Beginning with ONTAP 9.11.1, you can display audit log contents using ONTAP System Manager.

Beginning with ONTAP 9.12.1, ONTAP provides tampering alerts for audit logs. ONTAP runs a daily background job to check for tampering of audit.log files and sends an EMS alert if it finds any log files that have been changed or tampered with.

ONTAP logs management activities that are performed on the cluster, for example, what request was issued, the user who triggered the request, the user’s access method, and the time of the request.

The management activities can be one of the following types:

ONTAP records management activities in the /mroot/etc/log/mlog/audit.log file of a node. Commands from the three shells for CLI commands—​the clustershell, the nodeshell, and the non-interactive systemshell (interactive systemshell commands are not logged)--as well as API commands are logged here. Audit logs include timestamps to show whether all nodes in a cluster are time synchronized.

The audit.log file is sent by the AutoSupport tool to the specified recipients. You can also forward the content securely to external destinations that you specify; for example, a Splunk or a syslog server.

The audit.log file is rotated daily. The rotation also occurs when it reaches 100 MB in size, and the previous 48 copies are preserved (with a maximum total of 49 files). When the audit file performs its daily rotation, no EMS message is generated. If the audit file rotates because its file size limit is exceeded, an EMS message is generated.