You can specify when automatic saves occur, the maximum number of automatically-saved files, and the maximum size of the cifsaudit.alf file. You can also clear the cifsaudit.alf file.
More information
Where Data ONTAP logs audit event information
Audit event information is stored in an internal log file, /etc/log/cifsaudit.alf. If you do not use Live View, you should periodically save the contents of this file to an external EVT event log file either manually or by setting up automatic saving of this file.
Size and format of the internal and external log files
You can specify the maximum size of the internal cifsaudit.alf log file between 524,288 bytes (512K) and 68,719,476,736 bytes (64 GB). The default size is 524,288 bytes.
Data ONTAP event log updates
Data ONTAP updates the event log under certain conditions to ensure that audit event information is saved.
Automatic saving of audit events
You can specify that the storage system saves audit events automatically to the event log based on a time interval or the size of the internal log file—that is, how full the cifsaudit.alf file is.
SNMP traps for auditing events
Data ONTAP includes SNMP traps to provide a trigger for certain actions (such as notification) based on information about certain auditing events.
Clearing the cifsaudit.alf file
If you want to remove existing information and start over with an empty log file, you can use the cifs audit clear command to clear the internal cifsaudit.alf file.