You can enable or disable auditing on Storage Virtual Machines (SVMs). You might want to temporarily stop file and directory auditing by disabling auditing. You can enable auditing at any time (if an auditing configuration exists).
Disabling auditing does not delete the auditing configuration.
| If you want auditing to be... | Enter the command... |
|---|---|
| Enabled | vserver audit enable -vserver vserver_name |
| Disabled | vserver audit disable -vserver vserver_name |
The following example enables auditing for SVM vs1:
cluster1::> vserver audit enable -vserver vs1
cluster1::> vserver audit show -vserver vs1
Vserver: vs1
Auditing state: true
Log Destination Path: /audit_log
Categories of Events to Audit: file-ops, cifs-logon-logoff
Log Format: evtx
Log File Size Limit: 100MB
Log Rotation Schedule: Month: -
Log Rotation Schedule: Day of Week: -
Log Rotation Schedule: Day: -
Log Rotation Schedule: Hour: -
Log Rotation Schedule: Minute: -
Rotation Schedules: -
Log Files Rotation Limit: 10
The following example disables auditing for SVM vs1:
cluster1::> vserver audit disable -vserver vs1
Vserver: vs1
Auditing state: false
Log Destination Path: /audit_log
Categories of Events to Audit: file-ops, cifs-logon-logoff
Log Format: evtx
Log File Size Limit: 100MB
Log Rotation Schedule: Month: -
Log Rotation Schedule: Day of Week: -
Log Rotation Schedule: Day: -
Log Rotation Schedule: Hour: -
Log Rotation Schedule: Minute: -
Rotation Schedules: -
Log Files Rotation Limit: 10
