"Nnot present (不存在)"在NAS审核日志中显示为用户名
适用场景
- ONTAP 9
- CIFS
- CIFS审核
问题描述
CIFS审核日志不会显示用户名或服务帐户，而是显示标记为Not Present条目。
示例：
<Event>
<System>
<Provider Name="NetApp-Security-Auditing" Guid="{}"/>
<EventID>4663</EventID>
<EventName>Get Object Attributes</EventName>
<Version>101.2</Version>
<Source>NFSv3</Source>
<Level>0</Level>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<Result>Audit Success</Result>
<TimeCreated SystemTime="2025-01-01T00:00:00.0000000Z"/>
<Correlation/><Channel>Security</Channel>
<Computer>domain/computername</Computer>
<ComputerUUID>000000-000000-0000-0000-000000000000/000000-000000-0000-0000-000000000000</ComputerUUID>
<Security/>
</System>
<EventData>
<Data Name="SubjectIP" IPVersion="4">1.1.1.1</Data>
<Data Name="SubjectUnix" Uid="0" Gid="0" Local="false"></Data>
<Data Name="SubjectUserSid">S-0-0-0-0000000000-000000000-0000000000-000000</Data>
<Data Name="SubjectUserIsLocal">false</Data>
<Data Name="SubjectDomainName">Not Present</Data>
<Data Name="SubjectUserName">Not Present</Data>
<Data Name="ObjectServer">Security</Data>
<Data Name="ObjectType">Directory</Data>