NFS 删除操作的审核事件中包含哪些信息？

• ONTAP 9
• NFS 审核

• 在审核 NFS 文件删除时将记录以下数据：
  • SubjectIP，IPVersion
  • SubjectUnix，Uid，Gid，Local
  • SubjectUserSid
  • SubjectUserIsLocal
  • SubjectDomainName
  • SubjectUserName
  • ObjectServer
  • ObjectType
  • HandleID
  • ObjectName
  • InformationSet
• 注意：此架构无法更改。
• 有两个选项查看审核：xml 或 evtx。  XML 可供任何客户端查看。而对于 evtx，要查看它，请使用 windows 审核日志查看器
• 以下是"文件删除"的样子

<Event><System><Provider Name="Netapp-Security-Auditing"/><EventID>9998</EventID><EventName>Unlink Object</EventName><Version>101.2</Version><Source>NFSv3</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2015-12-02T01:00:36.142467000Z "/><Correlation/><Channel>Security</Channel><Computer>7f88b548-45ef-11e5-a549-005056923487/72ea833a-46d4-11e5-a549-005056923487</Computer><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">172.18.83.90</Data><Data Name ="SubjectUnix" Uid="1000" Gid="200" Local="false"></Data><Data Name="SubjectUserSid">S-1-5-21-315225131-152720833-1400237508-500</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">Not Present</Data><Data Name="SubjectUserName">Not Present</Data><Data Name="DirHandleID">00000000000402;00;00000bc6;000d18d5</Data><Data Name="FileName">(musica);/Gustav Mahler/this_is_a_test_dir/ntp.conf </Data><Data Name="SearchFilter"></Data></EventData></Event>

• Unlink Object是一个删除项。这将显示进行删除的人员的时间、源IP地址、用户ID和组ID号，以及文件名
• 以下是权限更改：

<Event><System><Provider Name="Netapp-Security-Auditing"/><EventID>4663</EventID><EventName>Set Object Attributes</EventName><Version>101.3</Version><Source>NFSv4</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2015-12-02T00:59:06.790210000Z"/><Correlation/><Channel>Security</Channel><Computer>7f88b548-45ef-11e5-a549-005056923487/72ea833a-46d4-11e5-a549-005056923487</Computer><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">172.18.83.50</Data><Data Name="SubjectUnix" Uid="1000" Gid="200" Local="false"></Data><Data Name="SubjectUserSid">S-1-5-21-315225131-152720833-1400237508-500</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">Not Present</Data><Data Name="SubjectUserName">Not Present</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">File</Data><Data Name="HandleID">00000000000402;00;0000065e;009be8aa</Data><Data Name="ObjectName">(musica);/Gustav Mahler/Symphony No. 9 [Disc 1 of 2] - Leonard Bernstein Royal Concertgebouw Orchestra/1-01 Mahler_ Symphony #9 In D - 1A..mp3</Data><Data Name="InformationSet">NFS4 ACL; </Data></EventData></Event>

• 这就是从 evtx 中权限更改的样子。