SVM name

Name of the SVM on which to create the auditing configuration. The SVM must already exist.

-vserver vserver_name

Yes

Yes

Log destination path

Specifies the directory where the converted audit logs are stored, typically a dedicated volume or qtree. The path must already exist in the SVM namespace.

The path can be up to 864 characters in length and must have read-write permissions.

If the path is not valid, the audit configuration command fails.

If the SVM is an SVM disaster recovery source, the log destination path cannot be on the root volume. This is because root volume content is not replicated to the disaster recovery destination.

You cannot use a FlexCache volume as a log destination (ONTAP 9.7 and later).

-destination text

Yes

Yes

Categories of events to audit

Specifies the categories of events to audit. The following event categories can be audited:

The default is to audit file access and SMB logon and logoff events.

Note: Before you can specify cap-staging as an event category, a SMB server must exist on the SVM. Although you can enable central access policy staging in the auditing configuration without enabling Dynamic Access Control on the SMB server, central access policy staging events are generated only if Dynamic Access Control is enabled. Dynamic Access Control is enabled through a SMB server option. It is not enabled by default.

-events {file-ops|cifs-logon-logoff|cap-staging|file-share|audit-policy-change|user-account|security-group|authorization-policy-change}

No

Log file output format

Determines the output format of the audit logs. The output format can be either ONTAP-specific XML or Microsoft Windows EVTX log format. By default, the output format is EVTX.

-format {xml|evtx}

No

Log files rotation limit

Determines how many audit log files to retain before rotating the oldest log file out. For example, if you enter a value of 5, the last five log files are retained.

A value of 0 indicates that all the log files are retained. The default value is 0.

-rotate-limit integer

No

Log file size limit

Determines the audit log file size limit.

-rotate-size {integer[KB|MB|GB|TB|PB]}

No

Log rotation schedule: Month

Determines the monthly schedule for rotating audit logs.

Valid values are January through December, and all. For example, you can specify that the audit log is to be rotated during the months January, March, and August.

-rotate-schedule-month chron_month

No

Log rotation schedule: Day of week

Determines the daily (day of week) schedule for rotating audit logs.

Valid values are Sunday through Saturday, and all. For example, you can specify that the audit log is to be rotated on Tuesdays and Fridays, or during all the days of a week.

-rotate-schedule-dayofweek chron_dayofweek

No

Log rotation schedule: Day

Determines the day of the month schedule for rotating the audit log.

Valid values range from 1 through 31. For example, you can specify that the audit log is to be rotated on the 10th and 20th days of a month, or all days of a month.

-rotate-schedule-day chron_dayofmonth

No

Log rotation schedule: Hour

Determines the hourly schedule for rotating the audit log.

Valid values range from 0 (midnight) to 23 (11:00 p.m.). Specifying all rotates the audit logs every hour. For example, you can specify that the audit log is to be rotated at 6 (6 a.m.) and 18 (6 p.m.).

-rotate-schedule-hour chron_hour

No

Log rotation schedule: Minute

Determines the minute schedule for rotating the audit log.

Valid values range from 0 to 59. For example, you can specify that the audit log is to be rotated at the 30th minute.

-rotate-schedule-minute chron_minute

Yes, if configuring schedule-based log rotation; otherwise, no.