ONTAP applies security traces at the SVM level.

Each incoming request is screened to see if it matches filtering criteria of any enabled security traces.

Traces are performed for both file and folder access requests.

Traces can filter based on the following criteria:

Requests are screened for Allowed and Denied access response results.

Each request matching filtering criteria of enabled traces is recorded in the trace results log.

The storage administrator can configure a timeout on a filter to automatically disable it.

If a request matches multiple filters, the results from the filter with the highest index number is recorded.

The storage administrator can print results from the trace results log to determine why an access request was allowed or denied.