I installed the MMC from the Celerra Application and Tools CD. Unfortunately, the auditing is disabled by default, but now I can enable it to log future events. Thanks for pointing me in the right direction.

How can I determine if auditing is enabled? I assume there is a checkbox in Celerra Manager.

take a look at this thread

https://community.emc.com/message/380348#380348

Did you look into enabling auditing on the CIFS server ?

you are welcome

make sure you take a look at the Celerra CIFS manual - you will most likely also want to move and enlarge the event log

For more automated needs there are also addon solutions available in that area:

• EMC Data Protection Advisor - pulls config, performance and other info and put them into a database and generates reports - also has a change control report
  
  
• EMC RSA Envision to store and analyze large volumes of logs and events
  
  
• Varonis DatAdvantage for analysis of permissions
  
  

Rainer

Hi,

We are running  5.6.50-2 and have all auditing enabled on the datamover yet nothing as far as changing permissions, deleting files, etc get's logged in the security log. Recently someone changed perms on a multiprotocol share which affected several developers on a key project, and when security came a knockin, we looked at the logs to find the culprit. Nothing was logged. Group policy auditing settings were already making the effective settings "success,failure" for all, and of course checking the boxes for the "current setting" was futile. Is this by design or a serious flaw in what should be normal CIFS auditing?

thanks

I see. I guess I figured that would have been inherited from our domain policies for any shares created. I'll do some testing but I'm sure that is it.

thanks

did you actually enable auditing on the shares/folders ?  Enabling auditing on the datamover itself is not sufficient.