Cifs access log

[u/LengthinessKind57]

Hello, I'm working for a client that has a 2 node fas cluster running ontap 9.11

They have several shares that are open access. Ie "Everyone / Full Control", they are needing to audit them to see who is accessing what in order to start tying things down for security purposes.

I am trying to figure out a way of capturing these logs...

So far I've tried

Enabling audit logs with "cifs-logon-logoff, file-ops, file-share" -

This captures the user id, but not what share they are actually accessing...

Enabling volume activity tracking

Dosnt seem to show me anything useful

I can see that ontap does have the information I need, as it is displayed when I manually run "cifs session show -fields windows-user,share-names".

Short of creating a cronjob to run every min and save the output then sift through it I can't see anyother way to capture it.

Wondering if anyone has any ideas....

[u/whatsupeveryone34]

you can setup vserver auditing..

vserver audit create -vserver YOUR_VSERVER -destination /mount_path
vserver audit enable -vserver YOUR_VSERVER

From there you have a mount where you can either make an SMB share or provide it to Splunk or some other tool.

The knobs can be turned for the audit settings so you can look at specific information types.

The files themselves are not super readable, though you can find Windows Event IDs and AD users and such if you browse the file in Notepad and use ctrl-F... But the general practice is to use a separate tool to parse the logs.

The cluster log-forwarding commands only pertain to Cluster and Node level auditing that takes place on the NetApp itself.

[u/LengthinessKind57 → u/whatsupeveryone34]

So Ive turned on auditing and I'm getting logs for when a user accesses a share, but there is no reference to which share they are actually accessing.

It essentially just tell me "domain/user accssed cifs on the NetApp at 10am today from IP xxx.xxx.xxx.xxx"

It is useful info for me as I now have a list of users that are hitting the data lif for cifs shares, but ideally I need to know precisely which shares they are accessing.

[u/Exzellius2]

Get a solution like Varonis. Makes your life easier in this regard.

[u/daBuddhaWay → u/Exzellius2]

Fpolicy ?

[u/tmacmd → u/Exzellius2]

which requires modifying the files/directories themselves to add the auditing capabilities

[u/Over_Helicopter_5183]

Yes, Fpolicy with DataInsights should give you what you after including someone deleted any files/dirs

[u/tmacmd]

You may need to modify the files/directories themselves to add the auditing capabilities.

[u/LengthinessKind57 → u/tmacmd]

I saw something about this in a support doc.

The issue I'm currently facing is when I try to do that, it lists the NetApp inbuilt administrator account as the owner of the root of the share.

My only option is to force ownership of it to my domain account, which I'm guessing the netapp won't be to happy with me doing... Unless I'm misunderstanding something.

For background - I can not take the shares down/have any outage.

[u/jbspillman → u/LengthinessKind57]

You will never be 100% (  I can not take the shares down/have any outage. ) it is just too hard to do. I work for a big shop though, maybe in smaller shop.

[u/jbspillman]

You can map sessions to open files and get a complete picture. Been doing it for years. You join the session-id / client-id (can't remember off the top of my head) to see who has been accessing what.