由于缺少 SACL，CIFS 审核无法按预期工作

最后更新
另存为PDF

Views:: 94

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

适用于

ONTAP 9
CIFS 审计

问题

未生成任何文件访问审核事件
- 登录事件和注销事件可能会被看到
文件名未在审核事件中显示
vserver security file-directory卷或 CIFS 共享上未显示 SACL

::> vserver security file-directory show -vserver svm_netapp -path /vol_netapp -instance

Vserver: svm_netapp

File Path: /vol_netapp

File Inode Number: 64

Security Style: ntfs

Effective Style: ntfs

DOS Attributes: 10

DOS Attributes in Text: ----D---

Expanded Dos Attributes: -

UNIX User Id: 0

UNIX Group Id: 0

UNIX Mode Bits: 777

UNIX Mode Bits in Text: rwxrwxrwx

ACLs: NTFS Security Descriptor

Control:0x9504

Owner:BUILTIN\Administrators

Group:BUILTIN\Administrators

DACL - ACEs

ALLOW-NT AUTHORITY\SYSTEM-0x1f01ff-OI|CI

ALLOW-BUILTIN\Administrators-0x1f01ff-OI|CI

ALLOW-Everyone-0x1f01ff-OI|CI

审核设置正确：

::*> vserver audit show -vserver svm1 -fields events vserver events ---------- -------------------------------------------------------------------------- svm1 file-ops,cifs-logon-logoff,user-account,security-group,audit-policy-change