Change Auditor for NetApp 7.2 - Event Reference Guide

Introduction

Change Auditor for NetApp tracks, audits and alerts on file and folder changes in real time, translating events into simple text and eliminating the time and complexity required by system provided auditing. The auditing scope can be set on an individual file or folder or an entire file system recursive or non-recursive. You can also include or exclude certain files or folders from the audit scope in order to ensure a faster and more efficient audit process.

In addition to real-time event auditing, you can also enable event logging to capture NetApp filer events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

NOTE: NetApp Filer auditing and event logging are only available if you have licensed Change Auditor for NetApp and have applied a NetApp Auditing template for each NetApp filer to be audited. Contact your Sales Representative for more information on obtaining Change Auditor for NetApp.

This guide lists the events that can be captured by Change Auditor for NetApp. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for NetApp Events

Change Auditor for NetApp queries NetApp filers for modifications made to files and folders. This auditing functionality is based on NetApp’s Data ONTAP file screening policy (FPolicy), which allows third-party screening software to interact with the NetApp filer. This section lists the audited events captured by Change Auditor when Change Auditor for NetApp is licensed and a NetApp auditing template is created for each NetApp filer to be audited. These events are listed in alphabetical order by facility.

IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.

NOTE: To view a complete list of all events, open the Audit Events page on the Administration Tasks tab in the client. This page contains a list of all the events available for auditing. It also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.

See Notes and Performance Considerations for strategies to help minimize performance issues.

Log Events

When event logging for NetApp is enabled in Change Auditor, NetApp filer events will also be written to a Windows event log, named ChangeAuditor for NetApp. This event log can then be gathered by InTrust and Quest Knowledge Portal for further processing and reporting.

NOTE: To enable event logging, select Event Logging on on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to enable.

The following table lists the log events captured when NetApp event logging is enabled. They are listed in numeric order by event ID.

Notes and Performance Considerations

This section contains a numerical list of notes for Change Auditor for NetApp events.

File changes to a NetApp filer initiated from the server hosting the Change Auditor agent responsible for capturing NetApp events will NOT be reported by the filer. This is a limitation of the NetApp filer’s FPolicy and not a limitation of Change Auditor.

ONTAP 7.3 (or later) is required to monitor permission change events.

Events are generated as described below when actions are taken on folders that have subordinate files and folders:

If a parent folder is copied to a target folder that is not being monitored, no event will be generated. The target folder must be monitored in order for an event to be generated.

For better performance:

Security events do not return a ‘From’ value. The security events that return a ‘From’ value require synchronous event exchange and can have a negative impact on performance. Whereas, the ‘no from-value’ events allow Change Auditor to connect and use asynchronous interfaces.

You may improve performance by assigning a NetApp Auditing template to more than one agent. When multiple agents are assigned to the same template, events are load-balanced between these agents. However, the downside is that the ‘where’ field for NetApp events may contain any one of the agents being monitored by this single auditing template. In addition, if NetApp event logging is enabled in Change Auditor, events will be written on multiple agent servers.

If a NetApp filer is not available, the agent will retry the connection every 10 minutes.