custom mountpoint called "/winnt", using Celerra Manager.
  
• As Administrator, create a hidden share to the \winnt mountpoint called "winnt$".
  
• Map to the hidden share "winnt$" from a Windows system, and create the following directory structure underneath the \winnt mountpoint:
  \system32\config.

yes

dynamox did you perform this operation(changing security log size for multiple VDM's)

file system names will need to be unique but mount point can be the same since you are mounting it under the different VDMs, other steps look good to me. Also don't forget to enable auditing at the datamover level (using Celerra MMC) and finally enable auditing on the actual objects you want to audit (directory/files)

so we create 4 FS seperatly on each CIFS server with different name and paths instead of what is mentioned in emc69252

Thank You very much dynamox