Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor for NetApp 7.0.1 - User Guide

Table of Contents

Change Auditor for NetApp Overview

Introduction System overview Deployment requirements FPolicy limitation Client components and features

Getting Started

Introduction Verify auditing template is applied Make changes and run a report Troubleshooting steps

NetApp Filer Auditing

Introduction NetApp Auditing page NetApp Auditing templates NetApp Auditing wizard File System events settings NetApp event logging

NetApp Searches/Reports

Introduction Create custom NetApp searches

Performance Considerations

Change Auditor agent performance Configuring audit scope

NetApp Filer Events File and Folder Inclusion and Exclusion Examples

Inclusions tab Exclusions tab

Folder exclusion examples Volume exclusion examples All volume exclusion examples

Folder exclusion examples

Audit Path = Folder (<ShareName>\<FolderName>) exclusion examples

In the following examples the Audit Path is HOME\TEMP.

Table 4. Exclusion examples: Audit Path = Folder
What to exclude	Exclusion syntax/examples
Exclude activity against files/subfolders in the specified folder in the base audit path. (Add \| Folder)	Exclusion Syntax: <FolderName> Example: DOCS Excludes: HOME\TEMP\DOCS
Exclude activity against files/subfolders in all folders that contain a specific string in their name, which are located in the base audit path. (Add \| Folder)	Exclusion Syntax: <FolderNameString> Example 1: DOC* Excludes: HOME\TEMP\DOCS HOME\TEMP\DOCUMENTS Example 2: DOC Excludes: HOME\TEMP\MYDOC Example 3: DOC? Excludes: HOME\TEMP\DOCS HOME\TEMP\MYDOCX HOME\TEMP\PUBLICDOCS
Exclude activity against files/subfolders in all folders with a specific name found anywhere in the audit path. (Add \| Folder)	Exclusion Syntax: \<FolderName> Example: \MYDOC Excludes: HOME\TEMP\MYDOC HOME\TEMP\DOCUMENTS\MYDOC HOME\TEMP\DOCS\PRIVATE\MYDOC
Exclude activity against a specific file in the base audit path. (Add \| File)	Exclusion Syntax: <FileName.ext> Example: Test1.docx Excludes: HOME\TEMP\Test1.docx
Exclude activity against all files with a specific extension, which are located in the base audit path. (Add \| File)	Exclusion Syntax: .<ext> Example: .tmp Excludes: HOME\TEMP\Doc1.tmp HOME\TEMP\Testing123.tmp
Exclude activity against all files with a specific file extension, which may be found anywhere in the audit path. (Add \| File)	Exclusion Syntax: .<ext> Example: .tmp Excludes: HOME\TEMP\Doc1.tmp HOME\TEMP\DOCUMENTS\Testing.tmp
Exclude activity against all files that contain a specific string in their name and/or file extension, which are located in the base audit path. (Add \| File)	Exclusion Syntax: <FileNameString>.<ExtString> Example 1: ??word.??? Excludes: Files whose name contains six characters and ends in ‘word’, with a three character file extension. HOME\TEMP\Myword.doc HOME\TEMP\12word.txt Example 2: word.??p Excludes: Files whose name contains the string ‘word’, with a three character file extension that ends with the letter ‘p’. HOME\TEMP\Word.tmp HOME\TEMP\Mywordtest.tmp HOME\TEMP\Nowords.bmp

Volume exclusion examples

Audit Path = Volume (<VolumeName>) exclusion examples

In the following examples, the volume name is Vol0 (Audit Path = Vol0); share names are HOME, SHARE2, and SHAREDDOCS.


	NOTE: Volume names are case sensitive and must be entered correctly in the Audit Path field on the auditing wizard.


	NOTE: When auditing an individual volume or all volumes, you must include the share name (or a file mask to represent the share) in the exclusion path.


	NOTE: If a file exclusion is added that does not include a slash (\), it will be automatically appended with "\.".

Table 5. Exclusion examples: Audit Path = Volume
What to exclude	Exclusion syntax/examples
Exclude activity against files/subfolders in a specific folder found in a specific location on the selected volume. (Add \| Folder)	Exclusion Syntax: <ShareName>\<Path>\<FolderName> Example: HOME\USERS\TEMP\DOCS Excludes: Vol0\HOME\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders whose name contains a specific string of characters found in a specific location on the selected volume. (Add \| Folder)	Exclusion Syntax: <ShareName>\<Path>\<CharString> Example: HOME\USERS\TE?????DOCS Excludes: Vol0\HOME\USERS\TESTINGDOCS Vol0\HOME\USERS\TEMPORARYDOCS
Exclude activity against files/subfolders in all folders with the specified folder name which is located on a specific share. (Add \| Folder)	Exclusion Syntax: <ShareName>\\<FolderName> Example: HOME\\DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders whose name starts with a specific string of characters which are located on a specific share. (Add \| Folder)	Exclusion Syntax: <ShareName>\*\<CharString> Example: HOME\*\DOC Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\HOME\USERS\DOCUMENTS
Exclude activity against files/subfolders in all folders with the specified folder name found in a specific path level on all shares on the selected volume. (Add \| Folder)	Exclusion Syntax: \\<FolderName> Example 1: \\DOCS Excludes: Vol0\HOME\USERS\DOCS Vol0\HOME\DEPTS\DOCS Vol0\SHARE2\TEST\DOCS Example 2: \\*\DOCS Excludes: Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARE2\PUBLIC\TEST\DOCS
Exclude activity against files/subfolders in all folders with the specified folder name which may be located anywhere on the selected volume. (Add \| Folder)	Exclusion Syntax: \<FolderName> Example: \DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARE2\TEST\DOCS Vol0\SHARE2\PUBLIC\TEST\DOCS
Exclude activity against files/subfolders in all shares and folders whose name contains a specific string of characters which may be located anywhere on the selected volume. (Add \| Folder)	Exclusion Syntax: *<CharString> Example: *DOC Excludes: Vol0\HOME\DOCS Vol0\HOME\MYDOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\HOME\USERS\TEMPORARYDOCS Vol0\SHARE2\TEST\DOCS Vol0\SHARE2\PUBLIC\TEST\MYDOCS Vol0\SHAREDDOC
Exclude activity against files whose name contains a specific string of characters which may be found anywhere on the selected volume. (Add \| File)	Exclusion Syntax: *\<CharString>* Example: *\DOC* Excludes: Vol0\HOME\Document1.tmp Vol0\HOME\FILES\Testing.doc Vol0\HOME\USERS\TEMP\FILES\BetaDoc.pdf Vol0\SHARE2\USERS\DECEMBER\Test1.docx Vol0\SHARE2\PUBLIC\MARCH\OldDocPlan
Exclude activity against a specific file found in a specific location on the selected volume. (Add \| File)	Exclusion Syntax: <ShareName>\<Path>\<FileName.Ext> Example: SHARE2\USERS\DOCS\Test1.docx Excludes: Vol0\SHARE2\USERS\DOCS\Test1.docx
Exclude activity against files with a specific file name (regardless of the file extension) which may be located anywhere on the selected volume. (Add \| File)	Exclusion Syntax: *\<FileName>. Example: *\test1. Excludes: Vol0\HOME\DEPTS\DOCS\test1.docx Vol0\HOME\USERS\TEMP\DOCS\test1.docx Vol0\HOME\USERS\DOCUMENTS\test1.pdf Vol0\SHARE2\TEST\DOCS\test1.txt
Exclude activity against files with the specified file extension found in a specific location on the selected volume. (Add \| File)	Exclusion Syntax: <ShareName>\<Path>\.<Ext> Example: SHARE2\TEST\DOCS\.docx Excludes: Vol0\SHARE2\TEST\DOCS\Test1.docx Vol0\SHARE2\TEST\DOCS\MyInfo.docx
Exclude activity against files with the specified file extension which may be located anywhere on the selected volume. (Add \| File)	Exclusion Syntax: *\.<Ext> Example: *\.pdf Excludes: Vol0\HOME\MYDOCS\Final.pdf Vol0\HOME\DEPTS\DOCS\Test123.pdf Vol0\HOME\USERS\DOCUMENTS\Test1.pdf Vol0\SHARE2\TEST\DOCS\Current.pdf Vol0\SHARE2\PUBLIC\TEST\MYDOCS\Ex.pdf

All volume exclusion examples

Audit Path = All Volumes exclusion examples

In the following examples, Vol0 contains three shares: HOME, SHARE2 and SHAREDDOCS; and Vol1 contains one share: SHAREDAPPS.


	NOTE: When using All Volumes, you cannot exclude an individual volume. You must use a share name, which is unique to a volume. That is, you cannot have two shares with the name of HOME (either on the same volume or different volumes).


	NOTE: When auditing an individual volume or all volumes, you must include the share name (or a file mask to represent the share) in the exclusion path.

Table 6. Exclusion examples: Audit Path = All Volumes
What to exclude	Exclusion syntax/examples
Exclude activity against files/subfolders in a specific folder found in a specific location on all volumes. (Add \| Folder)	Exclusion Syntax: \<Path>\<FolderName> Example: \USERS\TEMP\DOCS Excludes: Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARED2\USERS\TEMP\DOCS Vol1\SHAREDAPPS\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders with the specified folder name found on a specific share. (Add \| Folder)	Exclusion Syntax: <ShareName>\\<FolderName> Example: HOME\\DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders whose name starts with a specific string of characters found on a specific share. (Add \| Folder)	Exclusion Syntax: <ShareName>\*\<CharString> Example: HOME\*\DOC Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\HOME\USERS\DOCUMENTS
Exclude activity against files/subfolders in all folders with the specified folder name found anywhere on all volumes. (Add \| Folder)	Exclusion Syntax: \<FolderName> Example: \DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARE2\TEST\DOCS Vol1\SHAREDAPPS\DOCS
Exclude activity against files/subfolders in all folders with the specified folder name found at a specific level on all volumes. (Add \| Folder)	Exclusion Syntax: \\<FolderName> Example 1: \\DOCS Excludes: Vol0\HOME\DEPTS\DOCS Vol0\SHARE2\TEST\DOCS Vol1\SHAREDAPPS\INSTALL\DOCS Example 2: \\*\DOCS Excludes: Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARED2\PUBLIC\TEST\DOCS Vol1\SHAREDAPPS\PROCS\INTRO\DOCS
Exclude activity against files/subfolders in all shares and folders whose name ends with a specific string of characters that may be located anywhere on all volumes. (Add \| Folder)	Exclusion Syntax: <CharString> Example: DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\MYDOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\HOME\USERS\TEMPORARYDOCS Vol0\HOME\USERS\TEMP\TESTINGDOCS Vol0\SHARE2\TEST\DOCS Vol0\SHARE2\PUBLIC\TEST\DOCS Vol0\SHAREDDOCS Vol1\SHAREDAPPS\INSTALL\DOCS Vol1\SHAREDAPPS\PROCS\INTRO\DOCS
Exclude a specific file found in a specific location on the specified share. (Add \| File)	Exclusion Syntax: <ShareName>\<Path>\<FileName.Ext> Entering: SHARE2\USERS\DOCS\Test1.docx Excludes: Vol0\SHARE2\USERS\DOCS\Test1.docx
Exclude activity against all files with the specified file extension found in a specific location on the specified share. (Add \| File)	Exclusion Syntax: <ShareName>\<Path>\.<Ext> Entering: SHARE2\TEST\DOCS\.docx Excludes: Vol0\SHARE2\TEST\DOCS\Test1.docx Vol0\SHARE2\TEST\DOCS\123testing.docx
Exclude activity against all files with the specified file extension found anywhere on all volumes. (Add \| File)	Exclusion Syntax: *\.<Ext> Example: *\.pdf Excludes: Vol0\HOME\DEPTS\DOCS\Test123.pdf Vol0\SHARE2\TEST\DOCS\Current.pdf Vol1\SHAREDAPPS\WhatsNew.pdf
Exclude a specific file (regardless of the file extension) found anywhere on the all volumes. (Add \| File)	Exclusion Syntax: *\<FileName>. Entering: *\test1. Excludes: Vol0\HOME\DEPTS\DOCS\test1.docx Vol0\HOME\USERS\TEMP\DOCS\test1.docx Vol0\HOME\USERS\DOCUMENTS\test1.pdf Vol0\SHARE2\USERS\DOCS\test1.txt Vol1\SHAREDAPPS\test1.xlsx

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center